Embedded Files
Overall Impressions
Overall Impressions
Our last conference of the season was Risk at Excel London. This conference brings together a Risk Management community. It leans more toward the Internal Audit and Legal professions than other of the conferences that we have attended this month. However, there is a strong technology thread in the agenda: both from where the risks reside, and also in the mitigation tools. There is a whole category of software Reg Tech that I was not previously aware of. There was more AI in the positioning than we had at DTx or cyberExpo. The examples that I saw were actually very good. People seemed to differentiate well between a novel use of large language models and the analytics that we have always been using.
One thing that struck me as unexpected was that the vendors did not seem to make a great deal of their ability to interrogate the ERP back end. When I first entered this market, that was a very important characteristic. I saw one vendor mention the ability to interrogate Salesforce.
Procurement process though was very well represented. Supplier onboarding seemed very well represented. It seemed to cross over between ESG themes (ethical purchasing, sustainability) and information security (Information Supply Chain)
The following are some of the sessions we attended.
Regulatory Compliance and Change Management
Regulatory Compliance and Change Management
Policy compliance platform. Looking through your policies against laws and regs where you trade and initiate a workflow for remediation.
Seeing the Unseen: How Data Mapping Shapes Robust Privacy Strategies
Seeing the Unseen: How Data Mapping Shapes Robust Privacy Strategies
A talk given by Gal Ringel, CEO and co-founder, Mine. Part of the talk was about rouge IT and minimizing data landscape by pruning accounts where you only have 1 user. The methodology seemed to be to scan email meta data to find cloud based systems to which somebody had signed up, which I am not sure I fully understood.
They then talked about, Data classification. Scan the data. Meta data scan. Deep link to file or data source. They noted finding sensitive data in very unexpected places, like meeting notes containing credit card numbers
They mentioned the need under GDPR to create a record of processing activity (ROPA) and mapping what applications processes what data automatically through their Data Privacy Copilot. It got me wondering if Enterprise Resource Planning vendors create a ROPA for their customers.
Diligent One: Connecting Risk to the Board
Diligent One: Connecting Risk to the Board
Given by Thibaud Saint-Romain, Solutions Engineer, Diligent
Help companies run their risk meetings. Mentions EU AI top of schedule closely followed by UK corporate Governance Reform. A digitised risk register with Risk Controls policies and procedures relationships aligned with iso 31000. It showed some capability to align with COBIT. The processes looked very policy doc centered
The AI Act: That means EU (and you, and you, and you) – Risk Management and Regulatory Extraterritoriality
The AI Act: That means EU (and you, and you, and you) – Risk Management and Regulatory Extraterritoriality
Given by Barry Scannell, Partner (AI Law), William Fry LLP and Nish Imthiyaz, Global Legal Counsel – Privacy, AI, and Digital Regulations, Vodafone
The first thing to note was that the talk was standing room only. Great presenters. They noted thet the use of AI in product terminology diminishes trust in that product.
There were some aspects of the rules that were new to me. For example, rules on AI literacy. The UK will have to comply. The presenters made a great deal of the fact that if the data is consumed within the EU or uses data of EU you need to comply with the regulations and surrounding regulations. For example, a model provider must comply with EU copywrite law.
We made the point in the Q&A that the definitions within the EU AI are very broad and may include things that folks do not think of as being an AI. We also noted that there are things in the prohibited practices that may surprise folks; for example, detecting somebody's emotional state is prohibited and yet sentiment analysis is a standard feature within marketing software.
AI Revolutionising Risk Management: Enhancing Accuracy and Efficiency in Fraud Detection
AI Revolutionising Risk Management: Enhancing Accuracy and Efficiency in Fraud Detection
Moderated by Paul Munson, Compliance Lead EU & UK (MLRO/CCO), Legal and Compliance, Rippling
The session was conducted as a Q&A session starting off with how is AI being used. Some pieces seemed to conflate analytics and artificial intelligence: links in fragmented datasets. hidden correlation, anomaly detection and textual analysis. However there was one example from an insurance company that I thought was very interesting. They paid a claim based on the text in the description and then found the exact same text in many subsequent claims.
They talked about doing a network analysis of connected identities that reminds me of how photographs get connected with string at a detectives desk.
When the conversation drifted towards large language models, they made the point about prompt engineering, being the new reading and writing. The more exposure I get to these systems the more I agree that the most crucial skill is learning to frame questions well.
Google Sites
Report abuse