The Risk Wheelhouse

Wheelhouse Advisors LLC

The Risk Wheelhouse is designed to explore how RiskTech is transforming the way companies approach risk management today and into the future. The podcast aims to provide listeners with valuable insights into integrated risk management (IRM) practices and emerging technologies. Each episode will feature a "Deep Dive" into specific topics or research reports developed by Wheelhouse Advisors, helping listeners navigate the complexities of the modern risk landscape.

  1. 4d ago

    S8E2: How To Spot Real Autonomous AI In GRC Buying

    “Autonomous AI” is not a vibe, it’s an architectural promise. When a vendor tells you their GRC platform can run compliance, risk, and controls without humans, they’re claiming a system of action: detect, decide, act, and verify in a closed loop. We dig into a sharp Wheelhouse Advisors report on Optro’s acquisition of Midship to separate what’s real from what’s merely well-written. We start with the IRM Navigator Model and the three layers buyers should always map to: system of record (storage), system of engagement (workflows and approvals), and system of action (autonomous execution). Then we stress-test the “why not just automate it?” assumption with a concrete security example where an AI “fix” can accidentally take down payments, trigger outages, or create new legal exposure. In GRC and SOX testing, context and liability are the hidden constraints that marketing decks rarely mention. From there, we give Optro credit where it’s earned: FairNow brings meaningful AI governance capabilities like AI inventory, model risk assessment, third-party AI risk tracking, and automated audit artifacts. The controversy begins when “agentic GRC” gets rebranded as “autonomous,” and Wheelhouse follows the evidence. We track how a customer case study’s numbers drift across five tellings, why pre-acquisition proof does not validate an integrated platform claim, and what the architecture reveals when analysts ask the uncomfortable question: where is the remediation and verification loop? You’ll leave with a practical buyer playbook, three diligence questions to use in your next vendor meeting, and a simple demo standard that cuts through buzzwords. If this helped you think more clearly about autonomous AI, AI governance platforms, and enterprise risk management, subscribe, share the episode with a teammate, and leave a review. Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S8E2: How To Spot Real Autonomous AI In GRC Buying
  2. Jul 13

    S8E1: Stop Asking For Another AI Framework

    AI risk feels like driving at night with broken headlights, so leaders keep demanding “a new framework” that will finally make everything clear. We think that’s the wrong ask. The guidance already exists, and it’s more mature than most teams admit: the NIST AI Risk Management Framework, ISO/IEC 42001 certifications, sector-specific control objectives in financial services, and the hard edge of enforcement through the EU AI Act. The real reason risk and compliance teams still feel stuck is that frameworks are built to prove defensibility, not to tell you what to build. We unpack John A. Wheeler’s argument from RiskTech Journal and translate it into a practical way to design an AI governance program that actually works day to day. The key shift is moving from “framework shopping” to a risk operating model: the blueprint that connects people, process, data, and technology and sequences the work over time. We break down the three critical layers a modern integrated risk management (IRM) program needs: the system of record (trusted risk data), the system of engagement (how humans participate), and the system of action (automation, continuous controls, and AI agents that can operate within a defined risk appetite). If your AI only summarizes spreadsheets, you are living in the record layer, not building risk-reducing action. From there, we map the maturity curve from risk dysfunction to autonomous IRM and risk agency, explain why you cannot skip the messy data foundations, and end with a four-step plan you can use on Monday morning to decide what to fund next and how to hold it accountable. If you want clearer AI risk decisions, faster delivery without surprises, and governance that keeps up with speed, subscribe, share this with your risk or IT leader, and leave a review. What part of your AI risk program needs a blueprint most right now? Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S8E1: Stop Asking For Another AI Framework
  3. Jun 29

    S7E5: When Agentic AI Breaks The Law And You Take The Fall

    A subpoena shows up, and it is not addressed to “the company.” It is addressed to you, because an autonomous AI agent quietly renegotiated contracts, stripped a mandatory compliance clause, and triggered a regulatory breach that no human even knew was happening. That is the new baseline for executive risk, and it is why we go deep on the Wheelhouse Advisors 2026 IRM Navigator Leadership Persona Guide and what it reveals about integrated risk management in the age of agentic AI.  We break down the three forces colliding inside modern enterprises: agentic AI moving from generating text to taking action, regulators expanding personal accountability, and risk maturing into a management system discipline that demands unified frameworks and hard evidence. We talk through what “shadow AI” really looks like in a large organization, why “we didn’t know” fails as a legal defense, and how laws like the EU AI Act, DORA, and the SEC cybersecurity disclosure rule change the day to day reality for boards, CEOs, CISOs, CFOs, and legal leaders.  Then we map the IRM buying market as it reorganizes around 12 executive personas across ERM, ORM, TRM, and GRC. We highlight the uncomfortable market gaps: vendors overserve compliance reporting while underserving strategic performance and operational resilience, leaving CHRO and CLO needs wide open. You will also get a practical evaluation blueprint: demand integration with the systems you already run, insist on defensible evidence lineage, avoid “module” pitches that reduce complex risk to checklists, and match risk software to your maturity stage so you do not buy expensive shelfware.  If this raised your blood pressure in a good way, subscribe, share the episode with a leader who owns risk, and leave a review so more executives hear it before the regulator calls. What is the weakest link in your evidence chain today? Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S7E5: When Agentic AI Breaks The Law And You Take The Fall
  4. Jun 2

    S7E4: Your Company Just Hired 10,000 Invisible Interns

    10,000 invisible autonomous AI agents working inside a single enterprise sounds like a productivity dream until you realize no one can explain who chartered them, what data they touch, or what decisions they are quietly making. We take on the popular “AI agent sprawl” narrative head-on and argue for a sharper label: a governance failure in progress that can undermine integrated risk management from the inside out. We unpack the mechanics behind the explosion, from orchestration tools that connect large language models to enterprise APIs to the new reality that non-technical employees can spin up autonomous workflows in natural language. That shift turns isolated experimentation into an unmanaged AI population, spreading across departments without leadership intent, compliance testing, or monitoring. Then we get into the operational danger: conflicting agent outputs are not harmless second opinions when they write directly into systems of record. They become signal failures that corrupt dashboards, distort vendor risk, and feed executives a false picture of the organization’s true risk posture. Using our IRM Navigator lens, we explain how agents fuse systems of record, systems of engagement, and systems of action into one opaque loop, bypassing the human checkpoints that normally enforce authorization and accountability. We also challenge the mainstream focus on compute costs and cybersecurity as the “main problem.” Those matter, but they are symptoms. The deeper issue is silent governance debt that builds until an audit, regulator request, or cascading failure forces an expensive reckoning. If you lead risk, compliance, security, or enterprise architecture, this is your prompt to stop waiting for an IT patch and start designing agent governance as a first-class architectural requirement. Subscribe, share this with a colleague who is rolling out agentic workflows, and leave a review with your answer: if you froze your systems right now, could you tell your board how many AI agents are deciding on your company’s behalf? Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S7E4: Your Company Just Hired 10,000 Invisible Interns
  5. May 14

    S7E3: Why ERM Keeps Getting Ignored

    93% is not a rounding error, it’s a warning flare. When enterprise leaders ask for guidance on the biggest strategic risks ahead, many risk teams respond with a quarterly risk register and a heat map. That’s not “wrong,” it’s simply what a compliance-first system is designed to produce. The result is an asymmetric exchange: executives need a radar, and the organization hands them a snapshot from the past. We walk through new practitioner research from COSO and Crowe alongside John A. Wheeler’s analysis in the RiskTech Journal to explain why the ERM strategy gap persists. Our core claim is straightforward: the failure of ERM is largely structural, not behavioral. When ERM gets fused with GRC under the same reporting line, tooling, and audit committee cadence, uncertainty gets treated like a defect. That destroys psychological safety, suppresses early warning signals, and leaves strategy teams flying blind. To make the fix practical, we map Wheeler’s IRM Navigator Compass (West GRC, South technology risk, East operational risk, North ERM) and the IRM Navigator Curve (foundational through autonomous maturity). We also pressure-test the model against what top practitioners are actually facing right now: AI governance, data governance, third-party dependency, and geopolitical volatility. If agentic AI can make decisions at machine speed, quarterly checklists and static matrices cannot be your governance plan. If you want ERM to shape strategic planning, start by rebuilding the architecture that produces decision-useful signals. Subscribe, share this with a risk leader or board member, and leave a review with the biggest “West Anchor” symptom you see in your organization. Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S7E3: Why ERM Keeps Getting Ignored
  6. May 8

    S7E2: The Autonomous Enterprise And The AI Control Tower

    You can feel the shift happening when you stop picturing “AI tools” and start picturing “AI workers.” From the floor of ServiceNow Knowledge 26 in Las Vegas, we zoom out from the shiny security headlines and explain what John A. Wheeler argues is the real story: autonomous integrated risk management is the first credible blueprint for governing an enterprise where non-human identities execute the majority of actions. We break down the AI control tower mechanics in plain language: the continuous loop of sense, decide, act, secure, plus the five control functions that make governance real at scale (discover, observe, govern, secure, measure). We also get brutally specific about the nightmare scenario many organizations are living through right now: AI agents operating with identity permissions originally designed for humans. When an agent “wears” a cloned human badge, traditional perimeter security can be blind to catastrophic actions happening at machine speed. Then we map the key architectural puzzle pieces: Armis for agentless visibility across IT and operational technology, Vesa for real-time authorization graph mapping and least-privilege enforcement, and the action fabric that turns third-party models like Anthropic’s Claude into governable actors by controlling their actions, not their internals. We also unpack the NVIDIA partnership and why open AI infrastructure makes workflow-aware governance the premium differentiator. Finally, we ground it all in outcomes (hours saved, dormant identities eliminated, compliance timelines crushed) and connect the dots to the regulatory wave coming fast: ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act. If you’re making platform decisions for the next decade, this is the week the vendor questions change. Subscribe, share this with your security or architecture team, and leave a review with the biggest governance risk you’re trying to solve. Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S7E2: The Autonomous Enterprise And The AI Control Tower
  7. Apr 23

    S7E1: The Delve Collapse And The New Rules Of Enterprise Trust

    A compliance certificate is supposed to be like a bridge inspection: real materials, real tests, real signatures, and real accountability. Then AI arrived, and the market started rewarding something else entirely, speed. The result is what we call a trust mirage, where “audit-ready” output can look convincing even when the underlying control evidence is shaky or absent. We unpack the rise and alleged collapse of Delve, a once high-flying agentic GRC startup that promised SOC 2 compliance in days, not months and reportedly reached a $300 million valuation. The wild part is how the story breaks: not with a regulator raid, but with an anonymous Substack writer, a publicly accessible Google spreadsheet, and uncomfortable questions about whether AI-generated reports crossed the line from automation into fabrication. Along the way, we clarify the technical difference between deterministic verification and probabilistic LLM text generation, plus why auditor independence is the core legal requirement that software must protect at the code level. From there we get practical. We challenge the standard venture capital and enterprise procurement playbooks that lean on SaaS metrics like NDR, and we replace hand-wavy “AI compliance” claims with concrete architectural checks: role-based access controls, read-only evidence collection, cryptographic hashing, and hard separation between agents and human judgment. We also share two frameworks to navigate the new landscape: the IRM navigator curve for sequencing risk maturity, and the ADRI index for spotting vendors that maximize compliance artifacts while minimizing integrity. If you buy, fund, or build in compliance, GRC, risk management, SOC 2, ISO 27001, HIPAA, or GDPR, this conversation is your warning label and your field guide. Subscribe, share this with your security and finance leaders, and leave a review. What question will you start asking every “agentic” vendor first? Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S7E1: The Delve Collapse And The New Rules Of Enterprise Trust
  8. Mar 30

    S6E9: Why Legacy Risk Platforms Break Under AI Pressure

    A slick AI demo can make any risk platform look like the future, but architecture is destiny. We unpack the dangerous boardroom illusion where leaders treat radically different “AI GRC” products as interchangeable, then we map what is actually changing under the hood in governance, risk, and compliance technology. If you are a CRO, CISO, chief compliance officer, or audit leader signing multi-year renewals, this conversation is about avoiding the most expensive misread of the AI disruption curve. We walk through the three tiers of enterprise software that shape risk outcomes: system of record, system of engagement, and the emerging system of action. From there, we explain why classic workflow automation is so vulnerable: it is rigid, stateless, and provides no cognitive value once generative AI agents can read unstructured evidence directly, synthesize context, and update the compliance record without a human-friendly interface. Next we zoom in on agentic GRC, why it delivers real ROI, and why it still hits a hard boundary. Risk reasoning lives across four integration points: policies, goals, processes, and assets. A policy-focused agent can be brilliant and still remain blind to strategic objectives, operational workflows, and technology asset exposure. We use the AuditBoard to Optro rebrand and Optro’s AI governance acquisition as a real-time case study of vendors trying to cross that boundary, then we compare structural proximity advantages held by platforms rooted in ITSM and ERP. Finally, we define the destination: fully stateful autonomous IRM that connects GRC, ERM, ORM, and TRM into one governed decision architecture. We introduce the agent proliferation paradox, the city grid metaphor for risk agency, and the four hard procurement questions that keep you out of the integration trap. If this helps you pressure test a vendor claim or reframe your roadmap, subscribe, share the episode with a risk leader, and leave a review with the toughest question you ask in pitches. Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.  Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.  Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.

    S6E9: Why Legacy Risk Platforms Break Under AI Pressure

About

The Risk Wheelhouse is designed to explore how RiskTech is transforming the way companies approach risk management today and into the future. The podcast aims to provide listeners with valuable insights into integrated risk management (IRM) practices and emerging technologies. Each episode will feature a "Deep Dive" into specific topics or research reports developed by Wheelhouse Advisors, helping listeners navigate the complexities of the modern risk landscape.