#459 - The Three Lines Model for Identity Practitioners with Autumn Hurley

Jim McDonald flies solo this week while Jeff Steadman is out on assignment, and he's joined by Autumn Hurley, Cyber Risk Consulting Principal at RSM US LLP, for a practitioner's crash course in risk management frameworks and the three lines model. Autumn shares her path from marketing and banking to running offensive security operations and now leading RSM's cyber financial services team. From there, she and Jim unpack the vocabulary identity teams hear constantly but rarely get explained: likelihood, impact, risk appetite, controls, and the difference between a policy, a standard, and a procedure. They cover what GRC tools do, how frameworks like NIST CSF, ISO 27001, COBIT, and COSO apply, and the warning signs that compliance has become a checkbox exercise. Autumn then walks joiner-mover-leaver through the first, second, and third lines, explains where external audit fits, and offers practical guidance on translating an identity project into the risk language executives, auditors, and boards respond to. The episode closes with home remodeling advice and a contractor story Jim would rather forget.

Connect with Autumn: https://www.linkedin.com/in/autumnhurleyatrsm

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome and upcoming events

02:20 Why this episode: risk and the three lines model

03:36 Autumn's non-traditional path into cybersecurity

05:12 From pen testing to risk and governance

07:18 How her perspective on risk has changed

08:18 What is risk management?

10:07 Risk concepts every identity practitioner should know

12:52 Business, technology, and identity risk as a pyramid

14:28 What is a control?

16:05 Policy vs. standard vs. procedure

17:56 Control design vs. operating effectiveness

20:05 What is a GRC tool?

21:36 Who creates risk and control frameworks

23:07 NIST, ISO 27001, COBIT, COSO: what you need to know

24:24 Keeping compliance from becoming a checkbox exercise

26:16 The three lines model explained

30:19 Where external audit fits

31:38 Joiner-mover-leaver through the three lines

34:04 Can auditors rely on IGA and SSO data?

36:09 Why the lines are blurring

37:50 The IT risk function as internal advisor

38:46 Preparing for risk conversations with senior leaders

40:40 Translating an identity project into risk language

42:36 Key terms for talking with risk, compliance, and audit

43:56 Autumn's key takeaway

45:38 Remodeling advice and a contractor horror story

49:37 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Autumn Hurley, RSM, risk management, three lines model, three lines of defense, cyber risk, risk management framework, controls, control effectiveness, policy, standards, procedures, GRC, governance risk and compliance, NIST CSF, ISO 27001, COBIT, COSO, internal audit, external audit, risk appetite, risk tolerance, likelihood and impact, joiner mover leaver, JML, user access reviews, IGA, identity governance, privileged access, financial services, compliance, IAM, identity and access management