Articles
Tag: norman marks
-
Risk Practitioners Should Be Asking 'How Can We Help?'
We may have a business card that says we are internal auditors. But we are part of the management team and our first duty is to help the organization succeed.
Continue reading...
-
Should You Boast About Internal Audit Value?
Value is what people would be willing to pay for, not what you say it is. The same applies to internal audit.
Continue reading...
-
Risk, Consequences and the Domino Effect
Risk management is not about managing the possibility of harmful events or situations. It’s about managing the likelihood and extent of success.
Continue reading...
-
Which Comes First, Risk or Control?
Can you assess risk management without considering related internal controls? I don’t think so.
Continue reading...
-
Why Does Internal Audit Need to Be Agile?
We need to be not only agile in our audit planning, but also provide the assurance and insight that is needed at speed.
Continue reading...
-
Did Risk Management Fail?
Risk management is not like looking into a crystal ball and predicting the future with certainty.
Continue reading...
-
Do Risk Appetite Statements Add Value?
I am not persuaded that risk appetite statements should be the core around which risk management practices and programs are built.
Continue reading...
-
Are Your Business Decisions Failing Because They Are Biased?
The essential first step in combating biases is recognizing our own fallibility, our own biases.
Continue reading...
-
How to Assess the Effectiveness of Risk Management
Few organizations are seen as having effective risk management, so there is no exemplar against which to measure success.
Continue reading...
-
CEOs Aren't Idiots When it Comes to Risk Management
Management needs to take risks to survive and thrive, and that means balancing the potential harms that may occur against the potential rewards.
Continue reading...
-
If Risk Management Is the Answer, What Is the Question?
We need to stop coming up with new words and phrases when all we need to address is the effectiveness of management.
Continue reading...
-
Time (Again) for the IIA Standards to Be Corrected
IIA standards need to be updated so audit providing assurance on enterprise-level risks, not what matters to middle management alone.
Continue reading...
-
The Cost of a Cyber Breach
Deciding how much to invest in cybersecurity requires considering the likelihood of achieving objectives given all sources of risk, not just cyber.
Continue reading...
-
A Board That Would Fail Any Test of Its Governance Practices
Ten principles for what constitutes effective oversight of risk management by a board.
Continue reading...
