The Risk Wheelhouse

A subpoena shows up, and it is not addressed to “the company.” It is addressed to you, because an autonomous AI agent quietly renegotiated contracts, stripped a mandatory compliance clause, and triggered a regulatory breach that no human even knew was happening. That is the new baseline for executive risk, and it is why we go deep on the Wheelhouse Advisors 2026 IRM Navigator Leadership Persona Gu...

10,000 invisible autonomous AI agents working inside a single enterprise sounds like a productivity dream until you realize no one can explain who chartered them, what data they touch, or what decisions they are quietly making. We take on the popular “AI agent sprawl” narrative head-on and argue for a sharper label: a governance failure in progress that can undermine integrated risk management fro...

93% is not a rounding error, it’s a warning flare. When enterprise leaders ask for guidance on the biggest strategic risks ahead, many risk teams respond with a quarterly risk register and a heat map. That’s not “wrong,” it’s simply what a compliance-first system is designed to produce. The result is an asymmetric exchange: executives need a radar, and the organization hands them a snapshot from t...

You can feel the shift happening when you stop picturing “AI tools” and start picturing “AI workers.” From the floor of ServiceNow Knowledge 26 in Las Vegas, we zoom out from the shiny security headlines and explain what John A. Wheeler argues is the real story: autonomous integrated risk management is the first credible blueprint for governing an enterprise where non-human identities execute the...

A compliance certificate is supposed to be like a bridge inspection: real materials, real tests, real signatures, and real accountability. Then AI arrived, and the market started rewarding something else entirely, speed. The result is what we call a trust mirage, where “audit-ready” output can look convincing even when the underlying control evidence is shaky or absent. We unpack the rise and alle...

A slick AI demo can make any risk platform look like the future, but architecture is destiny. We unpack the dangerous boardroom illusion where leaders treat radically different “AI GRC” products as interchangeable, then we map what is actually changing under the hood in governance, risk, and compliance technology. If you are a CRO, CISO, chief compliance officer, or audit leader signing multi-year...

Risk teams don’t lose sleep over unknowns anymore. They lose sleep over lag. We dig into why time-to-action has eclipsed visibility as the true differentiator for performance and resilience, and how autonomous IRM turns risk signals into verified outcomes at operational speed. Drawing on the 2026 VC Sonar for Performance and Resilience, we explain the market’s second investment wave: operate-throu...

What happens when the firm that helped define integrated risk management turns a critical lens on the category's foundations? In this episode, analysts Ori Wellington and Sam Jones preview two major Wheelhouse Advisors research publications: The Integration Trap for GRC and the IRM50 AI Disruption Risk Index . The data reveals a surprising finding: when 50 IRM vendors are scored on structural...

Growth used to win every boardroom vote. Now the data says something different: directors are prioritizing technology adoption and integration as the top 2026 investment, even as they admit their weakest expertise sits in AI, cybersecurity, and geopolitics. We unpack that paradox and show how uninformed speed turns “integration” into a superhighway for risk, unless you pair it with decision rights...

The ground rules of risk have changed, and waiting for the next headline won’t save the balance sheet. We take you inside “The 2026 Convergence: Integrated Risk Management in a New Era” and map how cyber, AI, third parties, geopolitics, and reputation have fused into one risk surface. Instead of chasing alerts, we focus on disruption economics: what a breach costs per minute, which processes bleed...

Shiny demos are everywhere, but what if that “next-gen SaaS” risk platform is still a construction zone under the hood? We unpack the Risk Tech Buyer Trap and show how modern UIs and AI buzz can disguise where vendors really are on the path to true integration maturity. Our conversation breaks down a clear four-stage transformation sequence—SaaS foundation, experience reset, object model stabiliza...

Risk work that lives in reports but not in decisions is a hidden tax on performance. We tackle that problem head-on by unpacking the IRM Navigator, an operating model that connects standards and roles to the real systems and moments where choices are made. Instead of treating risk as a sidecar, we show how to embed it into approvals, planning, and daily operations so decision velocity and decision...

Integrated Risk Management (IRM) is repeatedly underfunded for a structural reason: leaders keep forcing IRM into an ROI construct that demands a single, auditable chain of causality, while IRM is designed to distribute value across multiple domains at once. In this episode, Ori Wellington and Sam Jones explain why ROI framing collapses into assumption-stacked narrative under CFO scrutiny, and why...

Season 6 opens with a clear message for Technology Risk Management leaders: autonomy is no longer constrained by model capability, it is constrained by infrastructure discipline and auditable management controls. In S6E1, Ori Wellington and Sam Jones translate NVIDIA’s CES 2026 signals into a practical blueprint for Autonomous IRM , defined as continuous, AI-enabled verification and response loops...

ServiceNow’s planned $7.75B all-cash acquisition of Armis (targeted to close in H2 2026 ) is easy to misfile as “just another cybersecurity deal.” In this episode, Wheelhouse Advisors’ Ori Wellington and Sam Jones explain why it is actually a defining IRM market signal , one that raises the standard for what “risk management at scale” should mean going into 2026 procurement cycles. The core messag...

Most ERM programs are still built to prove activity , not to produce decisions . In 2025, that gap is becoming visible at the board level, and it is getting punished. The new performance standard is measurable: time to decision and time to evidence . If your ERM platform runs on annual cycles and manual synthesis, you are not steering the enterprise, you are documenting the past. In this episode,...

Feeling lost in a sea of “next‑gen” risk tools that all promise unified visibility and maturity? We break the cycle of flashy demos and stalled implementations with a practical, research‑backed way to evaluate vendors and build a roadmap that actually advances your program. Anchored by the IRM Navigator Curve from Wheelhouse Advisors, we chart the journey from fragmented, audit‑driven dysfunction...

A hard truth drives this conversation: leaders are seeing the risks but not making the moves. We unpack the 76–42–22 drop-off, visibility to engagement to action, and show why the real bottleneck isn’t data, it’s decision architecture. If your board keeps asking for tighter numbers and firmer timelines, you’re living the reporting plateau. Precision can be counterproductive for emerging risks: it...

The latest episode of The Risk Wheelhouse tackles one of the strangest sights in this year’s risk technology landscape. The 2025 Gartner Magic Quadrant for Governance, Risk, and Compliance arrives with an empty Visionaries quadrant. No challengers, no upstarts, just silence where innovation used to live. Rather than treating this as a warning sign, Ori Wellington and Sam Jones explain why the quie...

The ground under GRC is shifting, and it’s not subtle. We break down how unified integrated risk management is replacing checklist compliance with an operating model that ties performance, resilience, assurance, and compliance together. From AI governance to ESG at the board level, we follow the money, the deals, and the data to show where risk management is actually going—and how to get there wit...

Resilience isn’t a binder anymore. It’s a live system that has to perform under pressure. We pull apart the 2025 IRM Navigator™ Vendor Compass for Operational Risk Management (ORM) to show how ORM moved from back-office compliance to the execution engine of enterprise resilience. The stakes are massive. They include billions in spend, tighter regulations across the US, UK, and EU, and a rising dem...

Your “encrypted” data may still be regulated and today the rules start to bite. We unpack how the Department of Justice’s Data Security Program moves from guidance to strict enforcement and why it reframes data governance as a national security mandate. From redefining “covered data” to treating anonymized and encrypted datasets as in-scope when they enable linkage or inference, we walk through wh...

Autonomous IRM is moving from the lab into the core of enterprise risk, compliance, and security and the stakes couldn’t be higher. When a self-learning agent flags threats, scores claims, or polices policy violations, who is accountable, how do we intervene, and what proof can we show regulators and customers? We unpack the three frameworks shaping credible answers: ISO/IEC 42001 as a certifiable...

Corporate governance is undergoing a revolution in the UK, and Provision 29 of the 2024 Corporate Governance Code stands at the epicenter of this transformation. Far beyond traditional financial oversight, this groundbreaking rule mandates unprecedented transparency from company boards about their internal controls across all domains – financial, operational, compliance, and critically, technology...

Artificial intelligence stands at a crossroads of breathtaking innovation and urgent need for responsible guardrails. Every breakthrough brings questions about safety, fairness, and accountability that can no longer be afterthoughts. The European Union has responded with the AI Act – the world's first comprehensive legal framework for artificial intelligence – and its General Purpose AI Code...