The RACI model has been used to help manage projects successfully. In this blog post we explore how meeting obligations can be improved using a RACI model to clarify compliance RACI for Projects The RACI model was introduced in the 1950s to clarify roles and responsibilities for for Compliance Variations to the basic RACI model are used to accommodate different kinds of project To apply the RACIV model each obligation is considered as a micro project where objectives instead of

In the traditional model regulators identify the public harm, conduct an assessment, and come up with In this new model, regulators establish performance and outcome-based obligations for industry to achieve

works — how obligations are owned, how promises are kept, how assurance is built into the operating model It's the operating model.

I wrote a few years ago that compliance needs to change, and that the reactive model most companies still What I did not name clearly enough at the time was the reason the reactive model persists. When we borrow the financial audit model and apply it to outcomes that have not yet occurred, we are AI does not tolerate a reactive compliance model. Its behaviour is variable, fast, and often novel.

The discipline inherited its working model from financial audit, never matured past the prescriptive In that domain, the model worked. What did not travel was the coupling between control and outcome that made the audit model work in finance The profession was built on a model designed for transactional assurance and applied to a domain that impact of change, integrated with change management PHA revalidation → Periodic re-evaluation of threat model

To bring the risks into focus, let’s consider the use of Large Language Models (LLMs) used in applications What do LLM's model? They do not model your compliance program, your cybersecurity framework, or any other aspect of your LLMs model language to predict words, that's all. behaviours, and interactions necessary to achieve the outcome of compliance which is something that's not modelled

This will help in updating our system models and processes to make them more efficient. In a fashion, we construct a "model" for how we understand the world and then validate that model using Management systems are based on models for how things get done. How true a model is depends on several factors that include: resolution, fidelity, and effectiveness. This is why we need to apply the scientific method to update our models so that they become "truer" in

This is a fundamental principle of cybernetic models (i.e., the Good Regulatory Theorem). 

However, there is a lesser-known, yet profoundly effective mental model that turns this logic on its The inversion mental model asks you to work backward from an undesirable outcome, rather than from a Inversion in Action: How to Apply it to Compliance Success Let’s explore how the inversion mental model The power of the inversion mental model is that it forces organizations to consider these blind spots The inversion mental model offers a valuable approach by shifting focus to failure prevention.

Risk assessment walks from hazard to failure mode to control, and with these systems that walk breaks enough to notice. 🔸 𝗗𝗮𝘁𝗮 𝗜𝗻𝘀𝗶𝗴𝗵𝘁𝘀 𝘃𝗲𝗿𝘀𝘂𝘀 𝗠𝗮𝗻𝗮𝗴𝗲𝗱 𝗞𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲 In the old model The model, the platform, and the tooling can be bought.

ISO 5338 defines the lifecycle processes for building an AI system: the engineering work of data and model If you fine-tune a model, add guardrails, chain components, or integrate AI into a larger system, you

An agent's range of behavior — the model, the tools it can call, the situations it can wander into, the There are filters that screen what goes into the model and what comes out. The model, the filter checking the model, and the second model watching the first are mostly the same