In nearly every organization I speak with, sustainability and ESG are now part of the conversation. Not just in annual reports or investor decks, but in strategy sessions, risk workshops, board discussions, and even operational resilience planning. The reasons vary — regulations, investor expectations, customer demands, talent attraction, reputational pressure — but the direction is unmistakable.…

I have reached a point in my research, advisory work, and ongoing dialogue with boards, executives, regulators, and technology providers where incremental language no longer feels responsible. The signals are too strong, the failures too visible, and the velocity of change too unforgiving. Digital risk and resilience are no longer peripheral concerns managed through documentation…

A Call to Action at an Architectural Inflection Point This article builds directly on last week’s analysis, GRC at the Architectural Crossroads: Why Legacy Platforms Must Rebuild to Survive, where I argued that many governance, risk management, and compliance platforms have reached the limits of architectures designed for a slower, simpler era. That piece examined why…

A View Earned Over Time I do not come to this perspective lightly, nor is it driven by the latest technology trend or marketing cycle. I have been immersed in GRC technology for more than twenty-six years. I defined the GRC acronym in 2002. I authored the first Forrester GRC Waves when the market was…

Orchestrating Stability, Trust, and Execution Integrity on the Most Pressurized Deck of the Enterprise There are few industries where the consequences of failure arrive as quickly — and as publicly — as they do in financial services. A manufacturing firm can experience a production disruption and recover over days. A retailer can absorb a supply…

Each year, when the World Economic Forum releases its Global Risks Report, I see leaders react in a familiar way. They circulate the visuals, discuss the rankings, highlight what feels immediate, and then quietly move on. It becomes a useful talking point — something we nod to as evidence that the world is “more complex” and…

As we move toward 2026, I find myself increasingly uneasy with how many organizations talk about operational resilience. Not because they are ignoring it, quite the opposite. Most financial institutions, and a growing number of organizations beyond financial services, have invested heavily in resilience over the past several years. Frameworks are in place. Programs exist.…

Resilience, When You Don’t Get to Choose the Disruption As 2025 draws to a close, many people around the world are entering a season of reflection. Whether marked by Christmas, Hanukkah, the New Year, or other traditions, this is a time when we pause, look back on what the year demanded of us, and consider…

For more than twenty years, risk management has been shaped by the gravitational pull of Sarbanes-Oxley. SOX arose from a genuine crisis of trust, and its intentions were honorable: to reinstate accountability, protect investors, and restore faith in financial reporting. But its unintended legacy has been far larger and far more limiting. Instead of elevating…

Orchestrating Strategic, Objective-Centric, and Operational Risk & Resilience through GRC 7.0 Risk! Risk is our business. That’s what this starship is all about. That’s why we’re aboard her — Captain James T. Kirk, Star Trek: The Original Series, Season 2, Episode 20 The Enterprise was not built to sit safely in space dock. Its mission —…

In my decades of advising organizations across industries and geographies, one recurring challenge persists: articulating the value of Governance, Risk Management, and Compliance (GRC) in a way that resonates with executive leadership. Despite its mission-critical role, GRC is often seen as a cost center, a necessary but uninspiring function that checks regulatory boxes and manages…

Over the past several years — and particularly throughout this past year — I have observed a profound transformation in how organizations confront uncertainty. The traditional boundaries we once relied upon have dissolved. What used to live neatly inside departments and functions now stretches across the full expanse of the enterprise, influencing strategy, culture, ethics,…