Risk is Our Business
- Épisodes
- 68
- Parution
- toutes les deux semaines
- Dernier épisode
- 9 Nov 2026
À propos du podcast
Welcome to Risk Is Our Business, where we explore the principles of Governance, Risk Management, and Compliance — to reliably achieving objectives, navigating uncertainty, and act with integrity.
Here, we follow the Prime Directive of Risk Management: No decision or strategy moves forward without understanding its impact on our objectives, our resilience, and our values. Because risk isn’t the enemy, it’s the mission.
After all, risk is our business.
Join us as we go boldly into the world of GRC.
Épisodes 68
Risk Across the Quadrant: AI, Interconnected Threats, and the Road to 2030 with Richard Chambers
Recorded live at Optro CRX 2026, this episode of Risk Is Our Business brings Richard Chambers back to the bridge with Captain Michael Rasmussen for a conversation about a turbulent decade, the changing nature …
Notes de l’épisode
Recorded live at Optro CRX 2026, this episode of Risk Is Our Business brings Richard Chambers back to the bridge with Captain Michael Rasmussen for a conversation about a turbulent decade, the changing nature of risk, and what lies ahead for internal audit and the broader GRC profession.
They begin with what keeps Richard awake at night. The 2020s have given risk professionals plenty to worry about, and Richard reflects on the growing interconnectedness of risks that rarely respect organizational boundaries or fit neatly into traditional categories. It's a discussion about how much the world has changed, how quickly problems can compound, and what that means for the people responsible for helping organizations anticipate trouble.
Michael and Richard also spend time discussing Richard's books, particularly his latest, and the lessons he hopes readers take from them. The conversation draws on his decades in the profession, including his time leading the Institute of Internal Auditors, and his perspective on where internal audit has made progress and where there is still work to be done.
Then there's artificial intelligence. Richard sees considerable potential for AI to make audit and GRC professionals more effective, but there are pitfalls worth understanding before handing too much responsibility to the technology. Michael and Richard explore where AI can make the greatest difference, what professionals should be watching out for, and how its growing capabilities could change the way the profession works.
They close by looking ahead to 2027 and further out to 2030. What might the profession look like by the end of the decade? Which parts of the work will change, and how should professionals prepare? Richard shares his expectations for the coming year and his thoughts on the role AI will play in shaping the next chapter of internal audit and GRC.
Red Alert: Risk, Resilience, and the Art of Readiness with Joshua Haravay
Recorded live at Mitratech Interact, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Joshua Haravay, Business & Cyber Resilience Architect at Smarsh, for a …
Notes de l’épisode
Recorded live at Mitratech Interact, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Joshua Haravay, Business & Cyber Resilience Architect at Smarsh, for a discussion about what it really means for an organization to be resilient when disruption strikes.
The conversation begins by examining the difference between business continuity and resilience. While the two are closely related, they are not necessarily interchangeable. Michael and Joshua explore what distinguishes them, where they overlap, and how resilience extends beyond maintaining operations to encompass an organization's ability to respond and adapt when circumstances change.
From there, they examine the relationship between resilience and risk management, discussing why the two disciplines depend on one another. Understanding uncertainty helps organizations prepare for disruption, while resilience capabilities influence how effectively those risks can be managed. They also explore the growing complexity of modern businesses, where dependencies and interdependencies between people, processes, technology, and third parties can turn an isolated problem into a much larger operational challenge.
The discussion then turns to tabletop exercises and micro-simulations, and how organizations can use them to sharpen their awareness, test assumptions, and strengthen their ability to recognize and respond to emerging threats. Joshua shares his perspective on why meaningful preparation requires more than documenting procedures. It requires giving people opportunities to practice, learn, and improve before they find themselves making decisions under pressure.
And, of course, Captain Michael poses a familiar question about what keeps Joshua awake at 1 a.m. when it comes to risk and resilience. The conversation explores the concerns that occupy resilience professionals when they consider the complexity of the organizations they are responsible for protecting and the possibility of disruptions they may not see coming.
Keeping Pace at Warp: AI, Audit Transformation, and Breaking Down Silos with Jan Murry & Rachel Nelson
Recorded live at Optro CRX 2026, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Jan Murry and Rachel Nelson of GE Aerospace, exploring how internal audit can keep …
Notes de l’épisode
Recorded live at Optro CRX 2026, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Jan Murry and Rachel Nelson of GE Aerospace, exploring how internal audit can keep pace with a business environment where change rarely waits for traditional assurance processes to catch up.
The conversation begins with a familiar question about what keeps risk and GRC leaders awake at night. For Jan and Rachel, one of the greatest concerns is whether their organizations and teams are responding to change quickly enough. Drawing on their experiences at GE Aerospace, they discuss some of the biggest challenges they have encountered, the lessons learned along the way, and why breaking down organizational silos is essential to effective risk management.
They also examine what bad risk management looks like and how organizations can avoid repeating familiar mistakes. A central part of the discussion focuses on GE Aerospace's internal audit technology transformation and how Jan and Rachel worked to align that effort with broader enterprise objectives. Rather than treating the implementation of new technology as an achievement in itself, they explain the importance of demonstrating measurable business value and ensuring that innovation improves how the function operates.
The conversation then turns to artificial intelligence and the challenge of balancing rapid technological innovation with the governance and security requirements of a global aerospace company. Michael, Jan, and Rachel explore how organizations can embrace emerging capabilities while maintaining the oversight, discipline, and accountability needed to manage the risks that accompany them.
They also discuss the human side of transformation, including the cultural shifts and change management strategies required to make new ways of working stick. From encouraging user adoption to establishing standardized processes and consistent execution, Jan and Rachel share how meaningful transformation depends as much on people and organizational alignment as it does on technology.
Beyond the Red Alert: What Good GRC Actually Looks Like with Jannie Wentzel & Andrew Gunter
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Jannie Wentzel and Andrew Gunter, Partner and Principal GRC Consultants at Cential, for a candid conversation about where risk …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Jannie Wentzel and Andrew Gunter, Partner and Principal GRC Consultants at Cential, for a candid conversation about where risk management and GRC go wrong, particularly inside American organizations, and what it takes to set a better course.
Jannie and Andrew take the helm for much of the discussion, beginning with the bad. They explore the habits, structures, and assumptions that leave risk and compliance programs disconnected from the business, including approaches built around satisfying requirements rather than helping organizations understand uncertainty and make better decisions.
The conversation turns to the state of risk management in the United States and some of the recurring weaknesses they encounter in practice. Rather than treating those problems as inevitable features of GRC, they examine what organizations can do differently and why effective risk management begins with understanding the business, its objectives, and the decisions people are actually trying to make.
From there, the discussion moves naturally into what good risk management looks like. Jannie and Andrew draw on years spent working directly with organizations to discuss the importance of alignment, practical processes, clear ownership, and GRC programs designed around business value rather than bureaucracy.
More than a prescribed tour through frameworks and methodologies, this episode is a practitioner-led conversation about the state of the profession and the course corrections that can turn GRC from an obligation into something the business genuinely wants on the bridge.
Charting New Frontiers: Risk, AI, and the Future of GRC in the Philippines with Rookie Nagtalon
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Rookie Nagtalon, technology executive, strategist, and AI advocate, for a conversation about how governance, risk, and compliance are …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Rookie Nagtalon, technology executive, strategist, and AI advocate, for a conversation about how governance, risk, and compliance are evolving in one of Asia's fastest-changing digital economies.
The discussion begins with the realities keeping Philippine organizations awake at night. From increasingly complex regulatory requirements to the rapid adoption of artificial intelligence, Rookie explains how organizations are balancing innovation with governance while strengthening the people, processes, and technologies that underpin effective risk management.
Michael and Rookie explore what makes the Philippine approach to risk and compliance distinctive, where organizations continue to mature, and why developing AI capabilities, improving workflows, and investing in the right skills have become strategic priorities. They also examine the remarkable diversity of the Asia-Pacific region, arguing that there is no single APAC model for GRC and discussing how the Philippines is helping shape regional thinking around digital transformation and modern governance.
Artificial intelligence remains a central theme throughout the conversation. Rookie shares his perspective on AI governance, AI risk, and why successful AI initiatives depend less on sophisticated models than on trustworthy, well-governed data. The discussion also explores the current state of AI regulation in the Philippines and how organizations can prepare for a regulatory landscape that continues to evolve alongside the technology itself.
The episode concludes by looking toward 2030, considering how governance, risk, and compliance may change over the coming years and what organizations can do today to build the capabilities they'll need for tomorrow. It's a thoughtful discussion about leadership, technology, and why the future of GRC will belong to organizations that combine innovation with disciplined governance.
Chapitres (8)
The Sustainable Frontier: Risk, Value, and the Future with Ellen Holder
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Ellen Holder, Managing Director and Sustainability & ESG Lead EMEA at Protiviti, for a conversation that asks a deceptively simple …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Ellen Holder, Managing Director and Sustainability & ESG Lead EMEA at Protiviti, for a conversation that asks a deceptively simple question. Is sustainability really about reporting, or is it something much bigger?
Together they explore how the conversation has evolved from sustainability to ESG, and why many organizations are now shifting back again. Ellen explains that sustainability was never just about the environment. It has always encompassed environmental, social, and governance considerations, but without some of the political baggage the term ESG has accumulated in recent years.
The discussion draws on an unexpected lesson from Ted Lasso, where the idea that "doing the right thing is never the wrong thing" becomes a useful way of thinking about sustainability. Rather than treating it as another compliance requirement, Ellen argues that sustainability should be understood as a long-term strategic capability that helps organizations create value not only for today, but for future generations.
Michael and Ellen also examine the relationship between sustainability and enterprise risk, the role of double materiality assessments, and the practical challenges organizations face when trying to integrate sustainability into existing governance and risk management programs. They discuss where technology, and particularly AI, is beginning to make a meaningful contribution, and how approaches to sustainability differ between Germany, the rest of Europe, and other regions around the world.
At its heart, this episode is about looking beyond quarterly reporting cycles and asking a more fundamental question. How do organizations build resilience and create lasting value by making decisions that remain the right ones tomorrow as well as today?
At the Speed of Trust: Reimagining Risk for the AI Era with Benjamin Lüders
Recorded live at Corporate Risk Minds 2026 in Berlin, this episode of the Risk Is Our Business Podcast features returning guest Benjamin Lüders, Partner and Risk Consulting Service Leader for Europe West and …
Notes de l’épisode
Recorded live at Corporate Risk Minds 2026 in Berlin, this episode of the Risk Is Our Business Podcast features returning guest Benjamin Lüders, Partner and Risk Consulting Service Leader for Europe West and Germany at EY, for a conversation on how enterprise risk management is being reimagined for an increasingly unpredictable world.
Drawing on EY's recent research into risk transformation, Benjamin and Captain Michael Rasmussen explore why traditional models of risk management are reaching their limits. As organizations contend with accelerating change, geopolitical uncertainty, AI, and growing interconnectedness, risk functions must evolve from monitoring the business to helping shape its future.
The discussion centers on what it means to operate at the speed of trust, where risk becomes an enabler of confident decision-making rather than a governance checkpoint. Benjamin shares how technology is supporting this transformation, not simply through automation, but by creating connected capabilities that improve visibility, coordination, and action across the enterprise.
A significant part of the conversation focuses on agentic AI and how organizations should think about it within three complementary layers: systems of orchestration, systems of intelligence, and systems of action. Rather than viewing AI as another tool, they discuss its potential to reshape how organizations sense, interpret, and respond to uncertainty.
They also explore EY's work recognizing organizations leading this transformation, highlighting the practical innovations and leadership approaches that are redefining modern risk management. Check out the links for the EY Risk Transformation papers . . .
EY Risk Transformation Series for the show notes.
Built on Trust: Risk, Assurance, and the Norwegian Perspective
In this episode of Risk Is Our Business, Captain Michael Rasmussen sits down with leaders from Norway’s Institute of Internal Auditors for a conversation about how culture shapes governance, risk, compliance …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen sits down with leaders from Norway’s Institute of Internal Auditors for a conversation about how culture shapes governance, risk, compliance, and assurance.
The discussion begins with Norwegian business culture and one of its defining characteristics: trust. They explore how trust influences decision-making, accountability, and assurance practices, and how that foundation differs from more rules-driven environments. The conversation also examines the maturity of risk management and assurance in Norway, where strong practices coexist with significant opportunities for growth as organizations confront increasingly complex and fast-moving risks.
The group discusses the challenges facing assurance professionals today, including the accelerating pace of change, emerging risks, and the need for organizations to adapt without losing sight of business value. They compare Nordic and U.S. approaches to risk management, highlighting the more pragmatic, business-oriented perspective often found across Scandinavia.
A particularly interesting part of the conversation focuses on the evolution of Norway’s IIA chapter itself. Unlike many national chapters, the Norwegian organization has expanded beyond a traditional audit focus to serve a broader community of GRC professionals. They share how that transformation occurred, what it has meant for members, and how they see the organization evolving toward 2030.
The episode closes with practical advice for organizations seeking to strengthen assurance and risk management capabilities in an environment where trust remains essential, but trust alone is no longer enough.
The Sound of Risk: Why Listening Matters More Than Knowing with Bruno Parnet
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Bruno Parnet, Manager of Risk Management at Audemars Piguet, for a conversation on the human side of risk management and …
Notes de l’épisode
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Bruno Parnet, Manager of Risk Management at Audemars Piguet, for a conversation on the human side of risk management and what it takes to build a program that genuinely supports the business.
Captain Michael Rasmussen begins by asking a familiar question to any listener—what keeps risk leaders awake at night? For Bruno, the answer lies not only in specific threats facing a company that manufactures some of the world's most prestigious timepieces, but also in the challenge of understanding risks well enough to act before they become problems.
The discussion explores what bad risk management looks like, including approaches that are disconnected from the business or focused more on process than outcomes. In contrast, Bruno argues that good risk management starts with listening. Risk professionals must acknowledge that they do not have all the answers, engage stakeholders across the organization, and act as facilitators who help the business understand and navigate uncertainty.
They also discuss whether Switzerland has its own approach to risk management and how culture influences the way organizations think about governance, decision-making, and accountability. From there, the conversation turns to the future, exploring how Bruno sees his risk management program evolving by 2030 and the role technology may play in supporting that journey.
The episode closes with practical advice for organizations seeking to strengthen their risk capabilities, emphasizing that effective risk management is often less about imposing frameworks and more about building trust, creating dialogue, and helping people make better decisions.
Conducting Resilience: Beyond Compliance and Into Action with Aurore Chatard
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Aurore Chatard in a conversation about what it truly takes to build resilience in an increasingly complex and …
Notes de l’épisode
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Aurore Chatard in a conversation about what it truly takes to build resilience in an increasingly complex and interconnected world.
Captain Michael Rasmussen and Aurore begin by discussing what keeps resilience leaders awake at night and why many organizations still struggle to move beyond a compliance-driven view of continuity and resilience. They unpack what bad resilience looks like, including programs that exist primarily to satisfy regulatory requirements, before exploring the characteristics of organizations that are genuinely prepared to adapt, respond, and recover.
A central theme of the discussion is orchestration. Michael and Aurore compare resilience to a symphony orchestra, where success depends not on individual performers but on how well people, processes, technologies, and leadership work together. Without coordination, even the most capable functions can fail when disruption strikes.
The conversation also explores the growing influence of regulations such as NIST and DORA, examining whether they help organizations become more resilient or risk turning resilience into another compliance exercise. Along the way, Aurore shares lessons learned from years spent leading security, continuity, and crisis management programs, offering practical insights for professionals looking to strengthen resilience capabilities within their own organizations.
They close by reflecting on Risk-!n Conference 2026 itself, discussing the growth of the event, the conversations shaping the future of the profession, and the increasing recognition that resilience is becoming a core business capability rather than a specialist discipline.
Shaking the Prime Directive: Rethinking Risk from the Ground Up with Adrian Clements
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business begins with a warning from Adrian Clements. Before agreeing to come aboard, he made it clear that he intended to "shake the tree." …
Notes de l’épisode
Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business begins with a warning from Adrian Clements. Before agreeing to come aboard, he made it clear that he intended to "shake the tree." Captain Michael Rasmussen's response was simple: engage.
What follows is a conversation that challenges some of the profession's most deeply held assumptions. Adrian argues that many organizations are still navigating with outdated star charts, relying on inherited frameworks and conventional wisdom that no longer match the realities of today's environment. Rather than tweaking existing approaches, he makes the case for stepping back, questioning first principles, and rebuilding from the ground up.
They explore what that looks like in practice. How do organizations break free from legacy thinking? How do leaders create the conditions for better decision-making? And what practical steps can be taken to transform risk from a compliance exercise into a driver of performance and value creation?
The discussion also examines the role of technology. Not as the destination, but as an enabler that helps organizations operationalize better thinking, improve visibility, and support more intelligent decisions.
Along the way, Adrian and Michael reflect on their key takeaways from Risk-!n Conference 2026, discussing the ideas and trends that suggest the profession may be entering a new phase of evolution.
The Speed of Risk: Controls and Decision-Making with Hermann Suter
Recorded live at the Risk-!n Conference 2026, this episode of Risk Is Our Business features Hermann Suter, Head of Group Enterprise Risk Management at Barry Callebaut Group, in a conversation on how risk …
Notes de l’épisode
Recorded live at the Risk-!n Conference 2026, this episode of Risk Is Our Business features Hermann Suter, Head of Group Enterprise Risk Management at Barry Callebaut Group, in a conversation on how risk management must evolve in an environment where the speed of change is accelerating faster than many organizations can absorb.
Hermann and Captain Michael Rasmussen begin with a deceptively simple question. If organizations claim to have an enterprise-wide view of risk, shouldn’t they also have an enterprise-wide view of controls? From there, the discussion turns to what actually keeps risk leaders awake at night. Not just specific threats, but the sheer pace and velocity of risk itself.
They unpack what bad risk and control management looks like. In contrast, they argue that effective risk management starts with understanding that every meaningful decision already contains a form of risk analysis, whether organizations recognize it or not.
The conversation also explores how to align risk with business culture rather than impose it from the outside, how Swiss and broader European perspectives influence approaches to governance and controls, and where technology is genuinely helping modern ERM programs.
They close by discussing what excited them most at the conference itself, including the growing focus on interconnected risk, operational resilience, and the future direction of enterprise risk management.
The Extended Enterprise: Third-Party Risk at Warp Scale with Darren Smith
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Darren Smith for a deep dive into third-party risk management in the age of the extended enterprise. The conversation explores how …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Darren Smith for a deep dive into third-party risk management in the age of the extended enterprise.
The conversation explores how modern organizations now operate through vast and increasingly interconnected networks of suppliers, partners, outsourcers, and service providers, creating a web of dependencies that stretches far beyond traditional organizational boundaries. Darren explains why TPRM can no longer sit within a single function, and how procurement, security, compliance, legal, operations, sustainability, and business leadership all play critical roles in managing third-party exposure.
They also unpack what separates bad TPRM (fragmented, compliance-driven, reactive) from good TPRM that is integrated, collaborative, and aligned with business objectives. They also examine how organizations define “critical suppliers,” why that definition is often more complex than it appears, and how businesses can better coordinate across departments to create a unified view of third-party risk.
The discussion then turns to technology and AI. Darren shares his perspective on where current TPRM tooling adds value, where maturity is still lacking, and how organizations can move beyond treating TPRM as a checkbox exercise toward something more strategic and forward-looking.
This episode is about managing risk in a world where the enterprise no longer ends at the company boundary and where resilience depends on understanding the entire ecosystem connected to the ship.
From Controls to Clarity: Aligning Risk and Control Across the Enterprise with Kristina Wiese Tranberg, Karoline Corfitz & Morten Bjerregaard
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Kristina Wiese Tranberg back to the bridge, joined by Karoline Corfitz and Morten Bjerregaard, for a practical deep dive into …
Notes de l’épisode
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Kristina Wiese Tranberg back to the bridge, joined by Karoline Corfitz and Morten Bjerregaard, for a practical deep dive into internal controls and their role in modern GRC.
Building on Kristina’s previous appearance, the conversation shifts from operating models and transformation to a core question of what is the real value of controls? The group explores how organizations can move beyond checkbox compliance toward control optimization that supports business outcomes rather than slowing them down.
They also challenge a common disconnect. Many organizations aim for an enterprise-wide view of risk, but lack an enterprise view of controls. Without understanding how controls operate across processes and functions, can risk truly be understood at scale?
The discussion then examines the relationship between risk owners and control owners, and when they should be the same, when they should be different, and how that choice affects accountability and effectiveness. They also unpack the 1-10-100 rule, illustrating how the cost of fixing issues escalates the later they are detected, and why embedding controls early in processes is critical.
This episode offers a grounded, experience-led perspective on aligning risk, controls, and ownership across the enterprise.
Risk in Deep Space: Culture, Appetite, and Real GRC in Practice with Michael Erlandsson Jensen
In this episode of Risk Is Our Business, Captain Michael Rasmussen sits down with Michael Erlandsson Jensen at April Coffee in Copenhagen, a busy café whose ambient hum feels oddly right for a conversation …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen sits down with Michael Erlandsson Jensen at April Coffee in Copenhagen, a busy café whose ambient hum feels oddly right for a conversation grounded in real-world experience.
Michael opens by tracing his path through global risk management, and from there the two find their way into something that doesn't get discussed enough: how differently risk culture actually plays out depending on where you are in the world. The Danish and broader European approach tends to weave risk into everyday business dialogue—collaborative, embedded, almost organic. That's a sharp contrast to the more compliance-first environments Michael has worked in across parts of the Middle East and the U.S., where risk can feel like something done to the business rather than with it.
That tension shapes the heart of the conversation. For Michael, good risk management isn't about control or enforcement, it's about facilitation. Helping the business understand its own risks, take ownership of them, and actually talk about them. Bad risk management, by contrast, is disconnected from decisions that matter, buried in process, and more interested in checking boxes than in being useful.
They also dig into risk appetite a concept that's often treated as a document to file away and forget. Michael pushes back on that, reframing it as something that should reflect how an organization actually behaves, not just what it says on paper. The real work, he argues, is closing the gap between strategy, risk, and what happens on the ground day to day.
It's a grounded, cross-cultural take on GRC and a reminder that the real work of risk doesn't live in frameworks. It lives in conversations.
When Risk Gets Real: Lessons from the Bridge
In this episode of Risk Is Our Business, Captain Michael Rasmussen brings together a cross-functional crew of risk, audit, cyber, and technology leaders for a candid conversation recorded in the Netherlands …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen brings together a cross-functional crew of risk, audit, cyber, and technology leaders for a candid conversation recorded in the Netherlands. Joined by David Ngu, Brett Steinmetz, Jos Bredero, and Eric Groen, the discussion opens with a simple question: what actually keeps you up at 1 a.m. when it comes to risk?
From there, the conversation explores the key drivers shaping risk management in the Netherlands, and how they compare to broader European and U.S. approaches. The group reflects on how Europe tends to lean more toward principles and outcomes-based thinking, while the U.S. often emphasizes rules and compliance and how those differences play out in practice across organizations and industries.
They then turn to the role of professional services firms, unpacking what a successful engagement really looks like. Rather than focusing purely on tooling, the discussion emphasizes the importance of a business-oriented approach, ensuring that technology implementations are grounded in real operational needs, not just frameworks or features.
The episode closes with each guest offering a key takeaway and practical insights drawn from their experience working across risk, controls, cyber, and consulting.
This is a grounded look at how risk is actually managed on the ground (across regions, disciplines, and perspectives) when the frameworks meet reality.
From Heatmaps to Histograms: Rewriting Cyber Risk on the Bridge with Tony Martin-Vegue
In this return episode of Risk Is Our Business, Captain Michael Rasmussen reconnects with Tony Martin-Vegue for a wide-ranging conversation built around his new book, From Heatmaps to Histograms: A Practical …
Notes de l’épisode
In this return episode of Risk Is Our Business, Captain Michael Rasmussen reconnects with Tony Martin-Vegue for a wide-ranging conversation built around his new book, From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification.
At the center of the discussion is a simple but uncomfortable idea: most organizations aren’t really measuring cyber risk, they’re describing it. Heatmaps, scoring models, and qualitative frameworks may look familiar, but they rarely help leaders make better decisions.
Tony breaks down what’s going wrong, and why. Along the way, he uses an unexpected historical example (the Hanoi Rat Massacre of 1902) to illustrate how well-intentioned interventions can create worse outcomes when incentives, measurement, and behavior are misaligned.
The conversation moves through the core themes of the book:
- Why cybersecurity often behaves like two separate disciplines under one label
- Why quantitative risk is less about advanced math and more about structured thinking
- The biggest myth about data that keeps organizations stuck in qualitative approaches
- Where methods like Monte Carlo simulation and FAIR fit and where they don’t
They also explore why many cyber risk quantification programs fail, what it takes to make them practical, and how the same principles apply beyond cyber to operational risk more broadly.
At over an hour, this is one of the most in-depth conversations on the show! It's less a summary and more a working session on how to move from risk reporting to decision-making.
Staying on Course: Risk, AI, and Resilience in a Changing World with Hakkı Sarp
In this episode of Risk Is Our Business, Captain Michael Rasmussen connects over a slightly distant comms link (via Teams) with Hakkı Sarp, Enterprise Risk Management leader at QIAGEN, for a conversation on how …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen connects over a slightly distant comms link (via Teams) with Hakkı Sarp, Enterprise Risk Management leader at QIAGEN, for a conversation on how risk management is being reshaped by today’s fast-moving environment.
They begin by examining the limitations of traditional risk practices, and why approaches built for slower, more predictable conditions are struggling to keep up with the velocity and complexity organizations now face. From there, the discussion turns to AI and separating real value from hype, including identifying where it is genuinely enhancing risk management today versus where expectations may be running ahead of reality.
Hakkı and Michael explore the dual challenge of predicting risks while remaining adaptable, and how organizations must balance short-term financial pressures with longer-term sustainability considerations that don’t always fit neatly into existing frameworks. They also unpack the role of risk culture and what it really means, why it’s so difficult to embed, and how leadership behaviors ultimately determine whether risk is lived or simply documented.
The conversation closes with a simple but powerful perspective on how leaders should approach risk in a world where uncertainty is constant and conditions change faster than frameworks can keep up.
The Search for Sense: Risk Appetite and Real Decisions with Graeme Keith
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes back Graeme Keith for a sequel to Wrath of Math, this time shifting from models to meaning. They take aim at cookie-cutter risk …
Notes de l’épisode
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes back Graeme Keith for a sequel to Wrath of Math, this time shifting from models to meaning.
They take aim at cookie-cutter risk management, unpacking what separates genuine practice from templated frameworks that look good on paper but fail to influence decisions. The conversation centers on Graeme’s recent writing on risk appetite, and his frustration with how often organizations discuss the risks they’re willing to take without addressing the more fundamental question of why are we taking those risks at all?
From there, they explore how risk appetite is often less about numbers and more about culture, intent, and context, and why effective risk management must always be anchored to the decisions it is meant to support. Without that connection, risk becomes descriptive rather than directional.
They also dive into the realities of interconnected risk, the current state of risk technology, and where the discipline may be heading by 2030, including whether tools are helping organizations make better decisions, or simply producing more sophisticated noise.
If Wrath of Math challenged how we quantify risk, this episode challenges how we make sense of it and whether risk management is truly helping us navigate, or just giving us more charts while we drift.
Commanding the Room: From Risk Data to Real Influence with Karan Rao
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Karan Rao, Head of Enterprise Risk at Embark Student Corp., for a conversation that started not in a boardroom but on LinkedIn. A …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Karan Rao, Head of Enterprise Risk at Embark Student Corp., for a conversation that started not in a boardroom but on LinkedIn.
A post from Karan caught Michael’s attention on how the best risk managers aren’t the ones with the most complex models, but the ones who can walk into a room, read the people, interrogate the data, and explain risk so clearly that action becomes unavoidable.
From there, the discussion dives into the human side of risk. They explore why understanding behavior is just as important as understanding data, and why the ability to communicate, write, and present with clarity separates those who inform from those who influence. Risk leaders, they argue, don’t hide behind dashboards, they translate insight into decisions.
They also discuss the importance of developing skills that compound over time: communication, storytelling, emotional intelligence, and business understanding. Karan shares how ideas from Atlas of the Heart shape his approach to risk leadership, helping him connect emotion, clarity, and decision-making in high-stakes environments.
This episode is about moving risk from a reporting function to a leadership discipline, one where the ability to engage the room matters just as much as the data on the screen.
Leading Through Uncertainty: The Future of Risk and Cyber with Anne Louise Higgins
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Anne Louise Higgins, Global Head of Cyber Governance, Risk and Control at BNY Mellon, for a conversation about how the risk profession …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Anne Louise Higgins, Global Head of Cyber Governance, Risk and Control at BNY Mellon, for a conversation about how the risk profession has evolved and who will be leading it into the future.
Anne reflects on the growing role of women in risk management and cybersecurity, and how diversity of experience and perspective strengthens decision-making at every level of the enterprise. From there, the discussion broadens into how the practice of risk management itself has changed over time, from compliance-driven reporting toward more integrated, business-aligned approaches.
They also explore the cultural differences in how risk is approached in the United States versus Europe, and how those perspectives shape governance, accountability, and engagement with leadership. The conversation then turns to risk technology, what currently stands out in the market, and how emerging capabilities are reshaping the way organizations understand and manage uncertainty.
Michael and Anne also discuss the future of careers in risk, cyber, and GRC, particularly in an era increasingly shaped by AI and rapid technological change. The episode closes with practical insights on how professionals can future-proof their careers and build the skills, adaptability, and strategic mindset needed to stay relevant on the bridge as the risk landscape continues to evolve.
Setting the Standard: The Past, Present, and Future of ISO 31000 with Alex Dali
In this episode of Risk Is Our Business, Captain Michael Rasmussen connects over a slightly long-distance subspace channel (also known as a video call) with Alex Dali, President of the G31000 Risk Institute, to …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen connects over a slightly long-distance subspace channel (also known as a video call) with Alex Dali, President of the G31000 Risk Institute, to explore the evolution of one of the most widely recognized frameworks in modern risk management.
Alex walks through the story of ISO 31000, where the standard came from, how it has evolved since its original release, and what the next phase of its development may look like as organizations confront an increasingly complex risk landscape.
Along the way, they unpack the difference between bad risk management (overly procedural, disconnected from decisions, and driven by checklists and heat maps) and good risk management, which aligns with organizational objectives and supports leadership in navigating uncertainty.
The conversation also turns to the current state of risk technology, including the ongoing search for tools that genuinely support the principles of ISO 31000 rather than forcing risk management into rigid compliance workflows. From there, they explore how AI may reshape the discipline, the role technology should play in enabling better decision-making, and how the Chief Risk Officer role itself may evolve as risk becomes more integrated with strategy and business operations.
The discussion offers a thoughtful look at how risk management standards, technology, and leadership must evolve together if organizations are to navigate uncertainty with clarity rather than simply documenting it.
Know Your Crew: Risk Psychology with Geoff Trickey and Elliot Phillips
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Geoff Trickey, founder of Psychological Consultancy and creator of the Risk Type Compass™, alongside Elliot Phillips, Principal …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Geoff Trickey, founder of Psychological Consultancy and creator of the Risk Type Compass™, alongside Elliot Phillips, Principal Risk Psychologist, for a conversation that shifts the focus of risk management from systems to psychology.
They begin by unpacking psychometrics—what it is, how it works, and why measuring personality traits can provide powerful insight into how individuals and teams perceive and respond to uncertainty. From there, they explore the concept of risk psychology and how risk-taking is not simply situational or financial, but deeply rooted in personality.
Geoff explains the origins of the Risk Type Compass™ and walks through its eight distinct risk types and how individuals are categorized, what differentiates them, and how those differences shape decision-making and risk culture within organizations. The discussion highlights an often-overlooked dimension of diversity—diversity of risk disposition. When leaders understand the varied ways people approach uncertainty, they can build more balanced teams, improve governance conversations, and avoid collective blind spots.
The episode also examines how organizations use this approach in practice, not as a personality exercise, but as a measurable way to strengthen risk management, enhance communication, and align decision-making with strategic objectives.
If every enterprise is a starship navigating uncertainty, this conversation reminds us that understanding the temperament of the crew may be just as important as the strength of the shields.
Beyond Controls: Rebuilding the Risk Engine with Amir Ramezanpour
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes back Amir Ramezanpour to unpack the thinking behind his new book, Beyond Controls: Reshaping Risk Into Intelligent Advantage …
Notes de l’épisode
In this return episode of Risk Is Our Business, Captain Michael Rasmussen welcomes back Amir Ramezanpour to unpack the thinking behind his new book, Beyond Controls: Reshaping Risk Into Intelligent Advantage.
The conversation begins with a direct challenge to risk managers: too much of risk management is still focused on controls. Controls that validate compliance. Controls that document activity. Controls that comfort regulators. But in an AI-driven, high-velocity environment, are controls alone enough?
Amir explains why the title Beyond Controls is intentionally provocative and why some initially resist it while agreeing with the substance. The core argument is not about removing controls, but about elevating risk into something more powerful: risk intelligence. That means turning fragmented risk data into meaningful insight that helps leaders make better decisions amid uncertainty.
They explore how good risk intelligence supports business objectives, how it enables clarity rather than bureaucracy, and how organizations can move from static oversight to more adaptive, learning-oriented models. The discussion also touches on the role of AI, agentic AI, and digital twins, not as hype, but as tools that can help organizations anticipate rather than simply react.
Finally, Amir shares practical advice for leaders who want to begin building this vision today—start with mindset, anchor to objectives, and design systems that support decisions, not just documentation.
If traditional risk management built stronger guardrails, this episode asks how we build something smarter, an engine that helps the enterprise move forward with confidence.
Steering Through Uncertainty: Enterprise Risk at Rolls-Royce with Chyono Flynn
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Chyono Flynn, Head of Enterprise Risk Management at Rolls-Royce, for a candid conversation about the realities of running risk …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Chyono Flynn, Head of Enterprise Risk Management at Rolls-Royce, for a candid conversation about the realities of running risk management inside one of the world’s most complex engineering organizations.
They begin with what really keeps risk leaders awake at 2 a.m., which is not abstract frameworks, but execution risk, governance expectations, and whether the organization truly understands its most critical exposures. From there, the discussion moves into the UK Corporate Governance Code, with particular focus on Provision 29, and what it means in practice for boards, executives, and risk teams responsible for viability and long-term resilience.
Chyono and Michael draw clear distinctions between bad risk management (compliance-driven, disconnected, and report-heavy) and good risk management that engages the business, informs decisions, and earns trust at the executive and board level. They explore how to communicate the value of risk in a way that resonates, how to build and sustain a healthy risk culture, and why partnership matters more than policing.
They also discuss the role of technology as an enabler rather than a solution in itself, and how tools must support judgement, insight, and dialogue rather than replace them.
This episode offers a grounded look at what enterprise risk management looks like when governance expectations are high, stakes are real, and risk must help the organization stay on course, even when the pressure is on and sleep is in short supply.
Before the Alarm Sounds: Risk Intelligence, Presilience, and Leadership with Fayadh Alenezi
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Fayadh Alenezi, strategic risk leadership architect and presilience advisor, for a candid discussion on where risk management …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Fayadh Alenezi, strategic risk leadership architect and presilience advisor, for a candid discussion on where risk management stands today and where it needs to go next.
They begin by unpacking the current state of practice and what works, what doesn’t, and why too much risk management still feels like process without purpose. From there, the conversation moves into risk intelligence and the importance of good information, meaningful insight, and decision-relevant signals rather than noise.
Fayadh introduces the concept of presilience, shifting the focus from reacting to disruption toward building the foresight and decision capability to stay ahead of it. This naturally leads into a deeper discussion on risk leadership and what distinguishes strong risk leaders from framework managers, and why mindset, judgment, and clarity matter as much as models and data.
They also explore risk culture, with particular attention to the Middle East and Saudi Arabia, where cultural context, leadership norms, and rapid transformation shape how risk is perceived and practiced. The discussion connects these themes to Vision 2030, and how it is acting as a catalyst for more mature, strategic, and leadership-driven approaches to risk management across the Kingdom.
Rather than treating risk as a compliance obligation, this episode reframes it as a leadership discipline—one rooted in intelligence, culture, and the ability to act with confidence before the alarm sounds.
Risk, Resilience, and Vision 2030: The Future of GRC in Saudi Arabia with Thamer Al Hamed
Recorded live at the GPRC Summit in Riyadh, this episode of Risk Is Our Business features Thamer Al Hamed, Executive General Manager of GRC and Data Management, in a timely conversation on how risk management …
Notes de l’épisode
Recorded live at the GPRC Summit in Riyadh, this episode of Risk Is Our Business features Thamer Al Hamed, Executive General Manager of GRC and Data Management, in a timely conversation on how risk management and resilience are converging as strategic capabilities in Saudi Arabia.
Michael and Thamer explore the relationship between risk and resilience, asking whether they truly belong together and how that relationship changes at national and organizational scale. The discussion then turns to the Saudi context, examining both the challenges and the opportunities shaping the evolution of GRC across the Kingdom.
A central theme is Vision 2030, and the role GRC plays in enabling it. Thamer explains how Vision 2030 has become a powerful catalyst for the growth and maturity of governance, risk, and compliance practices—shifting GRC from a supporting function into a strategic enabler of transformation, accountability, and long-term value creation.
They also discuss how GRC is being received across organizations, how mindsets are changing, and what it takes for risk management to move beyond formality and into real decision support. The conversation closes with Thamer reflecting on his own career journey and how he sees both his role, and the broader GRC landscape in Saudi Arabia, evolving as 2030 approaches.
This episode offers a clear window into how risk, resilience, and governance are being redefined in one of the world’s fastest-moving transformation agendas.
Red Alerts and False Signals: Separating Real Risk Intelligence from GRC Noise with Stefan Gershater
In this return voyage of Risk Is Our Business, Captain Michael Rasmussen reconnects with Stefan Gershater for a candid, occasionally interrupted conversation from opposite ends of a video call—a fitting setup …
Notes de l’épisode
In this return voyage of Risk Is Our Business, Captain Michael Rasmussen reconnects with Stefan Gershater for a candid, occasionally interrupted conversation from opposite ends of a video call—a fitting setup for a discussion about signal, noise, and what actually matters in modern risk management.
The episode centers on the real value of risk and GRC software, and how leaders should measure it. Stefan brings a healthy skepticism to the conversation, challenging an industry that too often sells efficiency for efficiency’s sake. Over dinner in London, he recalls receiving a message from a vendor promising to save him 80% of his time. His reaction was blunt: No one cares how hard risk teams work, they care about outcomes, decisions, and results.
From there, the discussion explores what risk leaders should actually evaluate in risk technology. Rather than control-heavy platforms built primarily for compliance, Stefan argues for solutions designed to support value creation, decision-making, and the achievement of objectives. They unpack what “good” looks like when it comes to risk data, data strategy, and visualization, and why many tools still struggle to present risk in ways the business can act on.
As the conversation turns to how risk technology should evolve, reality intervenes. A call from Stefan’s CEO pulls him away from the bridge mid-discussion, an unscripted reminder that risk management doesn’t live in dashboards or demos, but in the real-time demands of leadership.
This episode is a sharp look at why not all risk software deserves a place on the bridge, and why separating meaningful intelligence from false alerts has never mattered more.
Beyond the Security Console: Digital Risk and Resilience on the Bridge with Christopher Hetner
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Christopher Hetner, Senior Cyber Risk Advisor serving the boardroom community and former senior cybersecurity advisor to the Chair …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Christopher Hetner, Senior Cyber Risk Advisor serving the boardroom community and former senior cybersecurity advisor to the Chair of the U.S. Securities and Exchange Commission.
The conversation opens by tackling a deceptively simple question: what do we even call this space anymore? Information security, IT security, cybersecurity, cyber risk, digital risk, digital resilience — are these distinct disciplines with meaningful nuance, or different labels for the same underlying reality? Christopher and Michael unpack how language shapes expectations, accountability, and how risk is understood across the enterprise.
From there, they dive into Michael’s widely discussed essay, “The CISO Is Dead: A Eulogy and a Resurrection,”exploring why the title provoked resistance while the substance resonated. The discussion reframes the modern CISO not as a narrow security operator, but as a steward of digital risk and resilience in a world where every function, product, and decision carries a digital footprint.
They explore the dangers of cybersecurity leaders operating in isolation, the limits of traditional security-centric models, and why cyber risk can no longer live on its own island. The conversation then turns to the boardroom, what directors tend to understand about cyber and digital risk, where gaps remain, and how risk leaders can engage boards more effectively by shifting from technical reporting to strategic navigation.
Rather than treating cyber risk as a technical problem to be delegated, this episode makes the case for digital risk and resilience as a bridge-level responsibility, one that requires shared ownership, clearer language, and leadership capable of steering the enterprise through an increasingly interconnected and uncertain risk universe.
Keeping Time on the Bridge: The Rhythm of Risk with Bradley Jewett
In this episode of Risk Is Our Business, Captain Michael Rasmussen opens a subspace channel with Bradley Jewett, Chief Financial Officer at LeadVenture and a seasoned operating executive who helped shape …
Notes de l’épisode
In this episode of Risk Is Our Business, Captain Michael Rasmussen opens a subspace channel with Bradley Jewett, Chief Financial Officer at LeadVenture and a seasoned operating executive who helped shape enterprise risk management inside Microsoft and BMC Software.
The discussion begins by contrasting bad risk management (periodic, siloed, and designed to check a box) with good risk management that actively informs how organizations make decisions. From there, Brad introduces the philosophy he championed at Microsoft: the Rhythm of Risk.
Rather than positioning risk as a separate function, Brad describes an approach where risk management keeps pace with the enterprise itself. Strategic planning cycles, annual operating plans, mergers and acquisitions, audit planning, SEC reporting, investor communications, and product roadmaps all become natural moments for risk to surface and influence outcomes. Risk moves in time with the business, strategic and operational, top-down and bottom-up.
Recorded over a live video link, the conversation also explores how this mindset was received by leadership, what it took to set expectations that risk should shape daily decisions, and why aligning risk to the organization’s cadence is far more effective than standalone frameworks or annual exercises.
The episode offers a practical, experience-led perspective on what it means to keep risk on the bridge, not as a warning light, but as a steady navigational rhythm guiding the enterprise through uncertainty at warp speed.
Voici les 40 derniers épisodes sur 68. Les épisodes plus anciens se trouvent dans le flux du podcast.
Podcasts similaires
Plus de podcasts : Affaires
C’est votre podcast ?
Confirmez-le avec une entrée dans votre flux : vous recevez ici un code, vous l’ajoutez comme podcast:txt dans le canal de votre flux, et nous le vérifions. Votre podcast apparaît ensuite comme « vérifié » sur SoundNode.