-
Enterprise Risk Management by James Lam: Summary and Lessons for Auditors
Lam’s practitioner’s manual on ERM, summarised for auditors: the seven lessons, the seven components, the ten predictions and how they fared, three later failures, COSO 2017 and the…
Updated
·
32–48 minutes -
How to Measure Anything by Douglas Hubbard: Summary and Lessons for Auditors
Hubbard’s method for measuring “intangibles”, summarised for auditors: the definition of measurement, calibrated estimates, the value of information and the measurement inversion, small-sample tools, a vocabulary, an audit…
Updated
·
32–48 minutes -
Meltdown by Clearfield and Tilcsik: Summary and Lessons for Auditors
Clearfield and Tilcsik on why complex, tightly coupled systems fail, summarised for auditors: the danger zone, the cases checked against official records, seven remedies, a vocabulary, an audit…
Updated
·
26–39 minutes -
The Speed of Risk by Richard Chambers: Summary and Lessons for Internal Auditors
Chambers’s lessons from the audit trail, summarised for auditors: the speed of risk and the case against static annual plans, the original sixteen lessons, what changed across three…
Updated
·
24–36 minutes -
The Failure of Risk Management by Douglas Hubbard: Summary for Auditors
Hubbard’s case against scoring methods and his calibrated, simulated alternative, summarised for auditors: the argument, the method in six steps, a vocabulary, an audit map and a worked…
Updated
·
19–28 minutes -
The Black Swan by Nassim Taleb: Summary and What It Means for Auditors
Taleb’s argument about rare, extreme events summarised for auditors: nine ideas, fourteen terms, what it says about heat maps and sampling, a lesson-by-lesson audit map and a worked…
Updated
·
19–28 minutes -
From Internal Audit to Risk Management: What Changes, What Transfers, What It Pays
The most common exit from internal audit, examined properly: the six shifts in the work, which audit strengths transfer and which become liabilities, how to tell a second-line…
Updated
·
19–29 minutes -
How to Run a Strategic Risk Assessment: Surfacing the Bet-the-Company Risks
Most of the value a company loses, it loses to strategic risk: a bet that was wrong, a market that moved, a competitor that was underestimated, an execution…
Updated
·
21–32 minutes -
Board Risk Reporting: The Quarterly Risk Pack That Directors Actually Read
Boards oversee risk; they do not manage it, and the quarterly risk pack is the instrument through which they do the overseeing. Most packs fail at the task:…
Updated
·
19–28 minutes -
Building an Operational Risk Framework: Taxonomy, Tools and Governance
An operational risk framework is the machinery through which an organization sees the losses that come from its own processes, people, systems and external events before they arrive,…
Updated
·
21–32 minutes -
Corporate Liquidity Risk: Cash Forecasting, Covenants and Committed Lines
Companies do not fail because they lose money; they fail because they run out of cash and committed funding at the same time, usually with a covenant breach…
Updated
·
21–31 minutes -
Liquidity Stress Testing: Scenarios, Horizons and the Death Spiral Dynamics
A liquidity stress test asks how many days an institution survives a defined stress before it runs out of cash and unencumbered collateral, and what it would have…
Updated
·
22–33 minutes -
Assurance Mapping: A Worked Example From Blank Page to Board View
Everyone agrees an assurance map is a good idea and almost nobody publishes a finished one. This guide builds one from a blank page: defining the rows (risk…
Updated
·
18–27 minutes -
Internal Audit vs SOX vs Compliance vs ERM: Who Does What in the Control Ecosystem
New auditors, new control owners and new board members all ask the same question: what is the difference between internal audit, the SOX program, compliance and enterprise risk…
Updated
·
18–27 minutes -
How to Run a Compliance Risk Assessment: Obligations, Exposure and Prioritization
A compliance risk assessment is the document regulators, prosecutors and audit committees ask for first, and most organizations produce it as a list of laws with colors. This…
Updated
·
18–27 minutes -
How Internal Audit Should Audit the ERM Program Itself: Criteria, Maturity and Independence
Auditing the second line is the engagement that proves whether internal audit’s independence is real. This guide gives the method for the enterprise risk management program: the three…
Updated
·
18–28 minutes -
Risk Appetite vs Tolerance vs Capacity vs Limits: The Four Layers, Defined and Cascaded
Boards and risk functions use appetite, tolerance, capacity and limits as if they were interchangeable, and the result is a risk appetite statement nobody can apply. This guide…
Updated
·
18–27 minutes -
Designing a KRI Program: From a Metric Wishlist to an Early Warning System
Most organizations have a KRI list and almost none have an early warning system. This guide explains the difference and how to close it: what a key risk…
Updated
·
18–27 minutes -
The Bank Internal Audit Universe: A Worked Example With 126 Entities, Ratings and Cycles
Practitioners ask for a real bank audit universe and nobody publishes one. This guide does: the full 126-entity universe of Lakeshore Bancorp, the $9 billion regional bank used…
Updated
·
19–29 minutes -
The Three Lines Model Explained: Six Principles, the Roles, and What Changed in 2020
The Three Lines Model is the IIA’s 2020 replacement for the Three Lines of Defense, and most organizations still draw the old diagram. This guide reads the position…
Updated
·
27–40 minutes -
Risk Taxonomy: How to Build One, With a Full Three-Level Example and Six Design Rules
Every risk program references a taxonomy and almost nobody explains how to build one. This guide does: what a taxonomy is and is not, the six design rules…
Updated
·
18–27 minutes -
Risk Assessment Matrix: How to Design, Calibrate and Use One Without Fooling Yourself
The risk assessment matrix is the most used and least examined tool in risk management. This guide explains what it can and cannot do: the choice between 3×3,…
Updated
·
19–28 minutes -
How to Audit Operational Risk Management: A Work Program for the Framework, Not the Events
Auditing operational risk management means auditing the framework that identifies, assesses, monitors and reports operational risk, not re-auditing the processes where losses happen. This guide sets out the…
Updated
·
23–34 minutes -
Conduct Risk: Definition, Examples, Indicators and How Internal Audit Assesses It
Conduct risk is the risk that an organization’s behavior toward its customers, markets or counterparties causes harm, even when nothing illegal happens. This guide defines it properly, distinguishes…
Updated
·
19–29 minutes -
IBM OpenPages vs Archer: Which Regulated-Industry GRC Platform for Audit?
This comparison covers what IBM OpenPages and Archer each publish about ownership, audit workflow depth, SOX and controls, the AI features each shipped from 2024 through 2026, pricing…
Updated
·
23–34 minutes -
Optro vs MetricStream: Audit-First SaaS Suite Against the Enterprise GRC Veteran
What Optro (formerly AuditBoard) and MetricStream are and who owns them, the review-base gap between Optro’s 890 Gartner Peer Insights reviews and MetricStream’s six, how their audit workflow,…
Updated
·
23–35 minutes -
MetricStream vs ServiceNow IRM: Specialist GRC Suite or Platform Add-On?
What MetricStream and ServiceNow IRM are and who owns each, how their audit workflow, SOX coverage and 2024-2026 AI launches differ, a head-to-head scorecard and fit-by-situation table, the…
Updated
·
23–35 minutes -
IBM OpenPages Internal Audit Review: Published Prices, AI Agents and the Fit
What IBM OpenPages is and who owns it, the nine-module platform Internal Audit Management sits inside, SOX and controls, the AI releases from OpenPages 9.1 through 9.2.1, the…
Updated
·
28–42 minutes -
MetricStream Review: Audit Management Inside an AI-First GRC Suite
What MetricStream is after the May 2025 AI-first relaunch and the Blue Torch financing, the audit module stage by stage from vendor documentation, the SOX product, integrations and…
Updated
·
23–34 minutes -
Optro vs Onspring: Audit-Native Suite or the Mid-Market No-Code Platform?
Optro (formerly AuditBoard) and Onspring compared for internal audit software: real Vendr price evidence, where SOX, analytics, AI data use and FedRAMP authorization genuinely differ, the twelve-area scorecard,…
Updated
·
24–37 minutes