GRC systems became glorified registers while regulatory expectations leapt ahead. Twelve modules, two flagships, one platform: the gap closes only when the builders understand the domain.
For twenty years the only honest branch was buy. The premise that made it true has expired, and the widest build-versus-buy gap in risk technology is still widening.
Read the essayThe body of the severity distribution is easy; the tail is the entire game. A walk through the modeling choices that actually move the answer: splicing, thresholds, and the copula default nobody questions.
Read the essayEvery AI conversation in risk starts with the wrong question: headcount. The second line's binding constraint has never been intelligence. It's attention, and attention is exactly what the new instruments return.
Read the essayThe regulators didn't add a workstream. They changed the unit of analysis: from risk categories to services, from losses to continuity, from registers to evidence. That's not an extension of operational risk. That's a successor.
Read the essayMost banks run scenario analysis as a once-a-year workshop. The narratives are static, the anchoring is unexamined, and the challenge is theatre. It doesn't have to work this way.
Read the essayThe tail event risk teams were supposed to stress test once a decade is now resetting every few hours. A practitioner note on what that means for stress testing, DFAST overlays, and boardroom posture.
Read the essay