Browse articles and The Evidence Brief newsletter covering IT controls, cybersecurity, third-party risk, and AI governance.
Each piece is written for practitioners and the leaders they report to: what to look for, why it matters, and what to do next.
Professional perspectives on the decisions behind technology oversight.
Explore topics such as control effectiveness, vendor changes, AI accountability, access governance, and management reporting. The focus is practical: how to recognize a gap, assess its significance, and explain what needs attention.
9 items
Read articlesA short newsletter on technology risk, audit, and AI governance.
Each issue takes one idea leaders can use this week: what I am seeing, why it matters, three actions to take, and one question to bring to your next meeting.
1 item
Read the newsletterArticle
An issue closed on management assertion is not a risk reduced. How to agree closure criteria up front, test that the fix works over time, and report aging and repeat findings honestly.
The Evidence Brief · Issue 1
Words like reviewed, monitored, and in place sound like control. They are claims. Here is how to tell a claim from proof, and how to ask for the difference.
Article
Banning AI tools pushes use out of sight. Find what is already running, triage it by risk, and make the approved path easier than the workaround.
Article
Directors do not need technical depth to oversee AI. Six plain questions, with what a good answer sounds like and the red flags that should prompt a follow-up.
Article
A recovery plan that has never been exercised is a hope, not a control. What it takes to prove you can restore after ransomware, from immutable backups and full restores to the dependencies nobody planned for.
Article
AI agents send, approve, change, and buy, not just suggest. That shifts the control model toward agent identity, action limits, traceable decisions, real human oversight, and a way to stop.
Article
A signed access certification proves a review happened, not that access is right. How to fix the population, the reviewer, and the revocation evidence so the review actually reduces risk.
Article
Questions about approval, performance review and escalation across the AI lifecycle. Establish who owns the use case and who acts when conditions change.
Article
A practical perspective on vendor reassessment triggers, assurance scope and the control responsibilities an organization retains.
Article
Connect risk movement and control performance with accountable ownership and the action management needs to consider.
No resources published in this category yet.
For a question about a checklist, guide, or publication, please get in touch.
Ask about this resourcePublic guidance from NIST provides further reading on AI risk management, cybersecurity governance and technology supply-chain risk. These materials are external references. They complement the personal resources published here.