The Why Behind the Controls

A GRC leader at a fast-growing, multi-sector group explains how to set a baseline controls programme that subsidiaries can layer on top of, why cutting third-party review times means questioning what you actually ask vendors, and why he resists dressing up risk figures with more precision than they deserve.