Blog
COBIT in an AI World: Reinterpreting Governance for Autonomous Decision-Making
Here’s a question I keep hearing from IT governance professionals: “Do we need to throw out our governance frameworks now that AI is making decisions for us?” It’s a fair question, and one I suspect many of you are quietly wrestling with. My answer surprises people:...
I Taught ISACA’s First Advanced AI Risk (AAIR) Course in Vegas – Here Is What I Actually Learned
I just finished instructing the ISACA Advanced in AI Risk course in Las Vegas. This is the first time this course has ever been taught. I went in as the instructor. I came out a more informed advisor…and that order matters. There is a particular kind of learning that...
Strategy Without Governance is Just Expensive Hope
A CEO unveils a bold three-year digital transformation strategy at the annual board offsite. AI-enabled customer experience. Cloud-first infrastructure. A new data platform. An ambitious cyber posture. The board applauds. The press release writes itself. Eighteen...
Ten Lessons from Building My Own Digital Twin (And the Governance Questions That Keep Me Up at Night)
Building a digital twin of yourself is a little like rebuilding the engine on a car you still need to drive to work every day. You don't get to stop. Clients still call. Boards still meet. The twin gets built between flights, between sessions, between cups of coffee...
The Lone Wolf Consultant is Already Dead, Most Just Haven’t Figured it out Yet
Nature does not romanticize the lone wolf. That is Hollywood's job. In the wild, the lone wolf is the one limping behind the pack, eyes scanning the treeline, wondering why the herd suddenly got faster. Let me be transparent before I go any further, I AM a lone wolf...
TO STEER OR TO STRATEGIZE –DIFFERENCES BETWEEN IT STEERING COMMITTEES AND IT STRATEGY COMMITTEES
Yes ‘decision by committee’ is often negatively associated with non-essential, seemingly off-target, purposeless meetings. Agreed (sometimes) – meetings for the sake of meetings is unproductive and a waste of a valuable resource…TIME. But if you think about meetings...
DON’T WAIT FOR A RISK EVENT TO HAPPEN BEFORE YOU ADDRESS YOUR ENTERPRISE RISKS.
As I write this blog, I am experiencing a business disruption, and it is very frustrating. Should I blame my vendor, or is it my fault for not effectively managing my business risks? I outsource my email and my provider has been down for several days with no end in...
Digital Trust Isn’t a Fad; It’s a Requirement in Today’s High Velocity Environment
Just over a year ago, ISACA reached out to me asking for my thoughts on digital trust. Of course, I had a few ideas related to the subject, as it had come up in several board meetings I’d been in recently. As it turns out, this short discussion vaulted me into an...
USING MULTIPLE GUIDANCE SYSTEMS FOR THE GOVERNANCE OF ENTERPRISE IT
The most secured company in the world I’ve been known to tell a story about when my CEO rounded up the executive management team (I was the CIO at the time) and pounded us with the question: “Why are we going out of business as the most secured company in the world?”...