Christine Thomas

Buyers evaluating AI agents for compliance automation are buying a set of actions taken inside a regulated process, and every one of those actions has to be able to be reconstructed later. The eight requirements b...

Enterprise policy exception management is the discipline that keeps policy frameworks connected. This is necessary because most policy management content stops at attestation, leaving it for the next review cycle. ...

Investing in an AI compliance assistant looks like a capability decision, with accuracy benchmarks and citation quality and coverage of the regulatory library. However, it’s also important to understand what happ...

Operational readiness describes an institution that can demonstrate control at any moment, without a preparation project, because the underlying record is current rather than reconstructed. This article supplies...

Two documents sit in most bank risk functions and rarely speak to each other. The first is a board-approved risk appetite statement and the second is a third-party risk management framework. Neither one tells a ven...

Risk teams have spent decades managing exposure through spreadsheets, quarterly reviews, and manual sampling but that model now strains under the data volumes and regulatory expectations. AI risk software, in contr...

Third party risk management solutions are unusually hard to compare because the category has no fixed boundary. One product automates assessments, while another monitors external threat signals and a third tracks c...

The Federal Financial Institutions Examination Council is a coordinating body, and it examines no bank directly. What it does produce is examiner handbooks that the OCC, the Federal Reserve, the FDIC, and the NCUA ...

In June 2023, the way the Office of the Comptroller of the Currency evaluates vendor relationships changed. The OCC third-party risk management expectation set that many banks had followed for a decade was rescinde...

Most banks make the decision to replace their compliance tooling after an examiner finding, a regulatory change that slipped through unnoticed, or an audit that turns into weeks of assembling evidence from shared d...