“It is not the strongest of the species that survives, nor the most intelligent, but the one most responsive to change.” – Charles Darwin

The New Reality of Risk

The world today is increasingly volatile, unpredictable, and unstable. The assumption that conditions will remain steady from one year to the next no longer holds true. In recent years, we have witnessed the global disruption caused by COVID-19, the ongoing war in Ukraine, the conflict in Israel and Gaza, and rising tensions among major global powers. These are not isolated events; they are signals of a broader pattern of instability reshaping the global landscape.

Each of these crises has had a profound impact on economies, supply chains, and business operations. Goods and services once taken for granted can quickly become scarce, while essential commodities fluctuate in both price and availability. This shifting environment is forcing organisations to fundamentally rethink how they operate and how they prepare for disruption.

Building Resilience in a Volatile World

In this context, operational resilience and third-party risk management are critical to survival. Businesses must understand not only their direct suppliers, but also the extended supply chains beneath them. Mapping dependencies, identifying concentrations of risk, and establishing viable alternatives are now key sources of competitive advantage.

Traditional assurance mechanisms, such as SOC 2 reports, remain valuable, but they are not sufficient on their own. They offer a point-in-time view of controls, not a measure of resilience under real-world stress. What is required is continuous monitoring of third-party risk, supported by strong controls and a defence-in-depth approach.

Resilience planning must also evolve. Static business continuity plans are no longer enough. Organisations need dynamic, scenario-based testing that reflects real-world crises plans that have effectively been “tested in anger” across multiple scenarios to ensure they can withstand disruption when it matters most.

The Power and Limitations of Frameworks

Regulatory frameworks such as the EU’s NIS2 Directive mark this shift. Critical sectors including energy, infrastructure, and utilities are now required to demonstrate integrated risk management, robust governance, incident reporting capabilities, digital resilience testing, and effective oversight of third-party risk. They are also expected to collaborate, sharing intelligence on emerging cyber threats.

However, NIS2 should not be viewed as relevant only to critical industries. It represents a set of best practices forged from hard-learned lessons in an increasingly hostile environment. From state-sponsored cyberattacks to disruptions in energy supply and targeted attacks on infrastructure, these risks are becoming more frequent, more coordinated, and more sophisticated.

No framework can eliminate risk entirely. But by adopting these principles, organisations can equip themselves with the tools needed to navigate uncertainty. Those that invest in resilience, visibility, and adaptability will be far better positioned not only to survive, but to thrive in the face of future disruption.

The challenge now is simple, but uncomfortable: if a critical supplier failed tomorrow, if a key region became inaccessible, or if a cyberattack disrupted your operations would your organisation continue to function, or would it pause, scramble, and react? The difference between those outcomes will not be luck. It will be preparation. The organisations that ask and answer these questions today are the ones that will define tomorrow.

“Risk management is how you prepare for the unexpected, not how you safeguard against it.” – David Einhorn

The post Reactive vs Adaptive GRC: The Key to Building Operational Resilience appeared first on Wrangu.

About the Author

2. Recreating Legacy Processes

Adopt and adapt, don’t replicate the past.

Legacy thinking is the single biggest barrier to IRM success. Organisations often feel compelled to re-create their old tool configurations, reports, and workflows within a new platform.

This defeats the purpose of transformation. Implementing IRM should be an opportunity to question why processes exist, not simply how to reproduce them.

Challenge legacy habits. The real value comes from redesigning risk management processes for today’s needs, not rebuilding the past in a new system.

3. Scaling Too Quickly

Start small, prove impact, then expand.

IRM maturity is not achieved overnight, it is a multi-year transformation. Equally, organisations cannot wait years to demonstrate value.

The most successful initiatives begin with focused, high-yield pilots. Start with a small number of critical business processes, the organisation’s “crown jewels”, and deliver measurable outcomes within the first three to six months.

Early success builds credibility, secures ongoing funding, and creates the momentum needed to scale the programme sustainably.

4. Shaky Foundations

Lay foundations capable of supporting strategic growth.

IRM transformations unfold in phases, and each phase must align to a well-defined target operating model. Early design decisions, particularly around data structures, taxonomies, and governance, determine how effectively the programme can scale later.

Both a skyscraper and a bungalow require solid foundations, but they are engineered very differently. Before you begin building your IRM programme, be clear about which one you intend to construct.

5. Overly Complex Scope

Only capture what’s essential for oversight and control.

One of the most common pitfalls in IRM implementations is over-scoping. Trying to model every asset, control, or process quickly creates unnecessary complexity and slows adoption.

Instead, right-size your scope to what is required for meaningful governance, assurance, and insight.

Granularity should enable better decision-making, not burden teams with excessive administration.

6. Reinventing The Wheel

Industry standards accelerate maturity.

Reinventing frameworks from first principles wastes valuable time. Industry models such as ISO, COSO, NIST, and others are proven, mapped to multiple regulations, and widely accepted by auditors and regulators alike.

Adopting them as a baseline enables consistency, comparability, and faster maturity without sacrificing customisation where it truly matters.

7. Failure to Treat Risk Management as Data-Driven

Data enables consistency, automation, and informed decisions.

Effective Integrated Risk Management is data-driven, not document-driven. Organisations should use existing enterprise data to power workflows, identify trends, and inform policies.

Automation should be applied wherever logic and validation can replace manual review. This frees human capacity for higher-value activities such as analysis, foresight, and strategic decision-making.

8. Underestimating Cultural Change

Tools don’t change culture, leaders do.

Technology alone will not transform a risk culture.

Successful IRM programmes require visible senior sponsorship, sustained investment in change management, and clear communication across the organisation. Training, incentives, and messaging must reinforce that IRM is part of how the business operates, not just another reporting requirement.

Without engagement at every level, even the most advanced platforms fail through lack of adoption.

9. Unrealistic Expectations About Speed

IRM implementations take time because changing behaviour takes time. Specialist capabilities, expert configuration, and stakeholder alignment all require deliberate effort.

If speed is essential, accept that disruption will follow. Sometimes the fastest path is a clean start, leaving historical data and legacy processes behind in favour of a modern, scalable model.

The Bottom Line:

IRM is not about technology; it’s about resilience.

Success depends on aligning people, data, process, and purpose, supported by technology that amplifies, not defines, capability. Organisations that treat IRM as an evolving business discipline, rather than a software project, will ultimately build stronger, more adaptive enterprises ready for the risk landscape ahead.

The post 9 Reasons Integrated Risk Management Programmes Fall Short appeared first on Wrangu.

About the Author

Yes, AI is here. Yes, it promises to transform the governance, risk, and compliance (GRC) landscape. But let’s face it, are you truly ready to harness its power?

Throughout my career, I’ve worked with organisations of all shapes and sizes, from multinational giants to agile start-ups. Yet few were truly prepared for AI to solve their challenges. Why? Because they lacked the foundations needed for AI to deliver meaningful results.

Many have purchased AI tools. But have they solved their problems? No. AI cannot work in isolation.

The Real Potential of AI in GRC

Used effectively, AI can streamline core GRC processes that have traditionally been time-consuming and manual:

Foundation 2 → Data Readiness

Next, and most critically, you need data that is reliable, consistent, and usable to train AI models effectively. AI is a powerful tool, but it is not a silver bullet. As Grady Booch wisely said, “A fool with a tool is still a fool.”

In my experience, organisations tend to fall into one of these categories:

• Too siloed and fragmented, burdened by disparate processes and years of unaligned data.
• Moving from spreadsheets with ambition but no foundational systems or long-term vision.
• Stuck on outdated tools, eager for modernisation but trapped by archaic processes.

Or, often, a mix of all three.

Data is the foundation on which the AI house is built, it must be strong, or it will collapse. Preparing the ground and understanding the data you have is important before you start.

Foundation 3 → A Shared, Long-Term Vision

Successful AI adoption requires vision, communication, and cooperation.

Like all major GRC projects, this is not a one-and-done effort. Sponsors must recognise that managing risk, like maintaining security, is continuous. It demands investment in organisational change management, cultural transformation, and a unified vision with interconnected processes driving a common goal:

To mitigate uncertainty and empower the business to thrive.

Whether you follow the three lines of defence, four, or five, it doesn’t matter. What matters is that processes are structured, embedded, and adopted.

Just as data analytics required a clear purpose before creating measurable impact, AI needs a defined vision before it can deliver value.

Foundation 4 → Governance, Structure, and Accountability

AI algorithms are only as effective as the data and governance behind them. Quality, ethics, and robustness are vital for trustworthy outcomes. Frameworks such as the EU AI Act, the OECD AI Principles, and the NIST AI Risk Management Framework all highlight this importance.

Organisations need:

• Data and AI governance – Clear accountabilities and standardised processes for data management.
• Transparency and explainability – AI decisions must be understandable and auditable.
• Fairness, safety, and accountability – Systems must be designed to avoid bias, prevent harm, and ensure responsibility.
• Leadership and vision – Strong oversight to align AI initiatives with organisational strategy.
• Training and iteration – Ongoing refinement to improve accuracy and relevance.
• Collaboration and skills – The ability to work effectively with AI, including prompt design and critical evaluation of outputs.

Those of us in the GRC field bear a special responsibility. Governance and ethical guardrails are essential to realising AI’s potential while protecting the integrity of our organisations and the data we manage.

As Jason Lemkin aptly put it, “AI agents are incredibly powerful, but they cannot be trusted, and that is by design. If you want to use AI agents, you need to 100% understand what data they can touch, because they will touch it, and you cannot predict what they will do with it.”

AI can and will transform GRC, but only for those who lay the groundwork, building the systems, culture, and data foundation that allow the technology to shine.

The post Making AI Work for GRC: The Key Foundations for Success appeared first on Wrangu.

They literally hold everything together.

• If you want to show your compliance to regulations, you need them as they connect to citations, and control tests.
• If you want to mitigate your risks consistently you need them, as they will be linked to risk statements.
• If you want to populate policies and reduce duplication and extra effort, you need them. As they form the bulk of a policies content.

Just like the foundations of IRM, Control objectives can be the key between a powerful and valuable IRM implementation and a mediocre and impact installation.

Let’s look at why we need to use control objectives and why putting that little extra time and effort will add so much.

Let’s build a scenario, you have your Authority document from the regulator, it’s broken down into its citations and the words are in legalise. So you start analysing and asking questions:

• You know you must do something; it tells you what to do but it doesn’t tell you exactly how to do it.
• Maybe your company has regulation experts such as the privacy experts Wrangu has?
• In which case they will have told you what their interpretation of regulation is and what each citation is looking for.
• Maybe you are using downloaded the content?
• All that is a start, but now comes the hard part.
• Are you already doing this or not?
• How do you know?
• Is there something in a policy you have already implemented that would cover this?

That’s where Control Objectives come in.

Multiple citations can be linked to a control objective, if you are using UCF (Unified Compliance Framework) you probably already know this. You probably also know that the content provider control objectives are usually light touch and minimal.

They are a starting point.

What I feel is a huge mistake, which I commonly see, is people trying to use them as they are… DONT!

Now bear with me, I am asking you to take time and do some more work up front, but I promise you there is a very good reason.

Because Control Objectives are so key, the deserve time spent on them to make them work properly.

They are the voice of the company, explaining to employees how to implement a control, not the regulation but how YOU, YOUR company intends to comply with the regulation it.

The more information, guidance and support you put in these records, the better you will find your end users, your team will understand what is being asked of them and make the right call.

Knowledge is power and here is a prime example of putting that power in the hands of your teams.

The more detail and clarity you put in the control objectives the easier it will be to understand if it meets multiple regulations.

The more detail and clarity you put in the control objectives the more value the policies you generate from control objectives will be.

You will be able to publish them in confidence and be able to search through them with a greater degree of success.

The better your control objectives the easier it will be to map the to the right risk statements and feel confident in mitigating threats against your business.

Good quality control objectives can be the difference between a poor and a great experience on the ServiceNow IRM platform.

So, whether a customer or a ServiceNow consultant.

The next time the question comes up, give control objectives the respect they deserve.

I promise you; you won’t regret it.

They are after all, the golden thread that links everything together.

I borrowed the phrase from a client, he knows who he is and I hope he doesn’t mind, as it was too good to pass up.

Disclaimer: This content was not produced using AI but it the random outpouring of my brain which I hope was of use to someone.

The post Control objectives, the golden thread of IRM appeared first on Wrangu.

After a long fight with the COVID-19 virus, we seem to be slowly emerging from the long winter of our discontent. Governments are slowly working to approve, distribute, and administer vaccines while reducing restrictions imposed on citizens. Along with this, there are a growing number of proposals for digital vaccine certificates. Often these proposals link the vaccination status of an individual with a government-provided digital identifier to record and authenticate an individual’s vaccination status.  

As digital vaccine certificates emerge, governments and private organisations will restrict access to services and shared spaces based on an individual’s status, excluding those who have not received the vaccine. These initiatives will require large-scale data collection and processing of sensitive health data creating the infrastructure for new forms of surveillance.  

Public health authorities have a history of issuing vaccine certificates and maintaining vaccine records. Yellow fever vaccination certificates are used in international travel under International Health Regulations and administered by the World Health Organization. Beyond serving as proof of an individual’s vaccine status, it also contributes to avoiding duplicate vaccinations and facilitating proper administration of multiple doses. Similar systems are widely used around the world. When access to travel or public services is made contingent on having a vaccine, clear legal policies ensure equitable access to the required vaccines.  

Proponents of digital vaccine certificates argue the need to prevent the creation of fraudulent records as well as making the certificates available to organisations ranging from custom and borders control to small business owners. These apps also offer a contact point for other services such as reminders about appointments, when the next dose is due, tracking side effects, and offering medical follow up. 

What is different about COVID-19 is the digitised response. This ranged from the initial push to create contact tracing applications to developing systems for digital vaccine certificates that record and track individuals using information technology and digital records. Making access to places and services contingent on vaccine status raises concerns about exclusion and discrimination while the digitised response raises corresponding risks associated with mass data collection like data breaches while creating an infrastructure for the proliferation of centralised digital identity systems.  

Risk of Exclusion and Discrimination 

Digital certificate proposals raise concerns about discrimination towards those who have not received the vaccine for one reason or another. On the one hand, many people around the world are still waiting for access to COVID-19 vaccines. Some governments lack the resources for first access to the vaccines while others face challenges related to distribution. This often means that marginalised and vulnerable populations will be the last to receive vaccines, if they get them at all.  

If the primary use of digital certificates is to grant or deny access to travel, work, social services, and public places, these programs may push those already facing exclusion and discrimination further to the margins of society. If digital vaccine certificates are mandatory for travel, this would severely restrict individuals crossing borders out of necessity like refugees and migrants.  

And what happens for individuals who have other health-imposed restrictions or lack access to the internet and internet-connected devices and cannot make an appointment? Even if they do have the vaccine, how would they share that information digitally? Others in communities with access may be excluded from vaccinations because of existing medical conditions or religious objections. These individuals will then be systematically excluded from participating in a vaccinated society without access to services and public spaces. 

Privacy and Security Concerns 

The rollout of the vaccine and proposed vaccine passports also raises privacy concerns. Member States in the EU must take the General Data Protection Regulation (GDPR) into consideration when rolling out vaccine passports. What would be the legal basis for data collection and transfer? How long would the data be stored? A person’s agency to give consent is severely limited if a digital vaccine passport is the only way to participate fully in daily life. Other concerns relate to the mass collection of information by government and corresponding surveillance concerns while centralised data centres serve as a valuable target for cybercriminals. 

Digital vaccine certificates would significantly expand the amount of data collected about vaccination status while generating ongoing data collection about where and when a digital vaccine certificate has been used. This creates inevitable concerns related to mistakes while creating a target for cyber-attacks. These concerns are exacerbated by the creation of a centralised digital identity system serving as a new health identity infrastructure.  

In 2020, Jamaica released the JamCOVID app and website, a centralised platform showing information about the COVID status of individuals in the country with tools to self-report symptoms and obtain pre-approval to visit the country. Visitors upload their travel information and a negative test result to obtain approval. In February 2021, journalist Zack Whittaker broke the news that the cloud storage server containing travellers’ information had been left unprotected without a password. More than 70,000 negative COVID results, 425,000 immigration documents, travellers’ signatures, and more than 1.1 million check-in videos were open to exposure.  

One of the most worrying aspects of digital identity systems is the interlinking of various aspects of a person’s life linking tax records, mobile numbers, health data, financial record, and other registrations under one centralised identity system. The collection and use of health data should be grounded in the principles of necessity and proportionality in accordance with prescribed laws. This would seek to avoid situations like in Singapore where law enforcement officials were able to access data gathered through the TraceTogether and SafeEntry contact tracing applications for criminal investigations. This is not what the data was supposed to be used for.  

Centralised digital identity systems are susceptible to mission creep, growing far beyond the uses and limitations that were first envisioned. In India, the Aaroygya Setu contact tracing application was promoted as a one-stop solution for everything related to COVID-19 asking for personal information including habits and current symptoms. The government later used that data to create databases managed by different ministries. For the distribution of vaccines, the government of India rolled out the Co-WIN 2.0 platform using that information to populate the database for the Digital Health ID and forcing individuals to use a system used to populate India’s digital identity program. 

Another lingering concern relates to retention periods and how long this sensitive data would be stored. Outside of Europe, many countries are only at the stage of proposing data protection legislation creating a worrying situation about misuses of health data. No one wants to create a situation where individuals would be forced to compromise their fundamental right to privacy to maintain or gain access to essential services and the freedom of movement.  

A digital vaccine certificate will require the collection of sensitive personal data. The use and collection of this information should be bolstered by comprehensive data protection laws leveraging the GDPR and the protection of data subject rights including the right to access and correct data and, when the time comes, limiting collection and use of this personal data and eventually deleting the data.  

Recommendations on the Use of Digital Vaccine Certificates from Access Now 

Do What is Effective, Not What is Trending 

Existing vaccine certificate systems work and do not carry dangers of expansive digital vaccine passport programs and infrastructure. 

Prioritize Data Protection 

Minimize data collection and retention following privacy-by-design principles 

Be Transparent in both Design and Implementation 

Keep in mind uncertainties about the landscape of vaccines and their long-term efficacy including unintended consequences of new digital vaccine passports.  

Be Equitable and Inclusive 

Access to digital vaccine certificates should be free, accessible, and paired with easily accessible paper-based forms as an interchangeable alternative.  

Limit Use of Certificates 

Digital vaccine certificates should not be treated as another tool for accelerating digital transformation and must not be used to advance adoption of centralised and mandatory digital identity systems.  

Prevent Abuse 

Governments should include sunset clauses and strict data retention periods to avoid expanded surveillance, silencing dissent, and restricting freedoms of expression, assembly, and movement.  

Don’t Create Division 

Digital vaccine certificates should not be mandatory for exercising fundamental rights and freedoms. Systems that make digital vaccine certificates a requirement will divide and exclude.  

The post Threat to Human Rights: Vaccine Passports and more appeared first on Wrangu.