“It is not the strongest of the species that survives, nor the most intelligent, but the one most responsive to change.” – Charles Darwin

The New Reality of Risk

The world today is increasingly volatile, unpredictable, and unstable. The assumption that conditions will remain steady from one year to the next no longer holds true. In recent years, we have witnessed the global disruption caused by COVID-19, the ongoing war in Ukraine, the conflict in Israel and Gaza, and rising tensions among major global powers. These are not isolated events; they are signals of a broader pattern of instability reshaping the global landscape.

Each of these crises has had a profound impact on economies, supply chains, and business operations. Goods and services once taken for granted can quickly become scarce, while essential commodities fluctuate in both price and availability. This shifting environment is forcing organisations to fundamentally rethink how they operate and how they prepare for disruption.

Building Resilience in a Volatile World

In this context, operational resilience and third-party risk management are critical to survival. Businesses must understand not only their direct suppliers, but also the extended supply chains beneath them. Mapping dependencies, identifying concentrations of risk, and establishing viable alternatives are now key sources of competitive advantage.

Traditional assurance mechanisms, such as SOC 2 reports, remain valuable, but they are not sufficient on their own. They offer a point-in-time view of controls, not a measure of resilience under real-world stress. What is required is continuous monitoring of third-party risk, supported by strong controls and a defence-in-depth approach.

Resilience planning must also evolve. Static business continuity plans are no longer enough. Organisations need dynamic, scenario-based testing that reflects real-world crises plans that have effectively been “tested in anger” across multiple scenarios to ensure they can withstand disruption when it matters most.

The Power and Limitations of Frameworks

Regulatory frameworks such as the EU’s NIS2 Directive mark this shift. Critical sectors including energy, infrastructure, and utilities are now required to demonstrate integrated risk management, robust governance, incident reporting capabilities, digital resilience testing, and effective oversight of third-party risk. They are also expected to collaborate, sharing intelligence on emerging cyber threats.

However, NIS2 should not be viewed as relevant only to critical industries. It represents a set of best practices forged from hard-learned lessons in an increasingly hostile environment. From state-sponsored cyberattacks to disruptions in energy supply and targeted attacks on infrastructure, these risks are becoming more frequent, more coordinated, and more sophisticated.

No framework can eliminate risk entirely. But by adopting these principles, organisations can equip themselves with the tools needed to navigate uncertainty. Those that invest in resilience, visibility, and adaptability will be far better positioned not only to survive, but to thrive in the face of future disruption.

The challenge now is simple, but uncomfortable: if a critical supplier failed tomorrow, if a key region became inaccessible, or if a cyberattack disrupted your operations would your organisation continue to function, or would it pause, scramble, and react? The difference between those outcomes will not be luck. It will be preparation. The organisations that ask and answer these questions today are the ones that will define tomorrow.

“Risk management is how you prepare for the unexpected, not how you safeguard against it.” – David Einhorn

The post Reactive vs Adaptive GRC: The Key to Building Operational Resilience appeared first on Wrangu.

About the Author

2. Recreating Legacy Processes

Adopt and adapt, don’t replicate the past.

Legacy thinking is the single biggest barrier to IRM success. Organisations often feel compelled to re-create their old tool configurations, reports, and workflows within a new platform.

This defeats the purpose of transformation. Implementing IRM should be an opportunity to question why processes exist, not simply how to reproduce them.

Challenge legacy habits. The real value comes from redesigning risk management processes for today’s needs, not rebuilding the past in a new system.

3. Scaling Too Quickly

Start small, prove impact, then expand.

IRM maturity is not achieved overnight, it is a multi-year transformation. Equally, organisations cannot wait years to demonstrate value.

The most successful initiatives begin with focused, high-yield pilots. Start with a small number of critical business processes, the organisation’s “crown jewels”, and deliver measurable outcomes within the first three to six months.

Early success builds credibility, secures ongoing funding, and creates the momentum needed to scale the programme sustainably.

4. Shaky Foundations

Lay foundations capable of supporting strategic growth.

IRM transformations unfold in phases, and each phase must align to a well-defined target operating model. Early design decisions, particularly around data structures, taxonomies, and governance, determine how effectively the programme can scale later.

Both a skyscraper and a bungalow require solid foundations, but they are engineered very differently. Before you begin building your IRM programme, be clear about which one you intend to construct.

5. Overly Complex Scope

Only capture what’s essential for oversight and control.

One of the most common pitfalls in IRM implementations is over-scoping. Trying to model every asset, control, or process quickly creates unnecessary complexity and slows adoption.

Instead, right-size your scope to what is required for meaningful governance, assurance, and insight.

Granularity should enable better decision-making, not burden teams with excessive administration.

6. Reinventing The Wheel

Industry standards accelerate maturity.

Reinventing frameworks from first principles wastes valuable time. Industry models such as ISO, COSO, NIST, and others are proven, mapped to multiple regulations, and widely accepted by auditors and regulators alike.

Adopting them as a baseline enables consistency, comparability, and faster maturity without sacrificing customisation where it truly matters.

7. Failure to Treat Risk Management as Data-Driven

Data enables consistency, automation, and informed decisions.

Effective Integrated Risk Management is data-driven, not document-driven. Organisations should use existing enterprise data to power workflows, identify trends, and inform policies.

Automation should be applied wherever logic and validation can replace manual review. This frees human capacity for higher-value activities such as analysis, foresight, and strategic decision-making.

8. Underestimating Cultural Change

Tools don’t change culture, leaders do.

Technology alone will not transform a risk culture.

Successful IRM programmes require visible senior sponsorship, sustained investment in change management, and clear communication across the organisation. Training, incentives, and messaging must reinforce that IRM is part of how the business operates, not just another reporting requirement.

Without engagement at every level, even the most advanced platforms fail through lack of adoption.

9. Unrealistic Expectations About Speed

IRM implementations take time because changing behaviour takes time. Specialist capabilities, expert configuration, and stakeholder alignment all require deliberate effort.

If speed is essential, accept that disruption will follow. Sometimes the fastest path is a clean start, leaving historical data and legacy processes behind in favour of a modern, scalable model.

The Bottom Line:

IRM is not about technology; it’s about resilience.

Success depends on aligning people, data, process, and purpose, supported by technology that amplifies, not defines, capability. Organisations that treat IRM as an evolving business discipline, rather than a software project, will ultimately build stronger, more adaptive enterprises ready for the risk landscape ahead.

The post 9 Reasons Integrated Risk Management Programmes Fall Short appeared first on Wrangu.

About the Author

Yes, AI is here. Yes, it promises to transform the governance, risk, and compliance (GRC) landscape. But let’s face it, are you truly ready to harness its power?

Throughout my career, I’ve worked with organisations of all shapes and sizes, from multinational giants to agile start-ups. Yet few were truly prepared for AI to solve their challenges. Why? Because they lacked the foundations needed for AI to deliver meaningful results.

Many have purchased AI tools. But have they solved their problems? No. AI cannot work in isolation.

The Real Potential of AI in GRC

Used effectively, AI can streamline core GRC processes that have traditionally been time-consuming and manual:

Foundation 2 → Data Readiness

Next, and most critically, you need data that is reliable, consistent, and usable to train AI models effectively. AI is a powerful tool, but it is not a silver bullet. As Grady Booch wisely said, “A fool with a tool is still a fool.”

In my experience, organisations tend to fall into one of these categories:

• Too siloed and fragmented, burdened by disparate processes and years of unaligned data.
• Moving from spreadsheets with ambition but no foundational systems or long-term vision.
• Stuck on outdated tools, eager for modernisation but trapped by archaic processes.

Or, often, a mix of all three.

Data is the foundation on which the AI house is built, it must be strong, or it will collapse. Preparing the ground and understanding the data you have is important before you start.

Foundation 3 → A Shared, Long-Term Vision

Successful AI adoption requires vision, communication, and cooperation.

Like all major GRC projects, this is not a one-and-done effort. Sponsors must recognise that managing risk, like maintaining security, is continuous. It demands investment in organisational change management, cultural transformation, and a unified vision with interconnected processes driving a common goal:

To mitigate uncertainty and empower the business to thrive.

Whether you follow the three lines of defence, four, or five, it doesn’t matter. What matters is that processes are structured, embedded, and adopted.

Just as data analytics required a clear purpose before creating measurable impact, AI needs a defined vision before it can deliver value.

Foundation 4 → Governance, Structure, and Accountability

AI algorithms are only as effective as the data and governance behind them. Quality, ethics, and robustness are vital for trustworthy outcomes. Frameworks such as the EU AI Act, the OECD AI Principles, and the NIST AI Risk Management Framework all highlight this importance.

Organisations need:

• Data and AI governance – Clear accountabilities and standardised processes for data management.
• Transparency and explainability – AI decisions must be understandable and auditable.
• Fairness, safety, and accountability – Systems must be designed to avoid bias, prevent harm, and ensure responsibility.
• Leadership and vision – Strong oversight to align AI initiatives with organisational strategy.
• Training and iteration – Ongoing refinement to improve accuracy and relevance.
• Collaboration and skills – The ability to work effectively with AI, including prompt design and critical evaluation of outputs.

Those of us in the GRC field bear a special responsibility. Governance and ethical guardrails are essential to realising AI’s potential while protecting the integrity of our organisations and the data we manage.

As Jason Lemkin aptly put it, “AI agents are incredibly powerful, but they cannot be trusted, and that is by design. If you want to use AI agents, you need to 100% understand what data they can touch, because they will touch it, and you cannot predict what they will do with it.”

AI can and will transform GRC, but only for those who lay the groundwork, building the systems, culture, and data foundation that allow the technology to shine.

The post Making AI Work for GRC: The Key Foundations for Success appeared first on Wrangu.

My Name is Jenny Stegh

Who is Jenny?

I am a Regional Sales Manager at Wrangu, responsible for the DACH, CEE, and South regions. This means I am often the first point of contact for our customers and prospects, helping them navigate the complex world of technology solutions.

Jenny’s Journey

Like many in my generation, I built my own computer as a teenager to save money. But despite my early interest in tech, I never envisioned a career in the industry. What I always loved, however, was engaging with different types of people and being part of something dynamic—so I started out in music.

After spending a few years in the music world, I made a radical career shift, transitioning to a daytime role at an IT helpdesk. From there, I quickly explored various areas, including product management and risk & compliance. This experience gave me my first real insight into how technology can drive business success and provide companies with a competitive edge.

At the start of my career, I often felt like an outsider in tech. I was sometimes met with comments like, “Are you here for catering and entertainment?”—a stark reminder of how underrepresented women were in the field. Fortunately, times have changed, and it’s inspiring to see so many talented women making their mark in technology today.

What excites me most about my job is the opportunity to work with people from diverse backgrounds, helping them optimize their work and increase efficiency. After all, isn’t that what we all strive for—more time to focus on what truly matters?

A Day in Jenny’s Life

No two days in my role are the same. My schedule is packed with customer interactions, meetings with prospects and partners, crafting proposals, and collaborating with my presales colleagues to develop the best business solutions. The unpredictability keeps things exciting, even with its ups and downs.

Of course, maintaining work-life balance is a challenge, especially in a role where so much depends on individual performance. But over time, I’ve learned to set boundaries. For me, sports, travel, and cooking are the perfect antidotes to work stress, helping me recharge and stay energized.

What’s It Like Being a Woman in Tech?

My journey has been anything but conventional, but that’s what makes it exciting. And if there’s one thing I’ve learned, it’s that embracing change and staying open to new opportunities can lead to incredible personal and professional growth.

The post Women In Tech: Breaking Barriers – Jenny Stegh appeared first on Wrangu.

My Name is Zakiyah Abubakari Khalid

Who is Zakiyah?

I am a Support Analyst at Wrangu, specializing in ServiceNow platform support. Beyond problem-solving, I am a lifelong learner, a passionate tech enthusiast, and a firm believer in leveraging technology to create meaningful solutions for people.

My  career journey is proof that you don’t need a traditional “tech start” to thrive in this industry. With an initial background in public health, I took a bold leap into IT, navigating my way through customer service, system administration, and now enterprise technology solutions.

My biggest drive is The challenge of untangling complex issues, the thrill of continuous learning, and the ability to create solutions that actually make a difference.

Zakiyah’s Journey

I didn’t grow up writing code or taking computers apart, but I’ve always had a curious, analytical mind and a passion for efficiency. My first real encounter with tech came while working in customer service, where I found myself naturally drawn to solving process inefficiencies. Instead of just fixing issues, I wanted to prevent them from happening in the first place,a mindset that ultimately led me into the world of ServiceNow and ITSM.

Of course, transitioning into tech wasn’t a straight road. Imposter syndrome? Been there. Navigating male-dominated workspaces? Absolutely. But I pushed forward by believing in myself, staying committed to learning, and surrounding myself with the right people. My incredible Wrangu team has been a constant reminder that I belong here and that’s made all the difference.

A Day in Zakiyah’s Life

No two days at Wrangu are ever the same. Every day at Wrangu brings something new, making the experience both engaging and fulfilling.

My mornings typically begin with a quick check of emails to review open tickets and set priorities for the day. I then join our daily support meeting to stay updated on the latest developments in Wrangu’s support operations. Throughout the day, my focus is on troubleshooting issues, implementing fixes, and enhancing system efficiency to improve our clients’ experience.

Collaboration and continuous learning are also key aspects of my daily routine. I work closely with cross-functional teams, exploring new ServiceNow updates and best practices to stay ahead in the ever-evolving tech space.

Beyond my core responsibilities, I make time for personal and professional growth—whether it’s upskilling, expanding my knowledge, or simply taking a moment to recharge and maintain a healthy work-life balance.

What’s It Like Being a Woman in Tech?

Working in a predominantly male industry comes with its challenges, but I navigate them by continuously learning and growing in my field. I believe the tech industry thrives on diversity, bringing in new voices, perspectives, and problem-solvers. I’m committed to contributing to that change and fostering a more inclusive space for future talent.

The post Women In Tech: Breaking Barriers – Zakiyah Abubakari Khalid appeared first on Wrangu.

The post Women In Tech: Breaking Barriers – Laura Suchon appeared first on Wrangu.

I have been working in technology for the past thirteen years of my career. I have worked within various roles within this time, and to date I am a Cyber Security professional helping businesses to improve their operations using GRC and Security Operations Service Now solutions.

BOBBI’S JOURNEY

After studying social sciences and with a pressing desire to get out into the world and begin my career, my journey began in technology. Joining technology was never something I had questioned- why would I? Growing up in a household driven primarily by a strong, empowering and encouraging mother, I never questioned my role in society, as a person, or as a female in technology.

My technology journey began at eighteen years old, with no university degree and with no prior experience. I had a natural ability to understand businesses, technology and most importantly- the people. By the age of twenty-two, I was promoted four times and was equipped with a wealth of experience. Reflecting on my quick progression now, I would say I achieved this through hard work and challenging some of the norms around me in business. Questioning the now, the why, and the what if.

Fast forward another eight years, I have progressed in technology and had varied positions and job responsibilities along the way- not without challenges. Being a young female within senior roles, people were sceptical of my ability to perform.

I never seen this scepticism as a direct relation to my gender, in my mind it was an opportunity to prove to myself what I was capable of. I believe you must build trust; it is not a given nor should it be. I focused on my work, building great relationships and producing results. Naturally the scepticism faded, and my confidence grew. Proving myself was easy, because I believed in myself, and I wasn’t in competition with anyone else but myself. As a woman, I had to be top of my game- but I thrived on that

A DAY IN BOBBI’S LIFE

Working for a company like Wrangu has been a breath of fresh air. Over the years I haven’t always been in environments where I felt I could be authentically myself, without fear or without judgement in some form. Every day is unique, exciting and without challenges- exactly what I love. I am lucky to have the privilege to speak to clients every day who are looking to improve their businesses, their processes and plan for long term success. To this day, I love surprising clients who are expecting a fifty-something year old man from Glasgow named Bobby to join the call- they get me instead! Those moments are fun in humour, and never negatively received. 

The post Women In Tech: Breaking Barriers – Bobbi McCord appeared first on Wrangu.

I have come to appreciate that there are some fundamental steps to any successful IRM implementation. 

Context (The why?) 

Why is someone implementing Integrated Risk Management? What has motivated an organisation to change how they work and institute a formal enterprise risk management process? 

The context is important as it will shape not only your discussions but also the goals and objectives. 

For example: 

• Is the company worried that they do not understand their risk position and have no visibility or where they need to focus their attention? 
• Is the organisation striving for compliance to complex regulations and needs a way of tracking and showing that they are? 
• Has the organisation just been audited and found lacking? 

The context of why you are engaging with these people is paramount in understanding the journey. 

This will be the starting point but as you know an IRM(IRM) journey is a 3 -5-year marathon, not a sprint. Which means you also need to understand: 

• The long-term goals and vision 
• Where do they want to be not just what do they need today 
• The context will allow you to chart their maturity and the roadmap in front of them. 

Scope (The what and the who?) 

So, you understand why a customer is talking to you, now comes the hard part. 

The scope can have a major influence on the success or failure of a project. 

• Try to do too much too fast and you will overwhelm the userbase.  
• Try to do too little and the project will not show any ROI and will wither on the vine. 

When starting an IRM project, the first phase of the project is the beachhead.  

The business in general is used to how they work and are not eager for change, this first phase is about showing how things will make life easier for them.  

Surprising or not, this is not about technology, it’s about people.   

Organisation change will determine if this project is a success or not. 

The WHAT of the first phase needs to show the value, so pick a part of the business that is willing to embrace change or the most valuable crown jewels of the company and show how that area can connect with the why in the context.  

The WHO comes from the data.  

Good data can make projects run smoothly, bad data can increase the length of the project and drastically reduce its impact.  

• Do you know WHO owns the objects in the WHAT?  
• Can we assign the WHO risks and controls to manage?  
• WHO oversees the processes and needs to be a part of it? 

Understanding the data that will drive the process ahead of time will make the project run much more smoothly. 

Visibility  

The last pillar is understanding the HOW. 

How do they currently report, what reports do they have and are they required going forward? 

How does the information need to be presented, what different levels of visibility are there? 

Does the entire organisation need to see the information or is it a small set of people? 

Working back from what the board need to see and then what the lower levels need to see, you can understand what needs to be in place from day one. 

That makes setting up metrics and indicators, reports, and exports easier if they were already in architecture from the beginning rather than trying to retrofit things later. 

Conclusion 

Like any good architect, engineer, or scientist, having a clear vision of what they are trying to achieve is key.  

The lunar lander Eagle on Apollo 11 was perfect for landing on the moon but would be terrible for any other purpose. 

Taking the time to understand what we are trying to do before rushing in and building will save you many hours of suffering and help lead to more successful projects. 

While not the only keys to success they have helped me on many occasions. 

Disclaimer: This content was not produced using AI but it the random outpouring of my brain which I hope was of use to someone. 

The post The three pillars of IRM appeared first on Wrangu.

They literally hold everything together.

• If you want to show your compliance to regulations, you need them as they connect to citations, and control tests.
• If you want to mitigate your risks consistently you need them, as they will be linked to risk statements.
• If you want to populate policies and reduce duplication and extra effort, you need them. As they form the bulk of a policies content.

Just like the foundations of IRM, Control objectives can be the key between a powerful and valuable IRM implementation and a mediocre and impact installation.

Let’s look at why we need to use control objectives and why putting that little extra time and effort will add so much.

Let’s build a scenario, you have your Authority document from the regulator, it’s broken down into its citations and the words are in legalise. So you start analysing and asking questions:

• You know you must do something; it tells you what to do but it doesn’t tell you exactly how to do it.
• Maybe your company has regulation experts such as the privacy experts Wrangu has?
• In which case they will have told you what their interpretation of regulation is and what each citation is looking for.
• Maybe you are using downloaded the content?
• All that is a start, but now comes the hard part.
• Are you already doing this or not?
• How do you know?
• Is there something in a policy you have already implemented that would cover this?

That’s where Control Objectives come in.

Multiple citations can be linked to a control objective, if you are using UCF (Unified Compliance Framework) you probably already know this. You probably also know that the content provider control objectives are usually light touch and minimal.

They are a starting point.

What I feel is a huge mistake, which I commonly see, is people trying to use them as they are… DONT!

Now bear with me, I am asking you to take time and do some more work up front, but I promise you there is a very good reason.

Because Control Objectives are so key, the deserve time spent on them to make them work properly.

They are the voice of the company, explaining to employees how to implement a control, not the regulation but how YOU, YOUR company intends to comply with the regulation it.

The more information, guidance and support you put in these records, the better you will find your end users, your team will understand what is being asked of them and make the right call.

Knowledge is power and here is a prime example of putting that power in the hands of your teams.

The more detail and clarity you put in the control objectives the easier it will be to understand if it meets multiple regulations.

The more detail and clarity you put in the control objectives the more value the policies you generate from control objectives will be.

You will be able to publish them in confidence and be able to search through them with a greater degree of success.

The better your control objectives the easier it will be to map the to the right risk statements and feel confident in mitigating threats against your business.

Good quality control objectives can be the difference between a poor and a great experience on the ServiceNow IRM platform.

So, whether a customer or a ServiceNow consultant.

The next time the question comes up, give control objectives the respect they deserve.

I promise you; you won’t regret it.

They are after all, the golden thread that links everything together.

I borrowed the phrase from a client, he knows who he is and I hope he doesn’t mind, as it was too good to pass up.

Disclaimer: This content was not produced using AI but it the random outpouring of my brain which I hope was of use to someone.

The post Control objectives, the golden thread of IRM appeared first on Wrangu.