Practical thinking on IT audit, AI governance, and GRC, written for the people who have to act on it.
Technology risk writing is often long, abstract, and hard to use. Ours is short and specific. Every piece answers three questions:
We keep it brief where we can. We name the stanÂdards. We show the work beÂhind our conÂcluÂsions.
Short, opinionated pieces on live issues in IT audit, AI governance, and GRC.
Step-by-step guidance on building or testing a control, program, or process.
Working tools you can adapt and use the same day.
Plain-language summaries of standards like NIST AI RMF and ISO/IEC 42001, written for control owners.
One-page summaries of technology risk topics for directors and executives.
Questions about approval, performance review, and escalation across the AI lifecycle. Establish who owns the use case and who acts when conditions change.
Read the Article (opens nathalagbe.com in a new tab)Written by Dr. Nath Alagbe, our principal advisor, and published at nathalagbe.com.
Showing all 12 articles.
Practitioner checklists and a playbook by Dr. Nath Alagbe, free to download. Each audit checklist lists the risk, control objective, test steps, evidence, and framework references for every control area.
One practical idea on technology risk, delivered monthly. Short enough to read between meetings.
Is there a risk, standard, or control question you'd like us to cover? Tell us. The best questions often become our next article.
Editorial note: Our inÂsights are for genÂerÂal inÂforÂmaÂtion and edÂuÂcaÂtion. They aren't legal, acÂcountÂing, or tax adÂvice, and readÂing them doesn't creÂate an adÂviÂsoÂry reÂlaÂtionÂship.