https://www.ft.com/content/9921925e-5a32-48cc-a3e3-3f77042477d2
You get what you pay for - risk is underpaid and the majority of people are mo--ns. My manager does not have a clue - I came from a proper shop and they still do not listen to my advice. It is funny how after our last fed exam they came back and said the feedback was exactly what I said sic months ago 😀
1st and 2nd line are not used effectively. They expect business lines to be risk experts while they sit on the sidelines waiting to share an opinion (too late in the dev process to be helpful). Risk should be in lock step with the businesses to identify risks and ways to reduce the risks to acceptable levels. Money needs to be redirected to better systems of record too. This hodge podge of info in various systems is inefficient.
Obviously, they don’t like smart folks and who challenge bosses and they are laid off.
Mo--ns and our lines of defense are probably 80% of the reason for our issues. If instead of hiring people to give their random opinion of what they wanted to see, we could go to people that own processes and say, hey what the real risk here? Then just fund the required tech to fix it; we would be a 1,000,000x better then where we are.