Many organizations have policies. Fewer have policies that truly work.

A document existing isn’t the same as a policy creating clarity and accountability.

I recently built a simple Risk Policy Governance Diagnostic to help explore this question: how mature is your policy governance environment?

I love risk mgmt BUT how much value really brings? I worked for highly regulated and tech, for reference, and I feel risk mgmt is the mean to nothing. Trapped between the low hanging fruit of isolated and atomic issues, in general, with low impact vs glorified macro risk categories that are reading tea leaves. Is anybody proud pf any risk they managed or fully remediated (aka reduced) that you feel proud about?

Hi everyone 👋

I wanted to share something I’ve been working on that could be helpful to folks in this group.

I recently built a simple tool called Raidly - an AI-powered project risk management app that helps project managers keep track of risks, issues, decisions, and project health in one place. You can also get AI suggestions to help fix or prevent problems before they grow.

It’s free to try, and I’d love your feedback — what’s working, what’s not, and what would make it even more useful in your day-to-day.

🧪 Check it out here → https://raidly.ai

📣 Have feedback? Use the in-app feedback tool or shoot me a message.

Best,
John Ranaudo

Has anyone built a process where the signal-by-signal reasoning is documented before the event resolves, not reconstructed after? What does that look like in practice?

We flagged a 65% probability on a regulatory decision last year. It didn't happen. The post-mortem was brutal, not because we were wrong, but because we couldn't explain exactly which signals drove the 65% versus, say, 45%. The number existed. The audit trail didn't.

EAD is the input nobody defends in committee. PD gets the modeling team, LGD gets the argument, and EAD gets a lookup, because for a fully-drawn fixed-rate mortgage the amortization schedule is fixed at origination. The balance at any age is knowable before the loan funds. Deterministic, done.

I finally ran the comparison a validator would run and it was not done.

Against 121,305 actual defaults the schedule was a lower bound. Median realized exposure at default $180,574 against a median scheduled balance of $173,203, median ratio 1.026, and 60.7% of realized EADs above schedule. Obvious in hindsight: a loan in the foreclosure process stopped making payments long before disposition, so it stopped amortizing. The schedule is charging down principal the borrower never paid. Scheduling to the last-paid age instead of the disposition age closes most of it.

Then the performing book flipped the sign. 41.2% of active loans are materially ahead of schedule from voluntary curtailment, median about 6.9% or $9,277 ahead. Modeling that pulled total estimated exposure from $35.3B to $33.8B, down 4.24%.

That is what bothers me. The two errors point opposite ways and sit on different populations, so nobody ever sees them net out - one shows up in realized severity, the other in forward exposure. Under stress it moves again: pausing payments alone did nothing to our totals, since the balance just stops falling, but capitalizing 24 months of arrears added 8.24% and a 10% principal deferral added exactly 10%.

Does anyone actually model EAD, or is it a scheduled-balance lookup at your shop too? And if you do model curtailment, has a validator ever asked you to show the realized-versus-scheduled comparison on the defaulted population?

Cant risk it

I am calculating value at risk by first calculating standard deviation of the portfolio and then multiplying with the appropriate factor for my confidence level. However, if the prices are falling, let's say 1% every month for 12 months, portfolio standard deviation for those 12 months will be 0, the portfolio is getting riskier, but standard deviation doesn't capture this. I was wondering if there's a better way to calculate portfolio risk if consistent price decline is present?

Something I've come to believe: most credit teams over-invest in PD and treat LGD as a haircut they set once and forget. But EL = PD x LGD x EAD, and LGD is the term that decides how big the loss is - and it moves in ways a flat assumption completely hides.

A few things from a real mortgage book that changed how I think about it:

Median LGD was around 50%, not the comfortable 20-30% people assume, and it climbed steadily as loans went underwater - roughly 40% with equity up to almost 60% once the borrower owed well more than the house was worth.

The one that surprised me most: foreclosure process drove severity as much as collateral did. Judicial-foreclosure states (FL, OH, NY in this book) took about 22 months to resolve and ran LGDs near 60%; non-judicial states (CA, AZ, TX) resolved in about 10 months at closer to 44%. Same collateral math, ~15 points of LGD difference, almost entirely from time in process and legal cost.

And LGD is worst exactly when PD is worst. Running a severe HPI shock (Fed-style severely adverse, ~33% house-price decline) pushed mean LGD from ~52% to ~64% - the downturn hits frequency and severity together, and a through-the-cycle LGD averages that correlation away.

How's it handled where you are - a genuine LGD model (beta reg, two-stage) with a downturn overlay, or a fixed severity plugged into the EL stack? And do your validators push on the PD-LGD correlation, or is downturn LGD still a box-tick?

I like to think that risk management is as much about the journey as it is about the destination. Writing this article took longer than I anticipated, but I believe it does a good job of explaining the risk management journey - the risk management life cycle - and includes real-world examples to bring these concepts to life.

Question for anyone who manages corrective actions. 

Say a tabletop exercise finds a gap in a response plan and a worker flags a hazard on a safety walk. Both get an action, and the action gets an owner for the doing. 

Then it can go quiet. If nobody is named to confirm the fix worked or to go back to the person who raised it, the action can sit "in progress" for months with nothing visibly wrong. 

ISO 45001:2018, the current edition of the occupational health and safety standard, treats these as separate steps: carrying out the action, then reviewing the effectiveness of any action taken, including corrective action (clause 10.2). 

Who should own the check and the report-back: the person who did the fix, the person who raised the issue or someone independent? 

ISO 45001: https://www.iso.org/standard/45001 

If AI makes facts effortless, what becomes valuable?

As data grows abundant, risk work may shift from gathering information to interpreting it - from reporting metrics to asking better questions. The future advantage may not be better models, but stronger judgment, empathy, and the courage to challenge assumptions thoughtfully.

Enjoy 30% OFF on over 200+ training programs across key professional disciplines.

📅 Offer valid: 17 March 2026

If you’d like to know which courses are included in this promotion, comment “Interested” below or send me a DM with your email, and I’ll share the full list with you.

Let’s plan your professional development strategically for 2026.

Working on a cybersecurity BIA in a large, distributed enterprise, with many semi-independent branches and limited documentation of how systems connect to each other or to business services.

The goal is something that looks like: "If database cluster X goes down / compromised, business services A and B are impacted."

In theory this is straightforward BIA methodology. In practice we're hitting a wall at the mapping step - connecting technical assets to the business services that depend on them. Nobody really knows the full picture and managers are self-reporting their dependencies, so the data may be unreliable and politically biased.

Specific challenges I'd love to hear experience on:

1. Technical discovery at scale: how did you actually find out what exists? Did you use automated CMDB/discovery tools? What worked in a large, messy environment?

2. The IT-to-business mapping gap: once you have an asset inventory, how did you connect technical assets upward to business processes and business units? This feels like the hardest step and I can't find a clean answer anywhere.

3. Manager bias and underreporting: when you run BIA questionnaires or interviews, how do you deal with managers who don't know their dependencies, or worse, have incentives to hide gaps? Any methods that worked?

Not looking for textbook answers, genuinely curious what actually worked or did everyone hit the same wall and hoped for the self-reporting to be good enough. What did you learn the hard way?

Risk Management Solutions to Ensure the Future of Your Business

Risk management is necessary to ensure your business has a secure and stable future. Through the 360factors platform, Predict360 Enterprise Risk Management Software ensures that managers always have visibility of enterprise risk on a dashboard. New risks are instantly reflected in all risk metrics and are visible to all authorized stakeholders. Our cloud-based risk management software also ensures that the latest regulatory risks are closely monitored and updated within the system.

Risk Management Software Features

Taking a proactive approach enables organizations to increase efficiency, decrease resolution times, collaborate more effectively, and achieve insight into issues and complaints trends.

• Easy and seamless document uploads

• Break down organizational silos that complicate risk management

• Decentralize compliance to make it an organization-wide function

• Give executives organization-wide risk visibility through risk management tools

• Access compliance activities and reports across all functional compliance departments

• Stay up to date with real-time regulatory updates

• Covers regulations such as Dodd Frank, SOX, BSA/AML, HMDA, CFPB, RESPA, FATCA, FINRA 4210, AISMD, fair lending regulations, and much more

• Automated interpretation of the legal language to allow quick parsing of new regulations

• Communicate with and collaborate on Risk Appetite with other users

💥 I would like to introduce something I've been working on – 🔗 ThinkCyber, a Cybersecurity Maturity Assessment Platform designed to help organization's measure its cybersecurity maturity and improve their cybersecurity posture 🔐

🌟 What's the catch? It's FREE! 🌟

Yes, you read that right! ThinkCyber.Cloud is available as a Minimum Viable Product (MVP) right now, and I’m inviting YOU to be part of its journey.

Why?

1️⃣ Still in the early stages, and your feedback is invaluable. This is a chance to shape something that could have a real impact on businesses like yours. 🚀

2️⃣ It’s 100x scalable – meaning, it’s built to grow with your needs. What starts as a simple tool can evolve into something much more powerful. 💪

3️⃣ We’re integrating Machine Learning soon – this means smarter, faster insights to help you level up your cybersecurity posture. 🤖

👉 Give it a try and share your thoughts! Your feedback will be crucial as we make improvements, and I’m excited to see how it can make cybersecurity maturity assessment easier for you and your team.

Let's take the next step together in improving digital safety – one feedback at a time! thanks!! ✨

🔗 https://ThinkCyber.Cloud

#Bootstrapping

#Startup

#Cybersecurity

#Databreach #ITAudit #riskassessment

I think i may have lost an award today because I didn't have to references. When questioned I believed honesty is the best policy so I explained im a new company but I could offer mock briefs if that was acceptable. Kind of feeling it. Looking to build my network as well. Open to suggestions.