We're kicking off the 2026 season of Get NIST-y with some predictions about what's to come in the world of compliance and cybersecurity. At the end of the year, we'll make sure to grade ourselves on how well we predicted things, too. 

SIGMA is organizing a series of webinars on the new Global Internal Audit Standards and the changes with regard to the International Professional Practices Framework (IPPF) for public finance and audit professionals in European candidate countries and potential candidates as well as European neighborhood countries.

Tom Fox’s guest on this week’s show is Toby DeRoche, a professional auditor and senior manager of risk management at Verizon. He and Tom talk about the importance of risk assessment and how it has changed in recent years.

The compliance department is frequently viewed by companies as an afterthought. Many companies scramble to bring procedures in place only on time or after it’s too late. Worse still, the position is siloed by several companies, with the sales team seeing compliance officers mostly as too fast to respond "No!".   

Ironically, though, businesses lacking a compliance culture frequently contend with more disciplinary measures and lawsuits than their complying rivals rather than concentrating on operating a profitable company. In other terms, vital resources are saved with a successful compliance policy, covering individuals, time, and capital.

Realistically, building a compliance foundation is the most significant security for an organization to reduce risk. Thus, growing to achieve sales and creating proof of compliance with applicable laws, compliance should be recognized as an internal insurance system. With that, organizations should strive to develop a successful compliance program.

In this episode, we answer the most frequently asked questions about internal control systems, the COSO framework, and their relationship with audit processes, fraud risk, and compliance.