Practical perspectives on technology risk, IT audit, third-party risk, cybersecurity, and AI governance.https://www.nathalagbe.com/en-ushttps://www.nathalagbe.com/resources/closed-is-not-fixed/https://www.nathalagbe.com/resources/closed-is-not-fixed/An issue closed on management assertion is not a risk reduced. How to agree closure criteria up front, test that the fix works over time, and report aging and repeat findings honestly.Fri, 30 Oct 2026 00:00:00 GMTArticleIT controlsRisk reportinghttps://www.nathalagbe.com/resources/evidence-brief-01-assurance-language-is-not-evidence/https://www.nathalagbe.com/resources/evidence-brief-01-assurance-language-is-not-evidence/Words like reviewed, monitored, and in place sound like control. They are claims. Here is how to tell a claim from proof, and how to ask for the difference.Fri, 30 Oct 2026 00:00:00 GMTNewsletterIT controlsRisk reportinghttps://www.nathalagbe.com/resources/shadow-ai-is-already-inside-your-organization/https://www.nathalagbe.com/resources/shadow-ai-is-already-inside-your-organization/Banning AI tools pushes use out of sight. Find what is already running, triage it by risk, and make the approved path easier than the workaround.Fri, 30 Oct 2026 00:00:00 GMTArticleAI governanceAI audithttps://www.nathalagbe.com/resources/six-ai-questions-every-board-should-ask/https://www.nathalagbe.com/resources/six-ai-questions-every-board-should-ask/Directors do not need technical depth to oversee AI. Six plain questions, with what a good answer sounds like and the red flags that should prompt a follow-up.Fri, 30 Oct 2026 00:00:00 GMTArticleAI governanceRisk reportinghttps://www.nathalagbe.com/resources/the-recovery-plan-nobody-has-tested/https://www.nathalagbe.com/resources/the-recovery-plan-nobody-has-tested/A recovery plan that has never been exercised is a hope, not a control. What it takes to prove you can restore after ransomware, from immutable backups and full restores to the dependencies nobody planned for.Fri, 30 Oct 2026 00:00:00 GMTArticleCybersecurity and cloudIT controlshttps://www.nathalagbe.com/resources/when-ai-acts-on-its-own/https://www.nathalagbe.com/resources/when-ai-acts-on-its-own/AI agents send, approve, change, and buy, not just suggest. That shifts the control model toward agent identity, action limits, traceable decisions, real human oversight, and a way to stop.Fri, 30 Oct 2026 00:00:00 GMTArticleAI governanceAI audithttps://www.nathalagbe.com/resources/why-access-reviews-pass-audit-and-still-fail/https://www.nathalagbe.com/resources/why-access-reviews-pass-audit-and-still-fail/A signed access certification proves a review happened, not that access is right. How to fix the population, the reviewer, and the revocation evidence so the review actually reduces risk.Fri, 30 Oct 2026 00:00:00 GMTArticleIT controlsCybersecurity and cloudhttps://www.nathalagbe.com/resources/who-owns-the-ai-decision/https://www.nathalagbe.com/resources/who-owns-the-ai-decision/Questions about approval, performance review and escalation across the AI lifecycle. Establish who owns the use case and who acts when conditions change.Thu, 01 Oct 2026 00:00:00 GMTArticleAI governanceAI audithttps://www.nathalagbe.com/resources/does-the-assessment-still-reflect-the-service/https://www.nathalagbe.com/resources/does-the-assessment-still-reflect-the-service/A practical perspective on vendor reassessment triggers, assurance scope and the control responsibilities an organization retains.Tue, 15 Sep 2026 00:00:00 GMTArticleThird-party riskhttps://www.nathalagbe.com/resources/what-decision-does-this-report-support/https://www.nathalagbe.com/resources/what-decision-does-this-report-support/Connect risk movement and control performance with accountable ownership and the action management needs to consider.Tue, 01 Sep 2026 00:00:00 GMTArticleRisk reportingIT controls