In today's episode we take a candid look at the efficacy of vendor risk management programs in the face of breaches. This time, we're reflecting on a conversation that pushed me out of my comfort zone and made me question the very fundamentals of vendor risk management. The startling realization that the well-trodden path of best practices might not hold all the answers spurred a much-needed debate on whether it's time to disrupt the status quo and embrace a more proactive stance in managing vendor risks.

We're challenging conventional wisdom, by evaluating the October 2023 breach of Okta despite the collective efforts of nearly 20,000 customers' vendor risk management programs. The episode takes you through a journey of introspection and industry critique, examining how traditional defensive strategies might not be enough and why a shift in perspective is crucial. We don't just outline the problems; we also explore what it means to safeguard against the inevitable issues and the importance of leading with the taboo in conversations that could redefine industry standards.

For show notes, please visit The GRC Podcast website.

Sign up for our Bi-Weekly Newsletter

Ever found yourself in a tug-of-war between hard numbers and gut instinct? Brace yourself for a candid journey into the world of data, as we uncover the truth behind the numbers that drive our decisions. This episode is not just another number crunching monologue; it's a story-rich exploration of how metrics can mislead and the power of anecdotal evidence, as demonstrated in a memorable moment with Jeff Bezos and Lex Friedman.

With a dynamic blend of personal anecdotes and professional insights, we uncover the double-edged sword of metrics. Dissecting the manipulation of data to fabricate success and the unintended consequences of metric-driven incentives, it’s a reality check for any business professional. And for those grappling with measuring the success of a GRC program, get ready for a thought-provoking discussion that will leave you reevaluating your approach. No graphs or spreadsheets needed—just a healthy dose of skepticism and a reminder that sometimes, the stories behind the stats are the real gold.

For show notes, please visit The GRC Podcast website.

Sign up for our Bi-Weekly Newsletter

In this episode we unpack the often overlooked value of starting with manual routines in GRC and the strategic path to effective automation.

Key Takeaways:

1. The Value of Manual Work: Although manual work is often viewed with disdain, it holds significant value in understanding the nuances of GRC processes. Manual routines force a deeper engagement with the components of a process, leading to a more comprehensive understanding of what "better" truly looks like.
2. Understanding Before Automating: Jumping directly to automation solutions without a clear understanding of manual processes can lead to inefficiencies and a misalignment with organizational needs. A profound comprehension of manual components is crucial before deciding on the path to automation.
3. Incremental Automation as a Strategy: Transitioning from manual to automated processes doesn't have to be a leap. Incremental, lightweight automations, introduced step by step, can be more cost-effective and easier for teams to adapt to. This approach allows for continuous improvement and helps distinguish between mere inconveniences and actual pain points.
4. Case Study - The Evolution of Segment's Customer Trust Practices: We delve into Segment's strategic journey from entirely manual processes towards a comprehensive spectrum of automation, culminating in the implementation of a SaaS-based Customer Trust Center. Initially reliant on manual methods, Segment incrementally integrated various technologies and automated solutions into their workflow. This gradual evolution continued until reaching a pivotal moment where the decision to build in-house versus procuring a specialized tool was reassessed. Opting for a purpose-built solution marked a significant milestone, demonstrating the effectiveness of an iterative approach to automation that not only enhanced operational efficiency but also solidified the foundation for future scalability.
5. Practical Insights for GRC Professionals: The discussion provides practical insights for GRC professionals on balancing the desire for automation with the reality of manual processes. It emphasizes the importance of being intimately familiar with the processes before automating them and showcases the tangible benefits of incremental improvements.

For show notes, please visit The GRC Podcast website.

Sign up for our Bi-Weekly Newsletter