Integrated Risk Management versus GRC
GRC remains part of the picture. Integrated Risk Management becomes useful when risks, controls, assurance and actions need to connect across organisational boundaries.
Read this insightInsights
Useful thinking about risk, AI and change
Hot Desk shares practical guidance drawn from product development and consultancy across Integrated Risk Management, AI, security, legislation and business change.
Written for people who have to make the decision
These articles are for leaders, practitioners and delivery teams working through questions about Integrated Risk Management, enterprise AI, security, legislation, compliance and automation.
Start with the difference between IRM and GRC, how to evaluate enterprise AI search using your own knowledge, or why an unclear process should not be automated yet.
You will find practical questions, examples and checklists rather than trend commentary. We are clear about what our products can do today and keep client organisations private unless they have agreed to be named.
Published insights
How to replace disconnected risk registers
Replace separate risk registers by agreeing ownership and language first, connecting the information that matters, and moving data in controlled stages.
Read this insightHow to evaluate enterprise AI search using your own knowledge
Test enterprise AI search with representative documents, real questions, permissions, source evidence, current information and deliberate failure cases.
Read this insightA practical AI governance checklist for New Zealand organisations
A plain-language checklist for deciding why AI is being used, who is accountable, what information it may access and how the organisation will test and monitor it.
Read this insightPrivate AI is an operating model, not only a hosting location
Calling AI private requires control over the complete path through data, identities, models, knowledge stores, suppliers, workflows, operations and change.
Read this insightWhat makes an AI workflow governed and operable?
Use this practical checklist to govern AI workflows across approved sources, bounded actions, meaningful human decisions, versioning, monitoring and safe recovery.
Read this insightHow to turn legislation into implementable business requirements
Trace legislation through functions, capabilities, decisions, information and controls before writing requirements that a team can implement and test.
Read this insightWhy unclear processes should not be automated
Clarify the purpose, real work, decisions, exceptions, information and ownership before deciding whether anything should be automated.
Read this insightIntegrated Risk Management maturity self-check
Use 25 questions to see where risk work connects well, where it depends on individuals and where the next practical improvement may be.
Read this insightStart a conversation
Bring us the challenge, not a finished specification.
We will help clarify the current state, the decisions that matter and a practical next step.