Shared Experiences in GRC

This week on Office Hours (https://officehou.rs), Dan Zitting and Phil Lim attack the problem of regulatory change management. Specifically, Phil helped a client of his build an effective and cost efficient solution for not only aggregating and consolidating alerts of regulation changes, but envisioned a way to make sifting through them, cleaning out the garbage, and deciding what to actually do about those that matter far easier.

Dan Zitting and Kevin Legere discuss a question we got from a listener about how to use automation and monitoring without it causing external audit reliance issues that get blamed on the PCAOB. Some sanity is necessary to make sure each of the organization, the organization's auditor, and the organization's auditor's regulator (the PCAOB) realizes the BEST way to evaluate controls is through ongoing monitoring and this session describes four strategies fora gaining/maintaining that alignment.

This week on Office Hours (https://officehou.rs), Dan Zitting and Kevin Legere discuss thoughts on risk management in scenarios that are "too good to be true". Kevin uses the Volkswagen emissions scandal to show how publicly available data and a machine learning technique illustrated the risk that emissions performance was just "too good to be true". He shows how simple unsupervised machine learning can identify such a situation when pointed at data that is being disclosed for compliance reasons anyway.

This week on Office Hours (https://officehou.rs), Dan Zitting and guest host Phil Lim discuss vulnerability management and using analytics to consolidate, normalize, and prioritize vulnerabilities into threats and then evaluating risk levels based on the threats. Dan's customer was looking to drive a real time profile of IT risk based on its collection of threat and vulnerability data, which Dan demonstrates using ACL.

This week on Office Hours (https://officehou.rs), hosts Shahed Khalili and Dan Zitting discuss third party risk management by looking a disastrous vendor-related incident that caused Shahed's customer rethink their processes and controls around how they manage their third parties. Shahed discusses what was implemented to prevent the "next time" incident happening.

This week on Office Hours (https://officehou.rs), hosts Kevin Legere and Dan Zitting discuss third party risk management by looking at a situation where contract risk/vendor risk led to several very large organizations being substantially over-billed and the vendor itself having to restate its financial statements after rectifying the issue. We'll dig into how it happened and using "big data" to identify and resolve the issue.

This week on Office Hours, hosts Kevin Legere and Dan Zitting discuss their experiences identify ghost employees, ghost beneficiaries, and other related cases where large organizations are being defrauded through the identify theft of dead people. Kevin describes a large company where identified a high ranking executive had used the identity of a dead person to get hired and Dan describes a state government paying benefits (food stamps, veteran benefits, etc.) to people who were actually dead.

This week we talk about brand, and the risk of brand misperception. What assurance do management and the Board really have that corporate marketing is speaking to the market in a way that aligns to corporate strategy and drowns out the competition? We think about risk management's role in marketing, and also look at how AI-driven natural language processing can be used in a real-world, practical way to competitively benchmark natural language marketing communications to strategy and competitors

This week on Office Hours, our first guest host, the mad genius Phil Lim, joins Dan Zitting to talk about the Paradise Papers... what they mean and how an organization he worked with was interested in using the data compiled from them to look at potential risk indicators fraud or corruption. Phil actually uses the real data with real US government spending data to show how the process looks to evaluate red flags.

This week on Office Hours, hosts Dan Zitting and Kevin Legere summarize Kevin's experiences as a data analytics consultant to audit and compliance teams who are just getting started with an analytics program. Kevin distills the what he found are really the five key steps to getting off the ground and building your first "data robots". These worked at Fortune 500 company's and the US Federal Government, hopefully they work for you if you are just diving into "data-powering" your team or function!