Risk is Our Business

Recorded live at Optro CRX 2026, this episode of Risk Is Our Business brings Richard Chambers back to the bridge with Captain Michael Rasmussen for a conversation about a turbulent decade, the changing nature of risk, and what lies ahead for internal audit and the broader GRC profession. They begin with what keeps Richard awake at night. The 2020s have given risk professionals plenty to worry about, and Richard reflects on the growing interconnectedness of risks that rarely respect organizational boundaries or fit neatly into traditional categories. It's a discussion about how much the world has changed, how quickly problems can compound, and what that means for the people responsible for helping organizations anticipate trouble. Michael and Richard also spend time discussing Richard's books, particularly his latest, and the lessons he hopes readers take from them. The conversation draws on his decades in the profession, including his time leading the Institute of Internal Auditors, and his perspective on where internal audit has made progress and where there is still work to be done. Then there's artificial intelligence. Richard sees considerable potential for AI to make audit and GRC professionals more effective, but there are pitfalls worth understanding before handing too much responsibility to the technology. Michael and Richard explore where AI can make the greatest difference, what professionals should be watching out for, and how its growing capabilities could change the way the profession works. They close by looking ahead to 2027 and further out to 2030. What might the profession look like by the end of the decade? Which parts of the work will change, and how should professionals prepare? Richard shares his expectations for the coming year and his thoughts on the role AI will play in shaping the next chapter of internal audit and GRC.

Recorded live at Mitratech Interact, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Joshua Haravay, Business & Cyber Resilience Architect at Smarsh, for a discussion about what it really means for an organization to be resilient when disruption strikes. The conversation begins by examining the difference between business continuity and resilience. While the two are closely related, they are not necessarily interchangeable. Michael and Joshua explore what distinguishes them, where they overlap, and how resilience extends beyond maintaining operations to encompass an organization's ability to respond and adapt when circumstances change. From there, they examine the relationship between resilience and risk management, discussing why the two disciplines depend on one another. Understanding uncertainty helps organizations prepare for disruption, while resilience capabilities influence how effectively those risks can be managed. They also explore the growing complexity of modern businesses, where dependencies and interdependencies between people, processes, technology, and third parties can turn an isolated problem into a much larger operational challenge. The discussion then turns to tabletop exercises and micro-simulations, and how organizations can use them to sharpen their awareness, test assumptions, and strengthen their ability to recognize and respond to emerging threats. Joshua shares his perspective on why meaningful preparation requires more than documenting procedures. It requires giving people opportunities to practice, learn, and improve before they find themselves making decisions under pressure. And, of course, Captain Michael poses a familiar question about what keeps Joshua awake at 1 a.m. when it comes to risk and resilience. The conversation explores the concerns that occupy resilience professionals when they consider the complexity of the organizations they are responsible for protecting and the possibility of disruptions they may not see coming.

Recorded live at Optro CRX 2026, this episode of Risk Is Our Business features Captain Michael Rasmussen in conversation with Jan Murry and Rachel Nelson of GE Aerospace, exploring how internal audit can keep pace with a business environment where change rarely waits for traditional assurance processes to catch up. The conversation begins with a familiar question about what keeps risk and GRC leaders awake at night. For Jan and Rachel, one of the greatest concerns is whether their organizations and teams are responding to change quickly enough. Drawing on their experiences at GE Aerospace, they discuss some of the biggest challenges they have encountered, the lessons learned along the way, and why breaking down organizational silos is essential to effective risk management. They also examine what bad risk management looks like and how organizations can avoid repeating familiar mistakes. A central part of the discussion focuses on GE Aerospace's internal audit technology transformation and how Jan and Rachel worked to align that effort with broader enterprise objectives. Rather than treating the implementation of new technology as an achievement in itself, they explain the importance of demonstrating measurable business value and ensuring that innovation improves how the function operates. The conversation then turns to artificial intelligence and the challenge of balancing rapid technological innovation with the governance and security requirements of a global aerospace company. Michael, Jan, and Rachel explore how organizations can embrace emerging capabilities while maintaining the oversight, discipline, and accountability needed to manage the risks that accompany them. They also discuss the human side of transformation, including the cultural shifts and change management strategies required to make new ways of working stick. From encouraging user adoption to establishing standardized processes and consistent execution, Jan and Rachel share how meaningful transformation depends as much on people and organizational alignment as it does on technology.

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Jannie Wentzel and Andrew Gunter, Partner and Principal GRC Consultants at Cential, for a candid conversation about where risk management and GRC go wrong, particularly inside American organizations, and what it takes to set a better course. Jannie and Andrew take the helm for much of the discussion, beginning with the bad. They explore the habits, structures, and assumptions that leave risk and compliance programs disconnected from the business, including approaches built around satisfying requirements rather than helping organizations understand uncertainty and make better decisions. The conversation turns to the state of risk management in the United States and some of the recurring weaknesses they encounter in practice. Rather than treating those problems as inevitable features of GRC, they examine what organizations can do differently and why effective risk management begins with understanding the business, its objectives, and the decisions people are actually trying to make. From there, the discussion moves naturally into what good risk management looks like. Jannie and Andrew draw on years spent working directly with organizations to discuss the importance of alignment, practical processes, clear ownership, and GRC programs designed around business value rather than bureaucracy. More than a prescribed tour through frameworks and methodologies, this episode is a practitioner-led conversation about the state of the profession and the course corrections that can turn GRC from an obligation into something the business genuinely wants on the bridge.

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Rookie Nagtalon, technology executive, strategist, and AI advocate, for a conversation about how governance, risk, and compliance are evolving in one of Asia's fastest-changing digital economies. The discussion begins with the realities keeping Philippine organizations awake at night. From increasingly complex regulatory requirements to the rapid adoption of artificial intelligence, Rookie explains how organizations are balancing innovation with governance while strengthening the people, processes, and technologies that underpin effective risk management. Michael and Rookie explore what makes the Philippine approach to risk and compliance distinctive, where organizations continue to mature, and why developing AI capabilities, improving workflows, and investing in the right skills have become strategic priorities. They also examine the remarkable diversity of the Asia-Pacific region, arguing that there is no single APAC model for GRC and discussing how the Philippines is helping shape regional thinking around digital transformation and modern governance. Artificial intelligence remains a central theme throughout the conversation. Rookie shares his perspective on AI governance, AI risk, and why successful AI initiatives depend less on sophisticated models than on trustworthy, well-governed data. The discussion also explores the current state of AI regulation in the Philippines and how organizations can prepare for a regulatory landscape that continues to evolve alongside the technology itself. The episode concludes by looking toward 2030, considering how governance, risk, and compliance may change over the coming years and what organizations can do today to build the capabilities they'll need for tomorrow. It's a thoughtful discussion about leadership, technology, and why the future of GRC will belong to organizations that combine innovation with disciplined governance.

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Ellen Holder, Managing Director and Sustainability & ESG Lead EMEA at Protiviti, for a conversation that asks a deceptively simple question. Is sustainability really about reporting, or is it something much bigger? Together they explore how the conversation has evolved from sustainability to ESG, and why many organizations are now shifting back again. Ellen explains that sustainability was never just about the environment. It has always encompassed environmental, social, and governance considerations, but without some of the political baggage the term ESG has accumulated in recent years. The discussion draws on an unexpected lesson from Ted Lasso, where the idea that "doing the right thing is never the wrong thing" becomes a useful way of thinking about sustainability. Rather than treating it as another compliance requirement, Ellen argues that sustainability should be understood as a long-term strategic capability that helps organizations create value not only for today, but for future generations. Michael and Ellen also examine the relationship between sustainability and enterprise risk, the role of double materiality assessments, and the practical challenges organizations face when trying to integrate sustainability into existing governance and risk management programs. They discuss where technology, and particularly AI, is beginning to make a meaningful contribution, and how approaches to sustainability differ between Germany, the rest of Europe, and other regions around the world. At its heart, this episode is about looking beyond quarterly reporting cycles and asking a more fundamental question. How do organizations build resilience and create lasting value by making decisions that remain the right ones tomorrow as well as today?

Recorded live at Corporate Risk Minds 2026 in Berlin, this episode of the Risk Is Our Business Podcast features returning guest Benjamin Lüders, Partner and Risk Consulting Service Leader for Europe West and Germany at EY, for a conversation on how enterprise risk management is being reimagined for an increasingly unpredictable world. Drawing on EY's recent research into risk transformation, Benjamin and Captain Michael Rasmussen explore why traditional models of risk management are reaching their limits. As organizations contend with accelerating change, geopolitical uncertainty, AI, and growing interconnectedness, risk functions must evolve from monitoring the business to helping shape its future. The discussion centers on what it means to operate at the speed of trust, where risk becomes an enabler of confident decision-making rather than a governance checkpoint. Benjamin shares how technology is supporting this transformation, not simply through automation, but by creating connected capabilities that improve visibility, coordination, and action across the enterprise. A significant part of the conversation focuses on agentic AI and how organizations should think about it within three complementary layers: systems of orchestration, systems of intelligence, and systems of action. Rather than viewing AI as another tool, they discuss its potential to reshape how organizations sense, interpret, and respond to uncertainty. They also explore EY's work recognizing organizations leading this transformation, highlighting the practical innovations and leadership approaches that are redefining modern risk management. Check out the links for the EY Risk Transformation papers . . . EY Risk Transformation Series for the show notes. Reimagining risk for an unpredictable world How risk can operate at the speed of trust How AI can build resilience for future risks

In this episode of Risk Is Our Business, Captain Michael Rasmussen sits down with leaders from Norway’s Institute of Internal Auditors for a conversation about how culture shapes governance, risk, compliance, and assurance. The discussion begins with Norwegian business culture and one of its defining characteristics: trust. They explore how trust influences decision-making, accountability, and assurance practices, and how that foundation differs from more rules-driven environments. The conversation also examines the maturity of risk management and assurance in Norway, where strong practices coexist with significant opportunities for growth as organizations confront increasingly complex and fast-moving risks. The group discusses the challenges facing assurance professionals today, including the accelerating pace of change, emerging risks, and the need for organizations to adapt without losing sight of business value. They compare Nordic and U.S. approaches to risk management, highlighting the more pragmatic, business-oriented perspective often found across Scandinavia. A particularly interesting part of the conversation focuses on the evolution of Norway’s IIA chapter itself. Unlike many national chapters, the Norwegian organization has expanded beyond a traditional audit focus to serve a broader community of GRC professionals. They share how that transformation occurred, what it has meant for members, and how they see the organization evolving toward 2030. The episode closes with practical advice for organizations seeking to strengthen assurance and risk management capabilities in an environment where trust remains essential, but trust alone is no longer enough.

Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Bruno Parnet, Manager of Risk Management at Audemars Piguet, for a conversation on the human side of risk management and what it takes to build a program that genuinely supports the business. Captain Michael Rasmussen begins by asking a familiar question to any listener—what keeps risk leaders awake at night? For Bruno, the answer lies not only in specific threats facing a company that manufactures some of the world's most prestigious timepieces, but also in the challenge of understanding risks well enough to act before they become problems. The discussion explores what bad risk management looks like, including approaches that are disconnected from the business or focused more on process than outcomes. In contrast, Bruno argues that good risk management starts with listening. Risk professionals must acknowledge that they do not have all the answers, engage stakeholders across the organization, and act as facilitators who help the business understand and navigate uncertainty. They also discuss whether Switzerland has its own approach to risk management and how culture influences the way organizations think about governance, decision-making, and accountability. From there, the conversation turns to the future, exploring how Bruno sees his risk management program evolving by 2030 and the role technology may play in supporting that journey. The episode closes with practical advice for organizations seeking to strengthen their risk capabilities, emphasizing that effective risk management is often less about imposing frameworks and more about building trust, creating dialogue, and helping people make better decisions.

Recorded live at Risk-!n Conference 2026, this episode of Risk Is Our Business features Aurore Chatard in a conversation about what it truly takes to build resilience in an increasingly complex and interconnected world. Captain Michael Rasmussen and Aurore begin by discussing what keeps resilience leaders awake at night and why many organizations still struggle to move beyond a compliance-driven view of continuity and resilience. They unpack what bad resilience looks like, including programs that exist primarily to satisfy regulatory requirements, before exploring the characteristics of organizations that are genuinely prepared to adapt, respond, and recover. A central theme of the discussion is orchestration. Michael and Aurore compare resilience to a symphony orchestra, where success depends not on individual performers but on how well people, processes, technologies, and leadership work together. Without coordination, even the most capable functions can fail when disruption strikes. The conversation also explores the growing influence of regulations such as NIST and DORA, examining whether they help organizations become more resilient or risk turning resilience into another compliance exercise. Along the way, Aurore shares lessons learned from years spent leading security, continuity, and crisis management programs, offering practical insights for professionals looking to strengthen resilience capabilities within their own organizations. They close by reflecting on Risk-!n Conference 2026 itself, discussing the growth of the event, the conversations shaping the future of the profession, and the increasing recognition that resilience is becoming a core business capability rather than a specialist discipline.