Norman Marks

The guidelines make good points on how to manage risk but miss a key question: When should an organization <em>seek</em> risk?

According to studies by the Association of Certified Fraud Examiners, the typical company loses about 6% of its annual revenue to fraud.

One reason for the disconnect between senior executives and risk practitioners is that the latter speak in technobabble.

The concept that we must mitigate all risks is absurd. We cannot survive, let alone thrive, if we do not take risk.

Everyone takes risks at all levels of an organization. How can we make sure they take the right risks and in the right amount?

The variability in assessing risks raises a key question: How do you know that your decision-makers will take the desired level of risk?

Rather than setting strategies and only then considering risk, consideration of risk should be a critical element in the strategy process.

A new tool will help, but boards also need to stay skeptical and ask penetrating questions to test the quality of the external auditors.

Directors can use the questions when asking management about the organization’s understanding and management of cyber risk.

The first step on cyber security is to get our heads out of the sand and understand that we are all, collectively and individually, at risk.

A Forrester report is wrong to talk about a governance, risk management and compliance (GRC) technology market; there is no such thing.

Assessments of reputation risk should become part of the discussion when any risk is being considered, because almost all have an effect on reputation.

As we enter the gift-giving season, here are five books to consider as gifts for yourself, your team or a friend with a passion for risk management.