In this return voyage of Risk Is Our Business, Captain Michael Rasmussen reconnects with Stefan Gershater for a candid, occasionally interrupted conversation from opposite ends of a video call—a fitting setup for a discussion about signal, noise, and what actually matters in modern risk management.

The episode centers on the real value of risk and GRC software, and how leaders should measure it. Stefan brings a healthy skepticism to the conversation, challenging an industry that too often sells efficiency for efficiency’s sake. Over dinner in London, he recalls receiving a message from a vendor promising to save him 80% of his time. His reaction was blunt: No one cares how hard risk teams work, they care about outcomes, decisions, and results.

From there, the discussion explores what risk leaders should actually evaluate in risk technology. Rather than control-heavy platforms built primarily for compliance, Stefan argues for solutions designed to support value creation, decision-making, and the achievement of objectives. They unpack what “good” looks like when it comes to risk data, data strategy, and visualization, and why many tools still struggle to present risk in ways the business can act on.

As the conversation turns to how risk technology should evolve, reality intervenes. A call from Stefan’s CEO pulls him away from the bridge mid-discussion, an unscripted reminder that risk management doesn’t live in dashboards or demos, but in the real-time demands of leadership.

This episode is a sharp look at why not all risk software deserves a place on the bridge, and why separating meaningful intelligence from false alerts has never mattered more.

In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Christopher Hetner, Senior Cyber Risk Advisor serving the boardroom community and former senior cybersecurity advisor to the Chair of the U.S. Securities and Exchange Commission.

The conversation opens by tackling a deceptively simple question: what do we even call this space anymore? Information security, IT security, cybersecurity, cyber risk, digital risk, digital resilience — are these distinct disciplines with meaningful nuance, or different labels for the same underlying reality? Christopher and Michael unpack how language shapes expectations, accountability, and how risk is understood across the enterprise.

From there, they dive into Michael’s widely discussed essay, “The CISO Is Dead: A Eulogy and a Resurrection,”exploring why the title provoked resistance while the substance resonated. The discussion reframes the modern CISO not as a narrow security operator, but as a steward of digital risk and resilience in a world where every function, product, and decision carries a digital footprint.

They explore the dangers of cybersecurity leaders operating in isolation, the limits of traditional security-centric models, and why cyber risk can no longer live on its own island. The conversation then turns to the boardroom, what directors tend to understand about cyber and digital risk, where gaps remain, and how risk leaders can engage boards more effectively by shifting from technical reporting to strategic navigation.

Rather than treating cyber risk as a technical problem to be delegated, this episode makes the case for digital risk and resilience as a bridge-level responsibility, one that requires shared ownership, clearer language, and leadership capable of steering the enterprise through an increasingly interconnected and uncertain risk universe.

In this episode of Risk Is Our Business, Captain Michael Rasmussen opens a subspace channel with Bradley Jewett, Chief Financial Officer at LeadVenture and a seasoned operating executive who helped shape enterprise risk management inside Microsoft and BMC Software.

The discussion begins by contrasting bad risk management (periodic, siloed, and designed to check a box) with good risk management that actively informs how organizations make decisions. From there, Brad introduces the philosophy he championed at Microsoft: the Rhythm of Risk.

Rather than positioning risk as a separate function, Brad describes an approach where risk management keeps pace with the enterprise itself. Strategic planning cycles, annual operating plans, mergers and acquisitions, audit planning, SEC reporting, investor communications, and product roadmaps all become natural moments for risk to surface and influence outcomes. Risk moves in time with the business, strategic and operational, top-down and bottom-up.

Recorded over a live video link, the conversation also explores how this mindset was received by leadership, what it took to set expectations that risk should shape daily decisions, and why aligning risk to the organization’s cadence is far more effective than standalone frameworks or annual exercises.

The episode offers a practical, experience-led perspective on what it means to keep risk on the bridge, not as a warning light, but as a steady navigational rhythm guiding the enterprise through uncertainty at warp speed.

In this episode of Risk Is Our Business, Captain Michael Rasmussen beams into a cross-continental conversation with Karsten Findeis, Head of Risk Management at Nordex Group, and Dr. Ayman Nagi, Corporate Risk Manager, for a deep look at how risk maturity evolves inside a global renewable-energy manufacturer.

They discuss how Nordex has transformed its risk mindset over the past decade, shifting from a compliance-driven obligation to a strategic discipline that captures both risks and opportunities. By treating risk as the effect of uncertainty on objectives, the team explains how they’ve moved beyond the old hazard-and-harm framing to a more balanced, value-creating approach that resonates across the business.

Karsten and Ayman share how Nordex built trust with the organization, how the perception of risk has shifted from burden to business partner, and why logging opportunities alongside risks reflects a more advanced, enterprise-wide understanding of uncertainty. They also dig into IDW PS 340, how its requirements have sharpened their processes, and how implementing the right technology elevated data quality, reporting, and decision-making across the fleet.

They also chart where risk management at Nordex is headed in the coming years, from enhanced digital twins to deeper integration with strategic planning and operational execution. For organizations navigating uncertain markets, the Nordex journey offers a blueprint for turning risk into propulsion rather than drag.

In this latest episode of Risk Is Our Business, Captain Michael Rasmussen connects via subspace (okay… a Zoom call) with Marc Leipoldt, CEO of Global Risk Advisory Services.

Marc and Michael take a candid look at the state of operational risk management in financial services today. Has it become little more than a Basel-born compliance checkbox? Or can it truly guide strategic decision-making and protect the organization when volatility strikes?

Together, they outline what good operational risk management really requires, starting with deep understanding of how the bank actually works—its processes, systems, and the complex interactions between them. Marc emphasizes that KRIs must be actionable and aligned to accountability, not just dashboards for dashboards’ sake.

They also grapple with the messy truth of technology in risk. GRC tools are accelerators, not saviors, and without a clear strategy, strong governance, and well-defined processes, no platform will deliver the transformation banks are hoping for.

And finally, Marc looks five years ahead. What will operational risk maturity look like across global banks? How will regulatory expectations evolve? And can risk finally break free from compliance-only thinking to become the steward of organizational foresight?

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes aboard Mark Heywood, writer, presenter, creative director, novelist, screenwriter, and former global crisis-management leader, for a conversation that travels well beyond the neutral zone of traditional risk models. Together, they explore why risk and resilience can’t be governed by left-brain logic alone, and why the future of the discipline requires imagination, narrative, and the kind of storytelling that has steered starships and boardrooms alike.

Mark draws from his dual life in operational resilience and the arts to explain what happens when organizations rely solely on spreadsheets, heat maps, and linear thinking. They discuss how right-brain capabilities (creativity, empathy, narrative framing, and world-building) are essential for helping leaders actually understand risk, not just document it. From micro-simulations and tabletop exercises to gamification and immersive storytelling, Mark outlines how to design experiences that engage decision-makers emotionally as well as analytically.

The episode charts a course into the future where logic and imagination operate in tandem, where resilience teams think like screenwriters, and where storytelling becomes a strategic asset for preparing organizations to face the unexpected at warp speed.

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes aboard Reshad Alam, Vice President of Information Systems Security at Regal Rexnord, for a conversation about navigating risk at enterprise scale, and why the greatest threat is often the one you can’t see coming.

Reshad describes the sheer scope of Regal Rexnord’s global footprint, and with it, the vast digital surface he’s responsible for protecting. What keeps him up at night isn’t any single threat vector, but the unknowns—the blind spots, the emerging risks, the things security leaders can’t yet quantify. From there, the discussion expands into the evolving nature of the CISO role, which Michael sees not as security’s gatekeeper, but as the enterprise’s digital risk and resiliency officer, a creator of digital trust.

Together they explore why a company unwilling to take risks is a company on the path to irrelevance, and why the job of security is not to say “no,” but to help the business take the right risks for the right reasons. They discuss the art of engaging the business on security, shifting away from fear-based messaging and toward shared objectives, shared language, and shared accountability.

The episode also looks ahead at where the CISO role is heading, and of course, no future-focused conversation would be complete without AI. Reshad shares whether it excites him or worries him, and why, despite the threats, he’s far more energized by the potential of AI to strengthen defenses, accelerate detection, and enhance digital trust across the enterprise.

For security and risk leaders charting their own course through uncertainty, this episode is a reminder that the mission isn’t to eliminate the unknown, it’s to navigate it with confidence, clarity, and a willingness to boldly go where the future demands.

In this episode of Risk Is Our Business, Captain Michael Rasmussen welcomes Richard Chambers, Senior Advisor at AuditBoard and one of the most influential voices in internal audit and assurance, to discuss how risk, audit, and compliance have evolved in a decade defined by unprecedented velocity and volatility.

Richard reflects on the shifting mindset across GRC—from static frameworks and predictable cycles to a world where risk signals move fast, interdependencies compound, and organizations must adapt with greater speed and clarity than ever before.

The conversation draws a sharp distinction between good and bad audit in this environment. Bad audit is adversarial, a corporate police force focused on fault-finding and paperwork. Good audit is a value protector, a trusted partner helping management navigate uncertainty, make sound decisions, and keep the organization moving toward its objectives. If the business fears internal audit, something fundamental is broken.

They then examine modern risk management, emphasizing that effective programs are grounded in realistic assessments of likelihood and materiality, not abstract heat maps or theatrical risk registers. Risk is not something to be avoided; it is something to be understood so the organization can move with intention.

Compliance enters the discussion as well, particularly the cultural divide between the U.S.’s checkbox-heavy approach and Europe’s more risk-based, integrity-oriented model. Compliance, Richard argues, is ultimately about who the organization chooses to be.

The episode closes by looking ahead five years—where AI, automation, and intelligence-driven assurance will shape the role of audit, risk, and compliance. The mission remains the same, but the tools and tempo of the work are changing at warp speed.