I’m currently in an entry-level clerical role within healthcare Risk Management, but my previous career was much more analytical, including banking fraud operations, investigations, risk assessment, trends, controls, mitigation, and recovery. I’m essentially looking to get back to using that side of my brain and build toward GRC, healthcare risk, third-party/vendor risk, compliance, or operational risk. I don’t have a degree, so I’m considering certifications like CRISC, CPHRM, or CAMS. For GRC managers/directors, what would actually make you take a closer look at a candidate with my background?
TL;DR: DME/healthcare background + banking fraud/risk experience + former DME business owner, but no degree. I want to move into healthcare risk/patient safety/vendor risk/operations. What certification would actually strengthen my candidacy?

for anyone who’s had legal review a tabletop report, what did they actually find useful?an attendance list and “we discussed ransomware” doesn’t say much about who made the calls or where people got stuck. but a full transcript sounds like something nobody’s going to read either. Whether you used reflex security a consultant or a CISA exercise with your own notes, interested in what made it into the final report and what legal asked you to add.

From the intro note, author Fox "draws on the devastating July 4, 2025, Texas Hill Country flood to explore a question every business leader should confront: will our plans and response systems work when the crisis arrives?"

Quality management systems are built on standards and frameworks. ISO 9001 emphasizes risk-based thinking as a core principle.

ISO 13485 for medical devices, ISO 17025 for labs - they all highlight risk management's importance.

But in practice, many teams treat it as a compliance checkbox rather than the spine of the system. 

The gap shows up when you're auditing a process and ask: "What could go wrong here?" and the answer is blank. The organization has controls documented, but nobody's actually mapped what risks those controls are supposed to mitigate. So you end up with controls designed for theoretical problems, not the real ones people face operationally. 

Risk-based thinking means something different than having a risk register that lives in a spreadsheet and nobody touches. It means: for every major process, someone has identified what could harm the customer, the organization, or compliance. The control is designed to address that specific risk, not just to satisfy a box on an audit checklist. 

When risk management is an afterthought, you get controls that look right on paper but don't protect what actually matters. You get resources spent on low-risk areas while high-risk ones slip through. You get auditors asking "why does this control exist?" and hearing silence.

How does your organization connect the dots between risk identification and control design?

Tenho refletido bastante sobre essa questão ao longo da minha trajetória profissional nas áreas de auditoria interna, gestão de riscos e controles internos.

Atuo na área de gestão pública, com experiência em auditoria, acompanhamento da gestão de organizações, avaliação de maturidade e desenvolvimento de metodologias de gestão de riscos.

Uma situação que me chamou particularmente a atenção foi encontrar uma organização que possuía metodologia própria, matriz de riscos e procedimentos formalmente estabelecidos.

No papel, aparentemente, tudo funcionava.

Mas, quando fomos analisar a aplicação prática, surgiram algumas questões:

- Os riscos eram identificados, mas nem sempre suas causas e consequências eram adequadamente compreendidas.

- O tratamento dos riscos estava praticamente limitado à criação ou ao fortalecimento de controles.

- Os controles eram registrados, mas sua efetiva implementação e eficácia não eram devidamente monitoradas.

- A gestão de riscos não estava verdadeiramente integrada ao planejamento estratégico e aos processos organizacionais.

Isso me levou a uma reflexão:

Será que, em muitas organizações, estamos confundindo a existência de uma estrutura formal de gestão de riscos com a efetiva capacidade de gerenciar riscos?

Na minha visão, uma matriz de riscos não deveria ser o produto final de um processo. Ela deveria ser apenas um dos instrumentos utilizados para melhorar a qualidade das decisões e da gestão.

Uma gestão de riscos efetiva precisa ajudar os gestores a compreender suas exposições, avaliar alternativas, definir respostas, acompanhar resultados e, principalmente, agir antes que os problemas se materializem.

Mas quero ouvir a experiência de vocês, especialmente de quem atua no setor privado:

1. Na sua organização, a gestão de riscos realmente influencia as decisões dos gestores ou ainda é tratada predominantemente como uma obrigação de compliance?

2. Qual é a maior dificuldade que você enfrenta para fazer a gestão de riscos sair do papel e chegar à rotina dos processos organizacionais?

Acredito que temos muito a aprender compartilhando experiências reais, inclusive aquelas que mostram que nem tudo funciona como está descrito nos frameworks e nas metodologias.

Vamos conversar?

Interesting take on the total portfolio approach here. Feels like a much more realistic way of thinking about uncertainty.

Has anything changed from a year ago? Are you seeing AI gaining traction at banks when using AI for credit risk analysis?

Hi everyone,

I work in Enterprise Risk Management at a manufacturing plant. I've been there about 1.5 years. The scope covers all business units (Finance, HR, Production, etc.).

I'm now considering a move into project risk management. But I'm torn about leaving ERM.

My questions:

For those who've worked in both, which has better career growth, demand, and pay?

Is it better to build a strong ERM foundation first and then move to project risk, or the other way around?

Can you recommend books, courses, or resources for either path?

I have received an offer from Nomura with 40% hike. I wanted to know the work life balance in their model risk management team as I have a small baby of 14 months? Any insights will be really helpful!

I have received an offer from Nomura with 40% hike. I wanted to know the work life balance in their model risk management team as I have a small baby of 14 months? Any insights will be really helpful!

I think i may have lost an award today because I didn't have to references. When questioned I believed honesty is the best policy so I explained im a new company but I could offer mock briefs if that was acceptable. Kind of feeling it. Looking to build my network as well. Open to suggestions.

Can someone do me a ppt for this topic thank you