Neal

Governance, Risk and Compliance Insights

[Bull Theory @BullTheoryio]

This 88 year old Japanese trader spent 40 years day trading and turned $387,000 into a $14 million portfolio.

If he had simply bought the S&P 500 in 1986 and done nothing, he would have over $21 million today.

[Neal @NealScott_]

@tuuu28283 Onsen
Nihonshu
Ramen and all other food
Konbini
Izakaya
Everything Japanese

[Neal @NealScott_]

@harukaawake 1% with very selective, high-skill, assimilable inflows.

[Neal @NealScott_]

https://t.co/v9bYMfCyIF

[Neal @NealScott_]

@ONRYOUonsen 😄

[Neal @NealScott_]

Hot take after almost 20 years in GRC:

Throwing an AI agent into a financial process doesn't just automate the work — it turns the AI itself into the actual control.

And any real control needs proper design documentation, evidence that it's working as intended, access reviews, change management, and a solid process for handling exceptions.

Your AI team probably isn't thinking about any of that… and your audit/risk team has no idea where to even begin.

That’s a pretty big gap

[Neal @NealScott_]

Your company deployed an AI agent that approves purchase orders. EY just walked in requesting PBCs for the SOX audit.

"Show us the controls over your automated payment approval process."

Nobody has an answer.

This is happening right now. AI agents in financial systems = SOX controls. Most companies have zero documentation.

https://t.co/ZxYZS1cks6

[Neal @NealScott_]

@AtsushiOkinawa I'll be visiting Okinawa again this year. Can't wait!

[Neal @NealScott_]

https://t.co/yQrUNskzAR

[Neal @NealScott_]

Hot take: Most companies don't have an AI risk problem. They have a "we deployed AI without telling GRC" problem. Same energy as shadow IT in 2010. We know how that ended.

[Neal @NealScott_]

2026 is the year "point-in-time audit" dies. Continuous assessment. Real-time monitoring. AI-powered compliance.

The annual SOX audit isn't going away — but the idea that you only check controls once a year is Dead, imo.

https://t.co/y0S0WDcZmd

[Neal @NealScott_]

The U.S. just released a federal AI framework calling for unified national regulation.

State-level patchwork → preempted.
Child safety, IP, workforce impacts → all on the table.

If you're doing compliance today without an AI chapter, you're already behind.

https://t.co/Deo6DL4A1F

[Neal @NealScott_]

Insurers are now factoring in AI governance maturity into D&O underwriting.

Your board's AI oversight posture is literally affecting your premiums.

GRC isn't a back-office function anymore. It's a balance sheet item.

https://t.co/0wP1jOn3qi

[Neal @NealScott_]

Agentic AI is already browsing the web, sending emails, and taking actions on your behalf.

Most companies have zero governance around it.

That's not a tech problem, it's an audit finding waiting to happen.

https://t.co/Kp4srpqmpQ

[Neal @NealScott_]

@Parsonalsecret No

[Neal @NealScott_]

@sakegorilla Sake is wonderful, especially Namazake 🍶

[Neal @NealScott_]

https://t.co/tDGxwALQHu

[Neal @NealScott_]

The EU AI Act's August 2026 deadline for high-risk AI systems is five months out. Most financial sector firms still don't have a complete AI system inventory.

That's not a compliance gap — it's a governance gap. The clock is running.

https://t.co/6MHcguWvbO

[Neal @NealScott_]

AI agents are coming for SOX compliance testing.

Continuous control monitoring beats point-in-time sampling every time. Internal audit teams that treat this as a threat instead of a tool will fall further behind an already impossible workload.

https://t.co/URIKi2UZCK