Agents of Risk Blog Series
Agents of Risk is LogicGate’s series spotlighting the leaders, innovators, and risk professionals building smarter, more human GRC programs. In each installment, we sit down for a candid conversation with industry talent to get the true story behind their journey, their approach to risk and compliance, and the lessons they’ve learned along the way.
Featuring: Mike Arnesen, Senior Manager, Information Security Risk Management at Ralliant
Mike Arnesen’s team at Ralliant is moving a parent company and its sub-organizations onto one shared standard for third-party and security risk. His advice for a GRC program that works: know the business, communicate clearly, spot risks early, and keep data requests simple.
From Sarbanes-Oxley to Shared Standards
“You are literally standing in a river of change and new information.”
That’s how Mike Arnesen describes working in GRC, and his career started in the middle of a current. He began in audit at a Big Four firm just as Sarbanes-Oxley was kicking off. It was a transformational time for how businesses looked at IT and security risk.
A master’s in information systems management and a long interest in where computing and business meet pointed him there. Advisory services and an information security team followed.
Today he’s on Ralliant’s GRC team, helping a parent company and its sub-organizations run risk on the same standards.
Four lessons run through that path:
- Context comes first: Risk can’t be quantified until you understand how the business actually works.
- Communication carries the message: Findings only matter if executives can act on them.
- Look around corners: Study emerging issues early, before they reach the business.
- Simple scales: Teams adopt a program that asks for only what decisions need.
Context Before Quantification
Mike’s audit years showed him that evaluating controls reveals where a business is weak and where it can get stronger. Working across industries taught him that security risk management only pays off when the person doing it understands how the business runs.
“Until you truly understand the business that you’re working with, you’re never going to be able to properly quantify or understand the risks.” Technical skill and general risk knowledge matter.But they don’t tell you what could happen to a specific organization or how it would change the way that organization runs.
Then there’s the handoff. “Without that translation factor, the message may get lost in the details, or lost in technical jargon,” Mike says. In his view, communication is what turns risk data into decisions.
A Fast-Moving Field, and an AI Shift in Progress
Ask Mike what surprised him most about GRC, and his answer is instant: the speed. The relentless pace of new information is exactly what keeps the work so compelling.
AI is the sharpest example. Its capabilities have grown dramatically in a short time, and Mike calls it a “micro-revolution” that GRC professionals get an unusually clear view of, both in how it’s changing businesses and in the risks it introduces.
He’s particularly excited about how AI can automate the daily grind within LogicGate—handling task follow-ups, findings management, and vendor chasing in TPRM. By letting AI handle the busywork and gather data, his team can focus on what actually matters: synthesizing insights, making strategic decisions, and giving executives a real-time view of risk.
Early Warning, Not a Rear-View Mirror
The leadership lesson Mike didn’t expect to learn was how to look around corners. When something starts to percolate in the world, he wants his team studying it early, so they face issues “long before the train arrives at the station.”
That takes time, and time comes from getting out of the day-to-day tasks. Information arrives at a frenzied pace. The teams that can see what’s happening, or about to happen, are the ones that can position the business to respond.
From Separate Programs to One Standard
Mike’s most recent aha moment is a centralization project. Ralliant is a parent company with multiple sub-organizations, and many of them used to handle risk in their own ways. His team has been bringing that work together, from third-party risk management to security risk management, so every organization frames risk the same way. His reasoning is straightforward: “We’re all really on the same team, and we should all be looking at risks from the same perspectives.”
For third-party risk management, that meant standing up LogicGate and bringing every group onto it. Everyone now runs a similar review against the same standards, and the team strengthened standards from each group along the way. Mike helped build the processes behind it, and he calls watching it come together some of the most rewarding work of his career.
The Advice: Keep the Program Simple
“I have a tendency to want to be a perfectionist, and because of that, I try to over-collect information.”
Mike’s biggest lesson learned comes from correcting that habit: keep the program simple. Every extra data request is a burden on the teams who have to supply it, so the effort should be commensurate with the value that comes back. When it isn’t, friction wins. People abandon the program, never adopt it, or use it “only when they absolutely have to.”
His balance is gathering the information needed to make sound decisions without over-gathering. Defining the value up front tells you which information earns a place in the process.
Want to see how modern GRC pros put ideas into practice? Read our most recent story with Christina Kostock, Global Compliance Program Analyst Supervisor at McDonald’s.
Frequently Asked Questions
Why Does Business Context Matter in Risk Management?
Risk can’t be properly quantified until you understand how the business runs. Technical skill and general risk knowledge don’t show what could happen to a specific organization. Mike Arnesen’s advice is to learn the business first.
What Does It Mean to “Look Around Corners” in GRC?
In GRC, looking around corners means studying emerging issues early instead of reacting after they land. Mike Arnesen wants his team to face problems “long before the train arrives at the station,” which requires time away from day-to-day tasks.
How Do You Bring Separate Risk Programs Onto One Standard?
Start with a shared review process and shared standards. At Ralliant, Mike’s team has been moving third-party and security risk management across a parent company and its sub-organizations onto the same approach. Along the way, the team strengthened standards from each group.
How Much Information Should a GRC Program Collect?
A GRC program should collect only the information that supports sound decisions. Mike says to keep the effort commensurate with the value, because over-collecting burdens teams and creates friction that limits how often people use the program.
Where Can AI Help Most in Third-Party Risk Management?
Mike Arnesen points to routine follow-up work: contacting people, managing findings, and chasing vendors. If AI takes on that work and returns the information, GRC teams can focus on synthesis and on explaining current risk to executives.
