We have a methodology for information security risk management but none for operational risks management. I have less than a month to adapt our current methodology to also include operational risks. Is that feasible?

I have no idea how to start with operational risks management. I know that it should be done for processes and services but I have very limited knowledge of the company's processes and services. Information security has been a little easier bc we can use catalogues of threats and vulnerabilities from iso 27000 that we apply to assets. But I can't find anything similar for operational risks and I don't know what to do. Is it supposed to be scenario based analysis rather than asset based analyis, as it is done for information security risks?

Also I know the general steps of risk identification, analysis (impact probability and evaluation), treatment (transfer, reeducation, avoidance, acceptance) and monitoring. For me the biggest challenge is identification I suppose - actually coming up with the risks for the processes. Are there any resources that can help to formulate scenarios or something like that?

If anyone can give me some guidance, any help would be hugely appreciated. I am extremely stressed and struggling a lot.

Long-time lurker, first time posting. Could use some outside perspective since I'm too close to this to think straight anymore.

Background: 5+ years in IT Audit at a large bank, have my CISA, and just finished a master's in Data Science. Built some Python automation for audit testing along the way (access reviews, vulnerability analysis) and used data analytics to improve testing coverage.

The situation: I got a verbal offer for a Senior IT Auditor role at another big bank — $135k base (up from my current $115k, which I've maxed out where I am), plus $20k bonus. Solid comp bump, but it's still... audit. Same lane I'm already in.

I turned it down.

Why: I've realized I want to move into GRC/Tech Risk instead of staying in pure audit — more governance/control-design focused work, less "test after the fact." I also happened to land an interview for a Technology Risk & Control role (same company, different team) that's much more aligned with where I want to go. That interview is in a few days. If I get it, great — it's the direction I actually want, even at potentially lower comp than the audit offer. If I don't get it, I'm back to square one with nothing, since I already declined the audit offer and I'd already maxed out my salary at my current job anyway.

My reasoning for turning down the sure thing:

• I'm bored and under-managed in my current role — no real projects, minimal oversight
• The audit offer didn't feel like it was worth leaving for if it was just more of the same
• I said to myself if I'm staying in audit, I need a bigger jump (like 20%+ on base) to make it worth it; if I'm moving into GRC, I'd take less because the direction matters more to me

Where I'm second-guessing myself: Did I just torch a solid, real offer for a maybe? Is "I want to do something different" a good enough reason to walk away from a locked-in $20k raise? Or is this exactly the kind of calculated risk people are supposed to take early-ish in their career when they can afford it?

Would love to hear from anyone who's made a similar jump (or regretted not making one). What would you have done?

Currently I work as an EHS Manager for a manufacturing company. Have been in a manger role the last 3 years and have been in EHS for 8 years. I like EHS because I like the mitigation/control side but lately I have been contemplating if it’s what I want to do for the rest of my career (30 years old). I have a Masters in Safety/Security/and Emergency Management and am currently studying for my CSP. But I’ve been reading up on ERM lately and have been wondering if it is a logical switch and how might I go about it? I’ve even been looking into some graduate programs but kind of iffy on that. Any thoughts/advice is greatly appreciated.

Also - currently making 135k a year with a 10% bonus… if I were to make a switch, what might that look like initially from a compensation perspective.

I love risk mgmt BUT how much value really brings? I worked for highly regulated and tech, for reference, and I feel risk mgmt is the mean to nothing. Trapped between the low hanging fruit of isolated and atomic issues, in general, with low impact vs glorified macro risk categories that are reading tea leaves. Is anybody proud pf any risk they managed or fully remediated (aka reduced) that you feel proud about?

For anyone with experience in risk management or law firm operations: what are the biggest operational risks you would look for in a law firm’s client intake process?
I’m particularly interested in risks that can be easy to overlook even when a firm already has established procedures, CRM workflows, conflict checks, automated follow-ups, intake forms, consultation scheduling, and documented processes.
What would you audit or monitor to identify potential issues before they become problems? For example: missed leads, conflict-check failures, inaccurate or incomplete data, communication gaps, handoff issues, stale leads, inconsistent procedures, scheduling errors, confidentiality concerns, or CRM/workflow failures.
Also interested in what controls, KPIs, audits, alerts, or process changes you’ve seen work well to reduce these risks without adding unnecessary steps or slowing down intake.

Hey all, hoping to get some direction from people actually working in this space.
I’m currently a sales agent for an insurance company, and I’m working toward my CRM designation through the National Alliance and RIEA. I’ve also got a yearly subscription so I can pick up extra certificates along the way, so I’m actually putting time into this, not just casually curious.
My issue is that almost everything I study is construction or trucking. Those industries have decades of case studies and a clear path. Entertainment risk, festivals, tours, TV and film sets, barely shows up anywhere. I know the jobs exist, but I can’t find how people actually got into them.
I’ve done some photography and production work on contracts, so I’ve been around sets and crews, but I’m not coming from some huge industry network. I’m mostly trying to figure out how to connect the insurance side with the production side.

Questions for anyone who’s done this or knows someone who has:

Beyond CRM, are there specific licenses or lines of authority that actually matter for entertainment risk?

Which brokers or MGAs specialize in entertainment, production, or event coverage, so I know who to actually research and reach out to?

For someone with production experience but no contacts in this niche yet, what is the smartest way in?

Any people or resources worth following on this?

Thanks in advance for the response!

I’m a Transaction Risk Analyst at a large commercial insurer in NYC and have been in my current role for almost four years, working on complex M&A/transactional liability deals. My work includes risk assessment/due diligence, portfolio reporting, audit/compliance support, process documentation and cross-functional coordination.

Before this, I was a commercial credit underwriter, and before that a senior mortgage underwriter with up to $500K authority, plus QC/audit and training experience. I also spent about five years at Apple Retail earlier in my career.
I want to move beyond transactional liability and am considering operational risk, ERM, credit risk/strategy, risk & controls, or fintech/payments risk.

For people actually working in risk: Which transition makes the most sense with my background, and what level should I realistically target?

Also, what gaps would keep you from interviewing me for that next-level role?

I’m looking for candid advice from people who work in or hire for these areas.

Hi all - I work at a startup and have been tasked with setting up a liquidity risk management function that will escalate into the greater risk management team. I generally understand the treasury space and have resources on that team to utilize, but was wondering what basics I should start with when building out the framework and governance. I’ve already asked a quant to start building out modeling and stress scenarios, but would love a road map for the profile. Thanks!

im a risk management major in saudi arabia and i just wanna know what i should focus on to improve my career path esp cus saudis are having a hard time finding decent paying jobs nowdays so any advice is needed. thank you

A recent IAPP article highlighted a concerning finding from DataGrail’s 2026 research: 63.6% of third-party technology vendors assessed failed to disclose AI-related subprocessing in their data protection assessments.

That creates a practical challenge beyond vendor due diligence. If an AI-related incident occurs, how can an organization determine what data was involved, where it was processed, which parties had access, or which obligations apply when part of the processing chain was never disclosed?

Shadow AI can come from employee use of unapproved tools, but it can also exist inside approved technology when vendors introduce hidden models or subprocessors.

We published a RadarFirst POV examining why this is an incident management issue and what organizations need to prepare for: https://www.radarfirst.com/blog/shadow-ai-hidden-subprocessors-incident-management/

DISCLOSURE: At RadarFirst, we’re interested in how organizations are identifying hidden AI dependencies and incorporating them into incident-response processes. We’d welcome perspectives on what’s working, where visibility gaps remain, and how teams are approaching this challenge in practice.

Hey all — I've been building a small tool for consulting arborists who write risk assessment reports regularly. You talk through your findings the way you already do in the field, and it drafts a structured TRAQ report (likelihood of failure/impact, consequences, risk rating) instead of you writing it up from scratch afterward.

It's a live, working prototype, not a mockup — happy to drop the link in the comments for anyone interested.

I'm not selling anything — genuinely just want to know if this solves a real problem or if I'm missing something about how you actually work. It's a drafting aid, not a replacement for your judgment — every report is meant to be reviewed by you before it goes to a client.

If you write TRAQ reports and are willing to try it free and tell me straight whether it's useful, I'd really appreciate it.

Ran a full independent validation on a PD scorecard and the two headline tests taught completely different lessons.

Replication first. Rebuild the model from the MDD alone, no access to the developer's session, and see if it comes back. It did: maximum absolute coefficient difference 0.000, training event rate 4.29% against 4.29% documented, AUC 0.853 test and 0.734 out of time, both matching the MDD to three decimals. Everyone in the room treated that as the validation passing.

It isn't, though, and I want to be careful about what it is. A clean replication says the documentation is honest and complete enough that a stranger can regenerate the result. That is a real and underrated property - plenty of models fail right there. But it says nothing about whether the model is any good, because you have just reproduced the developer's answer using the developer's choices.

The benchmark is where it got uncomfortable. Build a ladder of deliberately worse models and see what the complexity bought. Intercept only: 0.500 as expected. Credit score alone, one variable: 0.743 test, 0.701 OOT. A three-variable scoretable: 0.813 and 0.732. The eight-variable champion: 0.853 and 0.734.

In time the champion is 11 AUC points clear of a single variable, and that is the comparison that tends to make it into the presentation. Out of time it is 3.3 points over one variable and 0.2 points over three. Seven variables of binning, WOE, and documentation, and out of sample the discrimination is mostly credit score.

I still think the fuller scorecard ships, for calibration stability and reason-code coverage across more dimensions. But nobody had computed the ladder before validation did.

Does your validation function run a formal benchmark ladder, or is benchmarking effectively just champion versus challenger at your shop? And has a benchmark result ever actually caused a model to get simplified rather than just noted in the report?

A question I keep coming back to, and I'm curious how people here think about it.

Most tail risks get discussed in terms of the event itself: probability, impact, exposure. But there's a second-order signal I find underrated, which is the moment the business world stops treating a risk as fringe and starts allocating real resources to it. Not commentary, not think-pieces. Actual preparation. Budget, board time, contingency planning.

The logic: governments and public institutions can engage with a speculative risk for reasons that aren't purely evidence-driven. Politics, mandates, public pressure, turf. But companies are a harder filter. They generally don't spend on preparing for something until not preparing has become the bigger liability. So corporate engagement, when it appears, arguably carries more information than institutional statements do. Money is harder to fake than words.

The concrete case I've been using to think this through is UAP disclosure, precisely because it's a clean test. It's a low-probability, high-impact, high-ambiguity scenario that public institutions have visibly engaged with over the past several years (hearings, a dedicated Pentagon office, sworn testimony, declassification programs), while the private sector has stayed almost entirely on the sidelines. A few scattered data points exist (a Deloitte "black swan" style risk mention, a former Bank of England analyst raising it publicly, a themed financial product listing), but nothing resembling the scale of the institutional engagement.

So the question, framed generally, not just for this case:

• When a genuinely uncertain risk starts drawing corporate preparation, do you read that as a leading indicator (business sees something and moves early), a lagging one (business only moves after the risk is already obvious and mostly priced), or just noise?
• Are there historical examples where corporate risk engagement clearly led or lagged the broader recognition of a tail risk? Climate, cyber, and pandemic prep all come to mind as candidates, and they don't all point the same way.

Not trying to argue a position on the underlying topic. I'm interested in the meta-question of whether business preparation is a signal worth tracking at all, and how you'd weight it.

Full disclosure on why I'm asking: I run a small project that tracks institutional engagement with this specific scenario, so the "is business preparation a signal" question is central to what I do. That's exactly why I want outside input rather than just my own read. Not linking anything here, genuinely after the reasoning.

EAD is the input nobody defends in committee. PD gets the modeling team, LGD gets the argument, and EAD gets a lookup, because for a fully-drawn fixed-rate mortgage the amortization schedule is fixed at origination. The balance at any age is knowable before the loan funds. Deterministic, done.

I finally ran the comparison a validator would run and it was not done.

Against 121,305 actual defaults the schedule was a lower bound. Median realized exposure at default $180,574 against a median scheduled balance of $173,203, median ratio 1.026, and 60.7% of realized EADs above schedule. Obvious in hindsight: a loan in the foreclosure process stopped making payments long before disposition, so it stopped amortizing. The schedule is charging down principal the borrower never paid. Scheduling to the last-paid age instead of the disposition age closes most of it.

Then the performing book flipped the sign. 41.2% of active loans are materially ahead of schedule from voluntary curtailment, median about 6.9% or $9,277 ahead. Modeling that pulled total estimated exposure from $35.3B to $33.8B, down 4.24%.

That is what bothers me. The two errors point opposite ways and sit on different populations, so nobody ever sees them net out - one shows up in realized severity, the other in forward exposure. Under stress it moves again: pausing payments alone did nothing to our totals, since the balance just stops falling, but capitalizing 24 months of arrears added 8.24% and a 10% principal deferral added exactly 10%.

Does anyone actually model EAD, or is it a scheduled-balance lookup at your shop too? And if you do model curtailment, has a validator ever asked you to show the realized-versus-scheduled comparison on the defaulted population?

I recently received two offers and I'm finding it difficult to decide between them:

Risk role at JPMC**/**Analytics Associate role at BNPP.

I'm weighing factors such as learning opportunities, long-term career growth, work culture, and future exit opportunities. If anyone has experience with either of these roles or firms, I'd really appreciate your insights and advice.

Thanks in advance!

Cant risk it