What if the way we manage risk is actually preventing us from seeing it?

Welcome to the Global Insider Threat Awareness Month 2026. This year's theme is Where Trust Meets Risk. Trust is fundamental to how every organization operates, but every time we extend trust to people, partners, or relationships, we also create opportunity. And with that opportunity comes exposure. To explore that relationship, I'm delighted to be joined by David Turner, partner of Carter Consulting and Chief Executive Officer of Risk New Zealand. David brings more than 30 years' experience across risk and leadership, beginning with his service in the Australian Army and extending across government and the private sector, with a particular focus on one of the most complex and often overlooked areas of organizational risk, and that is human behavior. David, welcome to GIDM.

Hey, thank you, Boaz. It's great to be here and always great to have a chat with you.

Great. So before we get into the discussion, perhaps you could briefly tell us about your background and what has shaped your perspective on risk and human behavior.

Oh, look, great question, Boaz. Look, I was always interested in human behavior since I was about 5 years old. I was always kind of looking seeing why teachers did what they do and everything else. It was always kind of an interest. And then long story very short, joining the Australian Army years ago and having a, you know, a very good productive time in the Army and then going to a level where we're in a recon team, we deployed and kind of using everything we learned is what I then brought to business afterwards. And what we learned was really a lot about human behavior. It was about how to influence. It was about to win hearts and minds. And everything was about risk management, even though we ever hardly said risk management. So that was the background that I brought into business.

Interesting. So from what you see today and what we're seeing, the complexity in the risk landscape, from your perspective, what are the most significant risks facing leaders today?

Oh, look, another great question. What is the biggest risk? Business risk we see is the speed of the world, really, how everything's happening, how we need to constantly adapt to things that are changing, whether it be economically, environment, everything else around that. So what it is facing leaders today is learning, learning about their own organization, learning about the forecasting, what's coming up. And the big underlying thing here is risk management. Have they got it sorted? Do they know their own their own people, their own teams, actually where they're heading. So in a nutshell, learning and a lot of learning, I think, is really, really needed.

Interesting you say that. So do you believe then that insider threats are receiving the level of executive attention that they deserve? Or are they still sort of underestimated as an organizational risk? Because you mentioned so much about learning, what is missing? In terms of their—

Yeah, I mean, working with probably 200 organizations in my time in business and probably 1,000 people and hundreds of teams. So drawing from that and always looking at consulting now, no, I think generally it's being treated as too boxy without considering what else may be there. So look, this is where business usually fails, doesn't do well. It's from that assumption. and not enough digging into exactly what's going on. The successful businesses are the ones who dig deeper. They challenge themselves and they say, hey, are we looking hard enough and making sure that we know our organizational risks? Not having a report, not having relying on, say, one source, but actually getting involved in that and asking the hard questions.

Interesting. What do you think about whether organizations view insider threat primarily as a sort of a security issue rather than as a business or leadership issue. I'm just interested in your thoughts there.

Well, on question 1 about everything moving so fast, we have to adapt and there's many more risks and threats like AI, cyber, and we'll probably touch on that later. And security used to work, you know, pretty well years ago. You know, what happened to the security box? They'll tell us inside of threats, we might have investigators or whatever. But now with that hat on, that level of expertise just at security level can be quite restricting, especially when looking at the whole organization and everything we have to look at now. So it's a topic which now needs its own meetings. It needs to be impartial. It needs outside advice, which is good advice, and a much higher level of risk thinking. So again, it's coming back to understanding our organization really, really well and understanding what could cause those insider threats.

Interesting you say that. From your perspective, we know the fundamentals, and as I started saying right at the beginning, that trust is sort of the baseline, the core part. But how do you see from your perspective that leaders think about the relationship between trust, organization, and organizational exposure and risk?

Yeah, I mean, at the end of the day, how much trust should we be giving to the organization? And I think it depends on how much trust and positive influence we've actually attracted as leaders and what we've done in that. The more we have people who are influenced in the right way, who trust us enough, who are working with us, good communication, good leadership, then we can put more trust in it because the risk is lower. When trust is low, there's more data shared, maybe it's not cared for as much, the risk goes up. And we don't have then a good focus, like our question prior to this, on exactly what's going on in the organization. So, it's a really good question.

Yeah. So, when you say when trust is low, you mean there's a lot of suspicion. Would that be correct?

When trust is low in the organization, then the respect goes down. And when the respect goes down from employees, staff, contractors in the organization, what I've seen, in my own opinion, but I'm sure many would agree, is that not enough care is taken with information. Not enough care is taken, or care is wanted to be taken, for working for the organization. And then when people are starting to look around at maybe other opportunities, or they're starting to talk to other people, that's when you can start having risks in there. And that's how trust can erode that information and erode the organization.

Now, we talked earlier before we started recording, you mentioned about your Perth situation or the story about when you were in Perth. Can you sort of elaborate to the audience what you mean by that? That would be very interesting.

Yeah, sure. So leaving the military, working for government corporate for a while in Perth, starting my own company, then having partners in that. We won some big contracts. And so, these big contracts were, you know, they're pretty big, pretty overwhelming. So, we had to have up to about 100 contracted staff on the ground doing various things from enterprise risk management to security to safety and everything else. Now, that means there's a lot of leeway for risk and issue. Yes. So, my partners and I went into this going, why don't we do a really big experiment, make it work, and have this organization have great relationships with everyone who works with us and for us? Why don't we try and make it more of a family environment? And why don't we start giving rewards, not monetary, but rewards and recognition for people when they do great stuff. And the biggest thing being CEO, I need to get out there, I need to be a presence, and I need to do what we're going to say we're going to do. And so we did that over a period of 3 or 4 years. And what we noticed was the retainment of staff was about 30% more, the success of our contracts had gone up about 40-50%. Our risk and issue had come down a whopping, say, 65% compared to other companies doing what we were doing. And the biggest, the biggest day was when we stopped trading because we'd finished all the contracts where we're going back because we started that company for one reason, to do a bunch of work over 5 years. As one of the employees came up and said, you know, it was like working with a family. And that's exactly what we want here. So look, it, it wasn't hard. We just took the time.

Interesting you say that. So let me ask you this question then. Traditionally, Risk management often focuses on known risk. So from your perspective, do you think organizations spend enough time understanding where they're most exposed?

No. And look, I'm gonna be really frank here after being in risk for more than 30 years every day. Traditional risk is becoming more of an issue. So traditional risk management is becoming the issue because we can't look at one thing. We can't have a risk register or a heat map or something else. That's all very good and we need them, but we We must think much more laterally, much deeper. And so we must train people in the organization, make risk management a habit, and stop that restricted thinking. Because when we have restricted thinking and we put risk into boxes, that's our biggest exposure because you're not looking at everything. And in my fair opinion, we're 29% there, if that makes sense.

Oh, okay.

We've got a long way to go.

Well, so, so it's a follow-up question, which is, um, how do organizations, from your perspective, uh, when looking at risk and they aren't able to identify the actual risk, so it's not part of the risk register now, how do organizations look at that from an exposure? So it's, it's managing unknown risk. And in some ways, that exposure, that vulnerability is not known, given the changing environment, given the change, like, you know, AI and, you know, the global workforce, where people are working remotely. We've got supply chains, we've got trusted partners. So everything is changing so quickly. So the way I see things is threats are evolving, risks are evolving. And a lot of the cases that those risks are not even captured, not even identified. So I'll be interested to see what's your perspective of how do organizations look at risk or unknown risks?

Yeah, and look back to my consulting days, which are still going on. Organizations can very quickly, from the board to the SLT, the risk management team, get very focused and start getting quite channeled and start missing risks. So they've captured all their risks, they're doing the annual report on their risks, they're getting everything in there, but have we got everything? And the most effective way I've seen it, and we used to do it in consulting, is getting the key people in the room for a day, getting a whiteboard and going, okay, we've got these risks. What else is there? Now, when we start discussing, when we start getting that creative edge on it, when we start really understanding the organization, where it's going, the strategy, the alignment, you'd be amazed what comes out and hits that whiteboard. Sometimes we've ended up with 20%, 30% more risk and issue, but also good stuff that we didn't know was there. Yes. And it can be really, really enlightening. And you know what the simple thing is here? Getting people in a room around a table and having a chat. And that can change absolutely everything. So to answer your question, yeah, I would confidently say we're missing at least 20 to 30% of our real risks by keeping it that channel.

Yeah, look, key point you just mentioned there. So having said that, so how can boards and executive teams improve the way they think about insider Threat-related or risk or organization exposure?

Oh, look, make it a focus, not just an end report or something that comes in from a consultant. Make it a focus. Yeah, also learn how to make it a focus and how— what they're looking for. Many boards rely on their own expertise, which is great, but we don't know everything. Normal director courses, we rely on that, but there's a lot that could go into them, especially risk management, especially insider threats, and especially at level Thinking we're talking about today. And generally need to listen more, enough to the actual experts. And the biggest thing I see that kills a lot of this in working with boards in my career and doing it now is groupthink. So, with groupthink, you can have positive and negative. If we've got negative, you'll find some of the board are following the popular vote or some of the board aren't engaging.

Yes.

Or some of the board aren't actually getting into the alignment of the organization. So, again, it's make it a focus. Learn more and we don't know all.

Interesting. So as I, you know, I just touched on it before, as organizations become more connected through AI, third parties, digital ecosystems, how do you think the nature of organization risks is changing?

It's changing fast and I think it's going back to the second question and It's really risk management is lagging behind, and it's the trust, awareness, training of all staff creates really a better understanding of the organization. We've got generational issues too coming through, and people have different perspectives from younger generations who might view risk in different ways. We've got AI, so we've got shortcuts, we've got fast wins that creates risk in some areas.

Correct.

I think one of the areas that can come in is probably more mentoring, more experience, and getting people on board to mix with not just generations, but the way that organizations have to adapt very quickly today. So what we're missing here is our thinking. We're not stopping and thinking enough. We're reacting and we're doing what we think we need to do every single day.

Yeah, let me ask you this side question. Um, the, the, the relationship between internal, like you can talk about like a perimeter between internal and external, now it's sort of dissipating or disappearing. And so, you know, traditionally staff would come and turn up in the organization. Now they work from home and so forth. And that relationship between what was once considered everything inside now has sort of gone into the global side of things. So interesting, your take in terms of trust that, you know, we trust our employees, we trust the staff and so forth. But now, you know, we are connected to everyone. I'll just be interested to hear your thoughts about that.

Here we are. And it used to be a lot easier, I guess, when everyone was in the organization, no one really working from home. Now everyone's spread and they're spread globally. We have to up our game on risk management. We have to up our game on the cybersecurity.

Yeah,

the way that we approach talking to clients, relationships, anything like that. It's a whole other way of looking at risk. Yeah. Another whole percentage that we have to do, which we're not doing well yet. And a lot of that also comes into inductions, training, and making sure that when they're— when the people are coming to the organization, or even refreshing the ones who are already there, that we exactly know what we need, how we're going to get it across, and we have a measure for that. And one way I find organizations, so they don't have the right things in place, but they are expanding what you're talking about, There's no measures and there's no KPIs to make sure we're keeping it as boxed as possible, but also keeping people safe.

Yeah. So you talked about stepping up. So looking ahead for the next 12, 2 years, 5 years, what changes do you believe organizations need to make better decisions, better related to managing risks such as insider threats of, you know, Over the next 5 years?

We need to become more nimble. We need to change governance structures, a lot more agile in thinking. We're not doing that yet. And we need to start losing that groupthink. We need to start making sure people are challenging, asking the right questions, but they're trained enough. We need to redefine boards. And really, we need to redefine how we're leading because everything now has to step up and say another 15-20% quicker. But the biggest thing here is that if we have an aim in an organization to make sure we can adapt as quickly and as best as possible when something happens. It's really not that difficult. All we're doing is taking another approach. So we've been, you know, it's been proven over the past 10 years that economic, environment, whatever disaster and crisis is not going to go away, and it's just going around and around. Yeah. All we need to do now is align to that and make sure we're ready as possible and we're aligning to what those things might happen in the future with the forecasting. That's what we need to do. Where we will lose and where it won't happen, and getting back to your question, is if we don't do anything but we do the same thing we did yesterday. Already we have an issue.

Correct. Side question, how would you think we, looking from an organization-wide capability involving different leaderships, whether it be risk, HR, security, intelligence, technology, and so forth,

So how can we improve that going into the future?

Yeah, because, because you've probably seen, well, being in the, in the risk game, is you may see that organizations are particularly silo-based. So I would have thought that one of the things that organizations need to look ahead is how do we get integration but also make it organization why that involves different functions of organizations?

Yeah, brilliant question. Look, we did this with one example with Risk New Zealand. So what we did when I went in there and took the position as CEO, we're across, you know, a few industries. That's about 65 industries all up. And what we did there was when I first joined, it was risk management, you know, that was the risk team. Or the board did a little bit over here, or someone did a bit over there. We smashed through that saying that everyone does risk management on some level, everyone in the organization.

Yes.

And it was quite interesting when I would approach when I was consulting, say HR or a legal department or what it might be, they said, oh, we don't do risk management, that's the, that's the risk team. And I would enlighten them and say, well, actually you do risk management every day. So that's taken about 4 or 5 years But now we're starting to have that. And with that, organizational risk is coming down because people know that they have their own risks. They know how to report it. And they see a lot more because it's becoming a habit. So we are getting there. But if it's in essence, the simple answer, make sure everyone knows they do risk management.

Interesting. Yeah. It's like, you know, everyone should know that they do security management rather than leaving to the security team. But coming to the last question, if you could leave boards and executive leaders with one piece of advice during the Global Insider Threat Awareness Month, what would it be?

I would say, just know we're all human. And because we're all human lies the immediate risk and issue. Once we understand this more and we can change that and make sure that there's the gaps, the challenges are filled because we can only do the best we can. We don't know everything. That is the biggest thing. We don't know it all, especially from the board level down. So probably about halfway there. I said 29%, halfway there is probably ambitious. But what we need to do is get good advisors. And if you look around there, there's consultants who do almost anything and they can advise really well. So we've got a big tree there we can pick from for good information, good advice. We've got to use that. We've got to get the external view.

Correct.

And also we need to use our networks, making sure we get the best from them. And we need to treat people with respect, listen, and make sure that we are understanding our organization inside and out. And now that is the biggest way to manage risk going forward.

Fantastic, David. Look, much appreciated for your insights. I very much enjoyed it. I'm sure the audience will get a lot out of it. And thank you very much.

Well, thank you, Boaz. Always a pleasure.

Pleasure.