Let's Talk IRM

Jada

0.0 (0)
Technology
Updated Monthly

Let's talk IRM. The real stuff. Join Jada, a certified ServiceNow IRM practitioner, as she breaks down compliance automation, risk frameworks, and the strategies GRC professionals actually need. No fluff, no theory. Just real talk from someone who builds it. A SaaSCE Boutique Podcast.

Sep 9

IRM Planning: Why Your Program Stalls After Go-Live

Picture the moment right after go-live. The implementation partner has signed off. The platform is live. The dashboards are populating. And somewhere in that room, the executive sponsor is mentally filing this under done and moving on to the next initiative. That is what this episode is about. A successful implementation and a working program are two different outcomes. In Episode 9 of Let's Talk IRM, Jada Porter and moderator Meesh work through four community questions from practitioners navigating the post-go-live gap in real time. In this episode: How to tell whether stakeholders are genuinely engaged with IRM or just completing tasksWhy it feels like nothing is working six months after a technically successful go-liveWhose responsibility it is to build the governance model and why implementation partners cannot own itHow to re-engage an executive sponsor who has moved on without making it feel like an escalationThe four governance design elements that belong on every SOW and almost never appear thereWhy ServiceNow's new dynamic user assignment feature cannot solve the ownership problem on its ownHow to prevent risk ownership from becoming fragmented when new teams want to join the programThe behavioral signal that tells you executive engagement is actually workingWhy CMDB alignment is the telltale sign of whether your org has truly defined control owners and risk ownersThe one thing Jada would go back and add to every implementation before the team departedCommunity Questions Answered in This Episode: My org went live six months ago. The platform is fully configured. Our business stakeholders only show up for assessment tasks and disappear the moment they are completed. The implementation was considered a success. Why does it feel like nothing is actually working?My org's executive sponsor funded the IRM program, attended the kickoff, and approved go-live. Now the only time I hear from them is when there is a finding in an audit. How do I re-engage an executive who has moved on without making it feel like I am escalating a problem?ServiceNow just released a feature that automatically assigns risk event ownership based on entity context and stakeholder personas. My org is excited about it but we still do not have a defined risk appetite model or a named governance owner. Is the platform going to solve the ownership problem for us?When risk ownership becomes decentralized across the business, how do you stop that from becoming fragmented or chaotic?Timestamp | Chapter Title0:00 | Hook — Picture the Moment Right After Go-Live0:57 | Segment 1: Implementation Success Is Not Program Success1:30 | How to Tell Whether Stakeholders Are Genuinely Engaged vs Completing Tasks3:18 | What Engaged Looks Like in Day-to-Day Platform Behavior4:10 | Community Question 1: Six Months Post Go-Live and Nothing Feels Like It’s Working5:40 | The Culture Gap Behind Check-the-Box Attestation Behavior7:08 | Segment 2: What Executive Disengagement Actually Costs the Program7:40 | Whose Responsibility Is It to Build the Governance Model?8:30 | Why GRC Is Not Just a Cybersecurity Problem9:50 | Can the Implementation Partner Own It, or Must It Be Internal?10:30 | IRM as a Cultural Change, Not a Tool Purchase12:00 | Community Question 2: Executive Sponsor Has Checked Out — How Do I Re-Engage?13:00 | Setting Governance Expectations Before Go-Live15:10 | What Happens When You Cannot Get the Sponsor Re-Engaged15:58 | Segment 3: The Governance Design Nobody Delivers16:40 | The Four Elements: Risk Appetite, Escalation Model, Executive Cadence, Named Owner17:38 | Risk Appetite Decision Model — Named Authorities at Every Threshold18:40 | Escalation Model — Named Humans with Defined Response Times19:30 | Executive Review Cadence — Decisions Not Dashboards20:00 | Named Governance Owner Post-Implementation — Why This Is the Heaviest Element21:05 | Community Question 3: Will Dynamic User Assignment Solve the Ownership Problem?22:05 | What the Platform Can and Cannot Do Without a Governance Foundation23:00 | Community Question 4: How Do You Prevent Decentralized Ownership from Becoming Chaotic?24:47 | The Governance Model as the Firewall Against IRM Fragmentation26:15 | Segment 4: What Genuine Executive Engagement Actually Looks Like27:00 | The Behavioral Signal — Pointed Questions vs Baseline Questions28:30 | How to Tell Whether Someone Has Actually Been Working in the System29:30 | Community Question 5: If the Platform Assigns the Right Person, How Do You Know the Roles Were Defined Correctly?30:20 | CMDB Alignment as the Telltale Sign of Role Definition Health31:57 | Closing Question: The One Thing to Add to Every Governance Design Before Departure34:24 | End Connect + Resources: Website: thesaasceboutique.com Article 9 (companion reading): Re-Engineering the Post-Go-Live Slump: Moving IRM from Live to Governed — thesaasceboutique.com/blog Connect with Jada on LinkedIn: linkedin.com/in/jadaporter Connect with Meesh on LinkedIn: linkedin.com/in/michelle-m-65a4b9a7 Subscribe so you don’t miss Episode 10. #ServiceNow #IRM #GRC #ServiceNowIRM #LetsTalkIRM #IRMPractitioner #Governance #RiskManagement #ServiceNowGRC #GRCPodcast #PostGoLive #IRM Planning #ExecutiveEngagement #TheSaaSCEBoutique #RiskOwnership #GRCImplementation #ServiceNowCommunity #ContinuousMonitoring #IRMGovernance #GRCGovernance
Aug 10

Who Actually Owns Risk in Your IRM Program?

In Episode 8 of Let's Talk IRM, Jada Porter and moderator Meesh work through five real questions from IRM practitioners navigating risk ownership gaps in their ServiceNow programs. Jada covers the earliest platform signals that ownership was configured before the organizational conversation happened, why defaulting to the CISO as the enterprise risk owner is a governance vulnerability, how scenario-based questions surface the actual risk owner faster than abstract definitions, and what it costs a program long-term when the implementation team fills the ownership vacuum to meet a deadline. The episode closes with a framework-to-controls walkthrough using an access control example and one concrete action every practitioner can take this week. Who Actually Owns Risk in Your IRM Program? The risk register shows owners. The owner field has a name in it. And that person has never once made a deliberate decision about the risk they are listed as owning. That is not a platform problem. The platform did exactly what it was configured to do. It is a governance design problem. In Episode 6 of Let's Talk IRM, Jada Porter sits down with moderator Meesh to unpack the most common post-go-live failure in ServiceNow IRM programs: risk ownership that exists on paper and nowhere else. Together they work through five community questions from practitioners who are navigating this problem in real time. In this episode: Why no variance in ownership is the first sign that the governance conversation never happenedThe hospital and Windows 7 example that explains why the CISO is not your risk ownerThe difference between an org that does not know how to own risk and one that is choosing not toWhy scenario-based questions surface the risk owner the abstract question never couldWhat it costs a program long-term when the implementation team fills the ownership vacuumHow to tell the difference between a status update and an actual conversationWhy automation on top of a broken process just automates a broken processThe access control example that turns framework names into organizational controlsThe one concrete thing you can do this week to move the needle on risk ownershipCommunity Questions Answered in This Episode: I assigned risk owners before the governance conversation happened. The engagement ends in 60 days. Is it too late to fix the ownership model?Every time I try to define process ownership with org leaders they defer back to me. At what point do I just make the call?My org is nowhere near ready for automated risk assessments but leadership expects automation at go-live. How do I manage that gap?My engagement ends in 30 days. The org's maturity is nowhere near where it needs to be. I flagged it in every status update. Do I walk away knowing I named it?My org references ISO and NIST in every conversation but nobody can tell me what controls they are actually evidencing against those frameworks. How do I shift that conversation? Connect + Resources: Website: thesaasceboutique.com Article 6 (companion reading): Why Executive Engagement Is the Variable Nobody Plans For — thesaasceboutique.com/blog Connect with Jada: linkedin.com/in/jadaporter Connect with Meesh: linkedin.com/in/michelle-m-65a4b9a7 Subscribe so you don't miss Episode 7. #ServiceNow #IRM #GRC #RiskOwnership #LetsTalkIRM #IRMPractitioner #ServiceNowIRM #Governance #GRCPodcast #TheSaaSCEBoutique
Jul 15

When is ServiceNow IRM Customization the right call?

This episode explores how to differentiate between genuine system gaps and knowledge gaps that lead to unnecessary customizations. The discussion emphasizes the importance of understanding customer needs, the risks of customizing baselines, and strategic approaches to IRM implementation within ServiceNow. Main Topics Covered: Recognizing whether a change request addresses a real gap or a knowledge gapThe importance of discovery processes before customizationWhen customization is appropriate versus when best practices should be followedRisks associated with customizing baseline features and how to mitigate themThe significance of understanding the platform's out-of-the-box capabilitiesStrategies for guiding clients towards realistic expectations and minimizing technical debtIn this episode: How to identify signals indicating a knowledge gap versus a build need (1:39, 2:07, 4:02)The role of discovery and understanding client processes before making recommendations (5:53, 6:21)Examples of justifiable customizations in IRM, like attestations or risk management processes (9:18, 10:08, 11:02)The importance of not touching baseline code and proper documentation practices (20:47, 21:16)Balancing client demands with platform limitations and avoiding technical debt (16:06, 17:25)
Jun 1

IRM Planning: Before The Build

This episode explores the critical aspects of planning and stakeholder alignment in ServiceNow IRM implementations. Featuring expert insights, it emphasizes the importance of strategic preparation, ownership, and organizational discipline for successful risk management. Key Topics Implementation planning and its impact on IRM successStakeholder and ownership alignment in IRM projectsThe role of CMDB and internal controls in risk managementChapters 00:00 Introduction to IRM Planning and Goals02:06 Why Planning Often Traces Back to Resources and Stakeholders04:07 Technical vs. Project Management Planning in IRM06:09 Aligning Business Processes with IRM Capabilities07:56 The Importance of Clear Ownership and Stakeholder Communication09:46 Building a Realistic and Phased IRM Implementation Roadmap12:08 Assessing and Improving Your CMDB for IRM Success14:05 Evolving Documentation and Regulatory Changes16:04 Minimum Viable CMDB Thresholds for IRM17:50 Trust and Gaps in the CMDB and Their Impact19:57 Granularity in IRM: Going Beyond the Basics21:50 Stakeholder Ownership and User Adoption Challenges24:01 Effective Communication and Ownership in IRM Projects25:58 ServiceNow vs. Practitioner Responsibilities in Readiness27:58 The Role of Readiness Checklists and Organizational Strategy29:51 Key Takeaways for Successful IRM Implementation32:13 Final Tips for Planning and Execution in IRM34:00 Using Now Create as a Starting Point34:58 Next Steps: Managing Scope and Roadblocks36:11 Closing Remarks and Resources for IRM Enthusiasts
May 10

Before the upgrade: ServiceNow IRM

Let's Talk IRM
Apr 20

To Transform Or To Transfer

Are you struggling with user adoption and process alignment during your IRM implementations? In this episode of Let's Talk IRM, certified IRM practitioners Elay and Jada dive into the core differences between transforming existing processes and merely transferring them into new tools, particularly within ServiceNow IRM. Key topics covered: The common pitfalls of "lift and shift" approaches and why a full reimplementation is often necessary.Indicators early in an engagement that reveal whether a team is ready to transform or just transfer their old processes.How organizational support from leadership influences the success of IRM projects.The importance of configuring the platform correctly to meet future needs and avoid rework.Strategies for balancing user experience with the integrity of data models during phased implementations.Tips for managing client expectations and avoiding the trap of recreating inefficient workflows.Recognizing when to rebuild versus work around existing configurations to ensure long-term value.The role of leadership buy-in in preventing the "dead on arrival" deployment scenario.Practical advice on engaging clients who are fixated on replicating their spreadsheet workflows.Timestamps: 00:00 - Introduction: Why many IRM projects fail despite investing heavily 00:28 - The critical question: Are we transforming or just transferring processes? 1:26 - Elay's expertise: Insights from numerous IRM implementations 2:25 - Why spreadsheets often outperform complex GRC platforms 3:20 - Signs early in a project that indicate a need for transformation 4:03 - How to identify a team's readiness to change during initial sessions 5:26 - Understanding the "crawl walk run" approach for IRM adoption 6:41 - Managing client expectations when demo-proof features don’t match real needs 7:37 - The impact of client resistance and how to handle it effectively 9:36 - When to automate and transform versus work with existing dashboards 10:41 - Navigating client resistance when they want to recreate their old workflows 11:36 - The importance of configuring at the right level: front-end vs. data model 13:58 - Accepting that sometimes you must lose battles for long-term wins 15:02 - When re-implementation is necessary: assessing the extent of the "lift and shift" 16:30 - Rebuilding vs. working around: making strategic decisions based on pain points 18:39 - Balancing user adoption with maintaining data integrity over the long term 20:11 - Protecting the process flow and data model during phased rollouts 22:08 - The importance of leadership support in successful IRM adoption 23:09 - Is lift and shift ever justified? Elay’s perspective on organizational readiness 24:26 - The role of executive buy-in in preventing half-baked IRM projects 25:31 - Practical considerations: matching implementation approach to organizational culture 26:44 - Closing remarks: The value of ongoing conversations around IRM best practices
Mar 10

True or False? IRM Begins Before Tool Implementation

The Critical Role of Business Understanding Before ServiceNow IRM Implementation Are you about to implement ServiceNow's IRM application? This episode exposes common pitfalls organizations face when rushing into tool deployment without fully understanding their business processes. Learn from real-world stories why IRM success begins with business insights. In this episode: Why IRM begins before the tool is even purchasedThe dangers of skipping business process analysisCommon implementation pitfalls based on field storiesHow organizational complexity impacts IRM projectsStrategies for aligning IRM with actual business operationsThe importance of stakeholder engagement and clear ownershipRisks of unnecessary customizations and performance issuesKey questions to ask before and during IRM implementation Timestamps:00:00 - Why organizations are unprepared for ServiceNow IRM success00:50 - How to determine the ideal order for IRM product implementation02:05 - The importance of understanding your business operations first03:24 - Challenges with entity scoping without clear business context04:11 - The risks of jumping into IRM without aligning to business needs06:39 - Handling immature processes and manual workflows in IRM projects08:43 - How language barriers and unexperienced teams impact implementation11:21 - Why organizations fail despite large investments in IRM tools12:37 - The pitfalls of customizing out-of-the-box modules15:43 - Performance issues and cross-functional silos in IRM deployments18:22 - Upgrade difficulties and the risk of over-customization20:47 - The importance of clear ownership and stakeholder involvement24:36 - Final takeaway: IRM starts with business, not technology Have you been through an IRM implementation that went sideways — or one that went exactly right because your team did the business work first? Jada wants to hear from you. This podcast is built on real stories from real practitioners. Send your story: Connect with Jada on LinkedIn (https://www.linkedin.com/in/jadaporter/) or send to podcast@letstalkirm.com Follow Let's Talk IRM for new episodes and IRM practitioner content.
Feb 10

What is IRM?

Summary In this episode, Jada Porter explains Integrated Risk Management (IRM), clarifying its meaning and importance in organizations. She discusses common misconceptions about IRM, emphasizing that it is not merely a tool or a checkbox exercise, but a comprehensive process that integrates various aspects of risk management. Jada outlines a four-part framework for successful IRM implementation, focusing on data, process, framework, and reporting integration, and encourages organizations to adopt a holistic approach to risk management. Takeaways The purpose of this episode is to explain what IRM is.IRM stands for Integrated Risk Management.IRM is not just a tool or a checkbox exercise.Understanding IRM is crucial for successful implementation.There are multiple meanings for IRM in different contexts.A lack of understanding of IRM can lead to complications.IRM involves integrating risk and compliance processes.Successful IRM requires strong business and leadership input.Four types of integration in IRM are essential for success.Meeting users where they are is key to effective IRM.
Feb 1

Why 'Let's Talk IRM' is Needed

Summary In this episode, Jada introduces her podcast focused on integrated risk management, sharing her passion for the subject and her desire to bridge the gap between business needs and technology solutions. With over a decade of experience in IT and security, Jada aims to create a platform for real discussions about the human side of risk management, moving beyond technical how-tos to address the challenges practitioners face in aligning business goals with technology. She emphasizes the importance of understanding stakeholder dynamics and the mindset required for successful implementation of integrated risk management strategies. Jada outlines her vision for the podcast, targeting GRC practitioners, technology teams, and anyone involved in risk management who may feel disconnected from the tools they are using. She expresses her hope that the conversations will resonate with listeners, providing insights and support for navigating the complexities of integrated risk management. By fostering an open dialogue, Jada aims to create a community where practitioners can share their experiences and learn from one another, ultimately enhancing their understanding and execution of risk management practices.

9 Episodes

Let's talk IRM. The real stuff. Join Jada, a certified ServiceNow IRM practitioner, as she breaks down compliance automation, risk frameworks, and the strategies GRC professionals actually need. No fluff, no theory. Just real talk from someone who builds it. A SaaSCE Boutique Podcast.

Creator

Jada
Years Active

2026
Episodes

9
Rating

Clean
Copyright

© 2026 Jada