When Insider Risk Becomes Strategic Risk

Welcome to the Global Insider Threat Awareness Month 2026. This year's focus is where trust meets risk. Trust is fundamental to how every organization operates, but every time we extend trust to people, partners, or relationship, we also create opportunity, and with that opportunity comes exposure. So to explore that relationship, I'm delighted to be joined by Tony. Charge, President and Chairman of the Australian Risk Policy Institute. Tony has spent many years working across the public, private, and community sectors and is so co-founder of the Australian Risk Policy Institute. His work has focused particularly on challenging conventional approaches to risk and exploring the relationship between leadership, strategic risk, and informed decision-making. So, Tony, welcome to GITAM.

Thank you, Boaz.

Excellent. So before we get started, perhaps you can briefly tell us about your background and what has shaped your perspective on strategic risk.

Going back to the first professional course in risk management with Monash University, Michael Vincent, the faculty head, and I looked at the content and decided that we needed to add policy and strategy to thinking about risk management.

Yep.

So, from that, we launched the Risk Policy Institute, which has adopted a different approach to risk in terms of meeting today's needs, which are very different to, say, 15 or 20 years ago. When risk management was designed.

Yep. Yep. Okay. So from your strategic risk perspective, where do you believe organizations are facing the greatest uncertainty today?

That's a good question. And I think the answer is that uncertainty can be removed. And the greatest uncertainty at the moment is fingers crossed, hoping nothing happens.

Correct.

When you add plausible deniability to that, nobody told me, I didn't know. And we're relying on a risk register, which is reactive risk management. No further information came in. So we're clear, but the uncertainty is they don't know. And we draw from the Financial Royal Commission where the commissioner said boards and executives need to be trained

and

fault and liability is no longer applicable.

Yeah.

And then followed up by questions such as, Have you made all reasonable attempts to find out the evidence? So at the moment, insider threats, internal integrity risks are really self-imploding in terms of uncertainty. They don't know. Most organizations we've worked with, government, corporate, large organizations, are relying on the old approach.

Yeah, which leads me to a side question. So let me get it if I've got it right. So you're saying the organizations are finding it more difficult to recognize uncertainty, or they're just ignoring it completely?

I think it's a bit like Alice in Wonderland. If you don't know where you're going, it doesn't matter how you get there.

Yes.

The essence of today rests on 2 pillars. We're now interconnected internally and externally like never before.

Correct.

We need to get information from those networks. Previously, under risk management, people waited. First of all, a focus group, think up some risks, put them in a risk register and review wait for information. We need to today develop and introduce means to identify our vulnerabilities and exposures. That's the difference rather than managing risks, identifying exposures and vulnerabilities within organizations.

Correct.

Protecting against them. So that's the first part. The second part is when executives and boards have received through their internal and external networks sufficient information, they can then examine where do we need to protect against those exposures. So a completely different proactive approach rather than reactive.

Yep. Yep. I agree. You know, one of the things that I've often seen is a lot of organizations look at insider risk as a technology issue or a problem rather than a strategic organization risk. What do you think, or how do we change the perceptions so that it is not seen just as a technology problem?

I think your opening words, Boaz, in terms of leadership and culture, you know, leadership is about personal skills. Trust is number one.

Yes.

Professional skills and crisis skills. It's that last one, crisis skills that are missing. So an organization's governance, integrity, culture rests on leadership.

Yeah.

Yep.

So

rather than saying, I wasn't told, I didn't know, We have systems in place. The change now is to search, to develop new approaches within an organization. A colleague in a large IT firm internationally discovered there were some concerns within. So she quickly identified the key internal network where things could happen.

Yeah.

And looked at the exposures, vulnerabilities, and then the consequences. It's the essence of risk today. Strategic risk is about information, identifying exposures, and protecting against them. That then moves the risk management or crisis aspects.

Yeah. So why do you think the insider-related risk continued to receive less executive attention? I know we've spoken a lot a lot about the two of us, uh, on the side, but I'm just sort of keen for, you know, for the viewers to understand your perspective.

Yes, I think, um, again, one of the pillars from the Royal Commission is those magic words: do you have evidence?

Yes.

Of making all reasonable attempts to find out? Could you have known? Should you have known? Is your board trained? Are your executives trained?

Yeah.

Comes back to culture, a risk culture, but not reactive, not a quarterly review of a risk register. And in the public sector, of course, the federal public sector, there is the Public Governance and Performance Act holding senior executives to So the argument is simple that if the Financial Royal Commission looked at the corporate sector, governments, plural, shouldn't be any less.

Yes. And, you know, trust is so important to everything we do. How should leaders think about it from a perspective of relationship between Trust, strategic risk, and organizational exposure?

They're probably all one and the same. That it's critical that we work forwards, not backwards.

Yes.

This is a change that's needed in leadership paradigm.

Yes.

And we need the leaders who are responsible and accountable. Trust within the organization governance and then that will flow through.

Yeah,

it's the absence of insider threats, internal integrity risks come from action or inaction.

Correct.

So if you have a lot of light in an organization, You have less darkness.

Yes.

Yes. So from the point of view of practicing, an organization, large organization, for example, should have a regular newsletter across the organization. There should be a message in there to start with from the chief executive or secretary promoting the culture.

And yeah, yeah. Yeah, very interesting. Keep going. Sorry, keep going.

And from the point of view of changing from the old approach to what works now, I think the Gandhi change leadership message, we need to be the change you want to see. Yes, staff will respect leaders who promote governance.

Yes.

And adopt a new way to be proactive rather than reactive.

Yeah. So that was gonna be my side question, which is basically, at what point do you think trust itself becomes something that maybe leadership needs to govern rather than simply assume?

That model we use to promote in terms of personal leadership skills, professional skills, vision, governance, strategy, and crisis demonstrated. When something goes wrong, it's the leader who must appear publicly and internally to lead through that.

Yep. Yep.

Whereas at the moment, there is often an assumption someone else is responsible. And

yes,

blame comes, blame the environment. Because today we'll have problems in human systems, in IT systems. We published recently on the troubles that Telstra is going through in great detail. And I think some of the case studies like that are good lessons for everyone to look through and say, well, If we had adopted this approach, we might have seen it rather than have to react and explain why it happened.

Yeah, yeah, yeah. Do— I mean, from your perspective, do traditional enterprise risk frameworks adequately capture insider-related exposure, or is there something that they need to think differently?

I think there's a completely new landscape in terms of risk today.

Yes.

There is what we're talking about in terms of vulnerability and exposure.

Yes.

Consequences and needing to look and identify that through a strategic policy approach.

Yes.

Risk management is where people sit. And on the right-hand side of that landscape, are live issues, crises.

Yes.

Wicked problems.

Yes.

We need to move the whole spectrum of risk from the live issues, reactive crises, trying to manage risks identified through focus groups.

Yes.

Work on real intelligence, which is garnered through that internal and even external system to look at exposures and vulnerabilities. What if this happens? This is a critical part of our whole system. If that fails, the trains go out, the ATMs go out, etc. So today, it's a different perspective to look at the consequences And the exposures.

Yes, very interesting you say that. How important is leadership then and organizational culture in reducing insider-related exposures and, and, and, yeah, and, and associated, you know, impact?

Yeah, the term I use for that, you know, is direction and connection.

Okay.

Okay. we need direction at all levels of leadership.

That's true.

Across the organization, that direction must be there, but there also must be connection. So it's not a case of just a communication strategy or saying connection management by walking around is still a great context, whether it's walking around an office or walking through Zooms and podcasts and the like, that connection is critically important. Correct. In looking at the cases we have where there are internal integrity risks, connection has been missing.

Oh, very much so. Very much so.

In one case where we were in a large organization on internal integrity risks, And a great group of people, highly skilled, knowledgeable, cooperative team. And question, who was aware of the incident that occurred yesterday? Yes, your regional offices.

Yeah, correct.

Unfortunately, there was no connection at all.

Correct. And that goes again to the culture of the organization where it's maybe safe to report and, and so forth. So that a lot of the challenges that I see within insider risk is that functional collaboration between the different functions of, of an organization. So you could have intelligence or visibility in certain areas, but They're not being shared.

Yes, I think focus groups tend to be very technical and within certain silos within the organization.

Yeah. Yeah.

But a good way to move forward in terms of identifying vulnerabilities and exposures is to follow a mixed group. So choose people from across the organization, at different levels and different functions, almost a tangent and workshop then where do we look. So again, I think new methods are needed. The old approach lacking direction, lacking connection and hoping doesn't work.

Yeah. Now, earlier on, you talked about the internal and external, how they're integrated. I'm going to add another thing, and we've talked about it quite a bit around AI, but another thing I want to talk about is include third-party relationships, supply chains, the sort of global, you know, employees and people being able to not just having to work internally but remotely. How's the strategic risk lens changing from an insider perspective, from your, from your view?

You've hit on 2 very important areas. And AI, of course, is in the media every day now. We in ARPI have been working on a complementary human-centric intelligence program in areas that AI doesn't cover. Importantly, decision-making. And therefore governance, culture, exposure, vulnerability. Those areas aren't basic to AI.

Yeah.

Processing at super speed data and information within a box.

Yeah, correct. Yes. Yeah.

Cannot see the totality of the situation. It can present very good data and great analysis of data, But we need a broader perspective.

Yeah. So are they creating new forms of exposure faster than the governance is adapting to them?

I think that's being recognized now. We've published on that starting in May last year. Okay. With any great invention, governance tends to come second.

Yeah.

And as we're seeing now, almost daily examples of where governance, risk exposure have been overlooked in the rush to develop the technology. So I think the view on AI is twofold. One, we need to address the areas which have been overlooked in terms of governance. And secondly, what we're developing in the human-centric intelligence systems. Yes. which covers the areas of decision-making, awareness, alert, all those things that are relevant to insider threats, will presently, are and will, I think, always remain outside AI because AI is trying to develop human models and human resource approaches.

Correct. Correct.

As Elon Musk said, AI will never be a conscious mind. So our discernment is super brain mind. So it's the intelligence augmentation, the human-centric side, which is where the totality and the foresight and insight. In terms of infrastructure, I think that's another very good example you raised that relying on risks and risk registers, things are continuing to happen. Take, for example, the building at Heathrow that caught fire, one of many. One small fire closed the airport. So it's now a case of looking at risk based in exposure and concern with consequences. So with infrastructure, more— we're working with the Electric Infrastructure Security Council, and more needs to be done in 3 stages. First of all, the strategic risk policy approach to identify exposures against a rapidly deployable education model. Yep. So that if a fire occurs in a building and there are 10 more like it,

Yes.

Sideways and approach it that way. And then, of course, great work which the Electric Infrastructure Security Council does is provide simulations free to government, corporate, academic, professional simulations of black sky earthquakes where they can walk through if something happens, this is how we respond. With infrastructure and global supply chains, timeframe is critical. Some governments are working on 10 years.

Yes.

Others are working on 3 years. Our approach is prioritization so that 10— 1 year, we must focus on what are the critical areas Needed to protect resilience and work on a 1-year timeframe, 3 years at the maximum.

Yeah. I wanna ask you a side question because there's something I've been thinking quite a bit and it's the evidence base, which is basically on that example of the Heathrow you just mentioned, is when presenting evidence to the executives about the consequence And yet nothing happens. So the question is, how do we reframe the— whether it be the evidence, the consequences, the intelligence, the likelihood— so that decision makers, specifically executives, are able to make better informed decisions rather than assume that it's not going to happen?

That question is also a diamond because non-decisions are legally decisions.

Correct.

Executives and corporates are informed and decide to do nothing. They have made a decision and they can be legally accountable for that.

Yeah. Yep.

So critically important, but also in terms of what flows through, you're seeing more of today in whistleblowers.

Yep.

And people report, there is no action, a non-decision, and a whistleblower occurs. And the story comes out, and the situation for the executive or corporates who may have known about that It's far worse. They leave.

Yeah, yeah, yeah. Another question I wanted to ask you, which is now let's assume that executives are looking for some feedback from management to understand how well their organization is mitigating, preventing, detecting, or responding to insider risk. What What should management be able to tell the executives or boards?

First of all, there shouldn't be a gap.

There

shouldn't be a knowledge gap between management and leadership. That's the direction and connection aspects. Basically, the world has changed. We are now more vulnerable in terms of human systems, IT systems,

Yeah.

We have to adopt a new approach. We can't rely and wait on information coming in, because that's what's occurring now, and crises are occurring. We need to change our leadership approach to seek information, to identify where we are, for example, using a part that's 10 or 20 years old. Yes. And go back to examples apart from our website, the Costigan Royal Commission looking, you know, and discovering the dates of birth of certain people were used.

Yes. Yes.

As with over time with salaries higher, consequences greater, The exposure and the consequences are greater. So therefore, the searching must be greater. Not only the searching, but the culture. It's a composite of culture, leadership, trust, and the right approach.

Yeah, which then leads me to this next question. What should governance play in ensuring that insider threats are considered as the sort of the broad strategic discussion, the risk resilience, the management of it all?

That probably goes to a policy decision.

Okay.

Separate from your question, but from our experience in corporate and government, reach out because governments and corporates are busy.

Yes.

And much of the information they need rests in the professional network and the academic network and therefore greater involvement. And we find that's a very good key performance indicator. So,

yes,

when you're invited in and then invited back.

Yes. Yeah, yeah, yeah. True. So, Tony, we're coming to the last question and I always leave ask this question, should I say, if you could leave executive leadership with one piece of advice about managing insider-related organizational exposure, what would it be?

Very simply, change in leadership culture and trust and approach is required.

Okay. So it's got to start from the top. Otherwise, it doesn't work.

Exactly. And staff are keen to learn.

Yes.

Staff are keen to progress and they like to work in an organization with a good culture, good governance, good opportunities.

Yeah. Yep. Yep.

You are whistleblowers.

Yes. Yes.

You are needful.

Exactly. Yes. Tony, again, look, thank you very much. It was a pleasure chatting with you. I've very much enjoyed, uh, our conversation and the discussion. And, uh, thank you again for your time, and, uh, it's a pleasure.

Thank you, Boaz.

Thank you.