Practical resources for technology risk, AI governance, and assurance.

Browse ar­ti­cles and The Ev­i­dence Brief newslet­ter cov­er­ing IT con­trols, cy­ber­se­cu­ri­ty, third-party risk, and AI gov­er­nance.

Each piece is writ­ten for prac­ti­tion­ers and the lead­ers they re­port to: what to look for, why it mat­ters, and what to do next.

  • Articles

    Pro­fes­sion­al per­spec­tives on the de­ci­sions be­hind tech­nol­o­gy over­sight.

    Ex­plore top­ics such as con­trol ef­fec­tive­ness, ven­dor changes, AI ac­count­abil­i­ty, ac­cess gov­er­nance, and man­age­ment re­port­ing. The focus is prac­ti­cal: how to rec­og­nize a gap, as­sess its sig­nif­i­cance, and ex­plain what needs at­ten­tion.

    9 items

    Read articles

  • The Evidence Brief

    A short newslet­ter on tech­nol­o­gy risk, audit, and AI gov­er­nance.

    Each issue takes one idea lead­ers can use this week: what I am see­ing, why it mat­ters, three ac­tions to take, and one ques­tion to bring to your next meet­ing.

    3 items

    Read the newsletter

  • Audit checklists

    Struc­tured prompts for plan­ning re­views, eval­u­at­ing con­trols, and iden­ti­fy­ing rel­e­vant ev­i­dence.

    Use the pub­lished check­lists to or­ga­nize ques­tions around con­trol ob­jec­tives, risk ex­po­sure, test pro­ce­dures, and sup­port­ing records. Adapt the scope to the en­vi­ron­ment and the pur­pose of the re­view.

    1 item

    Browse audit checklists

Library

  • The Ev­i­dence Brief · Issue 3

    Every risk acceptance needs an expiry date

    A risk ac­cep­tance is a de­ci­sion made under spe­cif­ic con­di­tions. With­out an ex­piry date, it qui­et­ly be­comes per­ma­nent. How to keep ac­cept­ed risks vis­i­ble, owned, and cur­rent.

    • Risk reporting
    • IT controls

  • Check­listDown­load

    Cloud Audit Guide with Checklist

    A prac­ti­tion­er check­list and audit guide cov­er­ing 15 cloud se­cu­ri­ty do­mains. Each con­trol area lists the risk, con­trol ob­jec­tive, audit test steps, ev­i­dence re­quired, and frame­work ref­er­ences.

    • Cybersecurity and cloud
    • IT controls

  • The Ev­i­dence Brief · Issue 2

    The AI inventory you think you have

    Most AI in­ven­to­ries cap­ture what some­one sub­mit­ted, not what is ac­tu­al­ly in use. A prac­ti­cal look at where in­ven­to­ries go stale and how to test whether yours is com­plete.

    • AI governance

  • The Ev­i­dence Brief · Issue 1

    Assurance language is not evidence

    Words like re­viewed, mon­i­tored, and in place sound like con­trol. They are claims. Here is how to tell a claim from proof, and how to ask for the dif­fer­ence.

    • IT controls
    • Risk reporting

  • Ar­ti­cle

    Six AI questions every board should ask management

    Di­rec­tors do not need tech­ni­cal depth to over­see AI. Six plain ques­tions, with what a good an­swer sounds like and the red flags that should prompt a fol­low-up.

    • AI governance
    • Risk reporting

  • Ar­ti­cle

    The recovery plan nobody has tested: ransomware resilience as a control

    A re­cov­ery plan that has never been ex­er­cised is a hope, not a con­trol. What it takes to prove you can re­store after ran­somware, from im­mutable back­ups and full re­stores to the de­pen­den­cies no­body planned for.

    • Cybersecurity and cloud
    • IT controls

  • Ar­ti­cle

    Why access reviews pass the audit and still fail the business

    A signed ac­cess cer­ti­fi­ca­tion proves a re­view hap­pened, not that ac­cess is right. How to fix the pop­u­la­tion, the re­view­er, and the re­vo­ca­tion ev­i­dence so the re­view ac­tu­al­ly re­duces risk.

    • IT controls
    • Cybersecurity and cloud

  • Ar­ti­cle

    Who owns the AI decision?

    Ques­tions about ap­proval, per­for­mance re­view, and es­ca­la­tion across the AI life­cy­cle. Es­tab­lish who owns the use case and who acts when con­di­tions change.

    • AI governance
    • AI audit

  • Ar­ti­cle

    Does the assessment still reflect the service?

    A prac­ti­cal per­spec­tive on ven­dor re­assess­ment trig­gers, as­sur­ance scope, and the con­trol re­spon­si­bil­i­ties an or­ga­ni­za­tion re­tains.

    • Third-party risk

  • Ar­ti­cle

    What decision does this report support?

    Con­nect risk move­ment and con­trol per­for­mance with ac­count­able own­er­ship and the ac­tion man­age­ment needs to con­sid­er.

    • Risk reporting
    • IT controls

Selected external reading

Pub­lic guid­ance from NIST pro­vides fur­ther read­ing on AI risk man­age­ment, cy­ber­se­cu­ri­ty gov­er­nance, and tech­nol­o­gy sup­ply-chain risk. These ma­te­ri­als are ex­ter­nal ref­er­ences. They com­ple­ment the per­son­al re­sources pub­lished here.