In this Q&A, Full Disclosure author Eric Krell asks CA Director of GRC Programs Sumner Blount to define "risk IQ" and to share some of the qualities he has witnessed in risk intelligent organizations.

Throughout this recession, small companies have suffered -- and, importantly, continue to suffer -- more intensely than larger companies. The suffering, which takes the form of late accounts receivable (A/R) payments and higher days beyond (payment) terms (DBT), poses a risk to small and large enterprises alike.

Even though execs are aware of major data breaches, like those at TJX Companies and Société Générale, many aren't working to control risks in their own companies. Brian Cleary, a vice president with Aveska, explains the importance of data breaches and information security risks and provides suggestions on how companies can address the problems.

Do you know what a specially designated national (SDN) is? More important, do you know if you are doing business with one of them? If you're a GRC professional at a company that conducts any sort of international business, you ought to or you could run into trouble with the Office of Foreign Assets Control (OFAC).

Exception management -- the process by which people respond to the information that GRC technology spits out -- enables the organization's investment in GRC technology to generate valuable returns when executed correctly. However, if exception management is ignored or botched, and it often is, the technology and the entire GRC program can falter.

Will manual journal entries, which are a key component in the financial closing and reporting process for the foreseeable future, become a riskier component of the financial process when we move to the principles-based standards of IFRS?

Three U.S. utility companies, including Exelon and Pacific Gas and Electric, have canceled their memberships in the U.S. Chamber of Commerce in response to the powerful pro-business lobbying organization's stance on climate change.

What does materiality mean when it comes to fraud? Accountants often use a "5 percent rule" to determine materiality -- meaning investors would not be unduly influenced by changes in net income or income statement line items that are under 5 percent -- yet other statutes and regulations have almost zero tolerance when it comes to determining what is material. How should companies determine what is best for them?

Which is more important to the success of a GRC program -- culture, funding, or processes/technology? Bob Tizio, governance, risk, and compliance officer for SAP Americas, says "They're all equally important," He adds, "I think you really need to have the right culture -- the right tone at the top -- or else you're not going to get the funding, the people, or the technology you need to move forward."

According to a new survey, nearly 45 out of 50 European-based GRC executives (including those from Barclays, Lloyds, and Swiss Re) expect their companies' GRC technology spending to increase or hold steady next year.

Here's the bad news: fraud happens everywhere. The media tend to focus on public corporations, but fraud also crops up in nonprofits and the academic world. One area that's increasingly becoming a problem is federal grant fraud in academia, as documented by Fraud Magazine. Here are some ways to get it under control.

Global investors are demanding stricter corporate governance and compliance requirements for publicly held companies. Read this white paper to learn more about the issues, new principles, and technologies underlying these new requirements.