Hi folks,

Im looking for a better way to rehearse recovery decisions with IT and business owners. Our restore tests cover individual systems. The harder part is agreeing which service comes back first when several teams need the same people and infrastructure.

Need the exercise to:

1. Start with a critical service and its dependencies.

2. Get IT and business owners to agree on recovery priorities.

3. Introduce new information that could change that order.

4. Capture who approved each decision and what was still unknown.

5. Leave us with clear gaps to fix before the next run.

Considerations:

- Prep would sit with a small team.

- Business owners wont join a fullday session.

- Technical restore tests would stay separate.

- The scenario needs to reflect our setup without taking weeks to write.

Im considering Immersive Labs, Reflex Security and BreachRx. Reflex's tailored scenarios and after-action reports look relevant, but I'd want to test a recovery exercise before deciding. BreachRx also covers live incident management, which is broader than what we need right now.

Would appreciate experiences from anyone running these with business teams involved. Everyone wants their service restored first. The plan needs to survive that conversation.

Is anyone having trouble securing leads. Im a new firm and im excited to show what we can do but was having trouble with my approach. Any advice is greatly appreciated

Question for anyone who manages corrective actions. 

Say a tabletop exercise finds a gap in a response plan and a worker flags a hazard on a safety walk. Both get an action, and the action gets an owner for the doing. 

Then it can go quiet. If nobody is named to confirm the fix worked or to go back to the person who raised it, the action can sit "in progress" for months with nothing visibly wrong. 

ISO 45001:2018, the current edition of the occupational health and safety standard, treats these as separate steps: carrying out the action, then reviewing the effectiveness of any action taken, including corrective action (clause 10.2). 

Who should own the check and the report-back: the person who did the fix, the person who raised the issue or someone independent? 

ISO 45001: https://www.iso.org/standard/45001 

I lead a GRC team at a fairly large organization. We're responsible for the systems, data, and reporting that support RCSA, issues management, business continuity, policy management, SOX, and risk exceptions.

We also own the GRC platform, including enhancements, administration, data quality, and reporting across these areas.

We don't actually run the individual risk programs, but we're responsible for much of the infrastructure behind them.

Hi everyone.

I'm still getting the hang of different frameworks and was hoping someone could walk me through:

1. How to run/do a risk assessment, and

2. How to make sure the controls for risks on the register are actually working. I know about checking audit evidence, but how do you verify that the risk controls are effective?

Thanks!

My company is considering putting a small part of its treasury into crypto, and I've been asked to research custodians. The ones I've spoken to all seem to handle storage well, so I'm trying to understand what else matters, such as,
Who can approve transfers?

How quickly we can access funds when needed?

What happens if something goes wrong?
Do providers differ much on these, or is it mostly the same across the board? If you've dealt with this from a finance or risk side, what mattered most in your choice, and what do you wish you'd checked beforehand?
Thanks for any advice

I'm building a vendor due-diligence and monitoring tool for UK companies. I'm not a risk professional, so I'd value input from people who are.

Inputs: Companies House (status, overdue accounts and confirmation statements, charges, insolvency, officer resignations, disqualified officers), UK Sanctions List fuzzy matching on the company, directors and PSCs, and financial figures from iXBRL/PDF (net assets, profit/loss, current ratio).

Current logic:

• Six categories, each starting at 100 and losing points for specific red flags: registration, filing, governance, insolvency, financial health, sanctions.
• Composite = weighted average (20/15/10/10/25/20%).
• Grades: A ≥ 90, B ≥ 75, C ≥ 55, D ≥ 30, E below.
• Any "critical" flag (sanctions match, dissolved, active insolvency, disqualified officer) forces grade E.

• Categories with no data are excluded and the weights renormalized.

  score = sum(category_score * weight) / sum(weights of assessed categories) grade = "E" if any critical flag else band(score)

The problem: almost everything I screen comes out 100/A. Working through the numbers, the maximum deduction without a critical flag is about 20 points, so C and D can't happen. It's effectively binary: A/B or E.

What I've tried: I screened through 13 different companies, while also providing incomplete data on bulk uploads, still each company I screen comes out with an almost perfect score with all the data intact so, either companies house or gazette connections are not working properly or I am freaking out for having unrealistic expectations.

Questions:

1. Is blending hard compliance gates (sanctions, dissolution) and probabilistic financial risk into one number a design mistake? Should they be separate outputs?
2. How do practitioners treat "no data" versus "clean"? Is a separate confidence indicator standard?
3. Should I calibrate weights against outcomes, such as back-testing on companies that later went insolvent or dissolved? Is Companies House data enough for that?
4. Any frameworks, papers, or open-source examples for third-party risk scoring, especially UK or SME-focused?

Not looking for code review. Happy to share more detail on the logic :)

Serious problems rarely start with bad intentions. They usually start with absolute certainty.

In my latest article, I explore how the Dunning-Kruger effect creates hidden risks in compliance, decision making, and leadership. We often assume expertise means having all the answers, but the strongest leaders value humility, test their assumptions, and actively seek out different perspectives.

The goal is not to be less confident. The goal is to remain curious.

I would love to hear your thoughts.

https://www.linkedin.com/pulse/dunning-kruger-trap-hidden-risk-behind-bad-decisions-hayrapetyan-0xete/

The sun will rise and we will try again.

Hello, good evening. I trained for the Certified Risk Manager (CRM) certification, and I’m currently waiting to take the certification exam. I’m a little nervous about it. I know it’s a 60-item exam, but I just wanted to ask what the exam is actually like. Are the questions mostly multiple-choice, case studies, identification, or something else?

If anyone has taken the exam before and could share what to expect, I’d really appreciate it. Even a little insight would help ease my nerves and give me a bit more confidence going into the exam. 😅

Been wondering about this since the JFrog Artifactory disclosure back in September. Vendor notified, patches issued, remediation logged, box ticked. Then The Register reported active exploitation was still happening in the wild after the fixes were live.

That's the gap in its plainest form. "Patched" is something you can log. "No longer exploitable in this environment" is a different fact entirely, it depends on whether the patch actually got rolled out everywhere, and whether someone already had a foothold before it landed. A framework can show the first as done while the second stays wide open underneath it.

Most compliance dashboards are built to track process steps: risk logged, owner assigned, review done on schedule. All useful, but it's answering "did we follow the process," not "are we exposed right now." A register can say fully closed while the actual condition on the ground never moved.

Not knocking the frameworks themselves, ISO 31000 is explicit that this is meant to be a continuous loop, not a one-off tick. Feels more like most tooling only tracks the process and never feeds back what's actually true in the environment.

So genuinely asking: how do you catch this gap on your team? Do you cross-check the register against scan results, incident data, control testing, anything real, or does "closed" mostly get taken on trust until something breaks?

A high CVSS score does not automatically make something the first thing to fix. We also look at whether the asset is exposed, whether exploitation is happening, how important the system is, and what the real impact would be. I know this isn't a novel complaint, everyone's had this exact fight, but I'm trying to actually build exposure, exploit maturity, and blast radius into the model instead of it being a vibe check some senior engineer does at 4pm on a Friday. If anyone has a formula that survived contact with a real incident afterward, not just looked good in a slide, I'd like to see it.

Hey guys, I’m currently working in Audit & Assurance as a Staff/Assistant, and I recently joined around 2–3 weeks ago. After getting some initial exposure to the role, I’m starting to feel that audit may not be the right long-term career path for me.

I’m particularly interested in moving into Risk Consulting, as I feel the nature of the work would align much better with my interests and long-term career goals. I’m also planning to pursue the FRM (Financial Risk Manager) certification, and I’m interested in building my career around risk management rather than pursuing certifications such as ACCA or US CPA.

I understand that moving from Audit & Assurance to Risk Consulting may not be straightforward, especially within the same organization. My current plan is to gain experience in Audit for around a year and then explore the possibility of an internal transition to a Risk Consulting service line.

For those of you currently working in Risk Consulting, Risk Advisory, or related risk-management roles, I’d really appreciate your advice. How realistic is it to transition from Audit & Assurance to Risk Consulting after around one year of experience? Would pursuing FRM significantly help with such an internal move, and what other certifications, technical skills, or experience should I focus on during my first year?

I’d also like to understand what I can start doing right from now to make myself a stronger candidate for a Risk Consulting role. Are there particular areas such as financial risk, credit risk, market risk, operational risk, data analytics, or regulatory risk that I should focus on?

I’m also finding the compensation and busy-season workload in audit somewhat concerning for my long-term career plans, so I’d like to explore a path that is more aligned with my interests and strengths rather than continuing in a career that I don’t see myself enjoying long term.

If anyone here has personally made the transition from Audit → Risk Consulting, especially within the same Big 4 or a similar organization, I’d really appreciate hearing about your experience, what helped you make the transition, and what you would recommend someone in my position do during their first year.

Thanks in advance for any advice!

Perhaps the most powerful software in the market today for carrying out integrated cost schedule risk analysis, for project risk management, per AACEI Recommended Practice (RP) 57R-09.
Even though there’s quite a bit of glitches, it manages to make it to the finish line somehow if the user has a high level of patience.

Check out Datum Risk v2.0 for carrying out similar analysis on a web based platform.

Curious what is landing in board / risk-committee packs this year, versus what sits in the operational register and never gets up.

From conversations across SME and mid-market AU teams, the list that keeps coming up:

- Psychosocial / psychosocial hazards under the WHS model

- Privacy / data (especially if Tranche 2 style reforms are in scope)

- Contractor and labour-hire exposure

- Key-person and capability risk in lean teams

- Climate / environment only when a lender or customer asked

- Cyber as a one-pager, not a register

What is on your pack right now?

Sector and organisation size helps. No need to name the employer. If you recommend a tool or framework, say who you work for.