# Michael Rasmussen

Michael Rasmussen is a governance, risk, and compliance (GRC) analyst and commentator. Through GRC 20/20 Research, Rasmussen helps organizations assess GRC technologies and professional services, and writes and speaks about connecting risk, resilience, and AI governance to business decisions.

- Profile: https://b2binfluencer.marketing/creators/michael-rasmussen/
- LinkedIn: https://www.linkedin.com/in/mkrasmussen
- Topics: artificial-intelligence, supply-chain, ai-governance
- Based on 11 dated posts, latest 2026-10-08

## Summary

Michael Rasmussen is most useful for analyst commentary on AI governance, risk quantification, and GRC decisions.

- Best for: A GRC or risk-technology software campaign sponsoring thought-leadership on AI governance and risk quantification.
- Not for: Performance marketing, conversion assets, paid ads, demo sign-ups, or fixed pipeline targets.
- Check first: Confirm format, price, availability, audience data, and commercial scope in writing.

### Takeaways

- Buying a platform or completing an audit does not make evidence easy to find.
- A pre-launch assessment cannot show what an AI agent is doing while operating.
- A red heatmap square cannot tell a business what to do next.

## Main ideas

- **AI governance has to run continuously, not at periodic checkpoints**: Rasmussen argues that AI changes between reviews, so governance limited to periodic assessments leaves the important part uncovered. Governance should be ongoing, with visibility into what a system is doing while it runs. In the GRC Insights newsletter, their contribution is titled "Governing AI Between the Checkpoints," arguing that because AI changes continuously, governance has to as well. The same idea appears in a vendor briefing on AI assurance.
- **"Responsible AI" needs evidence behind the adjective**: Rasmussen argues that assurance should start with evidence and attach to business events, not checklist completion. Their briefing notes describe a customer reality: finishing an audit or buying a platform does not automatically make the next piece of evidence easy to find. The opportunity, they say, is to make that work manageable rather than give the same scavenger hunt a new interface. Assurance questions start with business triggers such as a product launch, a significant change, or entering another market, then ask what an organization must demonstrate to move forward with confidence. They put it sharply: "Trust me, I'm responsible AI" is not an assurance strategy.
- **Risk numbers should persuade decisions, not color heatmaps**: Rasmussen argues that risk quantification should express uncertainty in terms that support decisions about investment, mitigation, and resilience, rather than use visual scales that prompt attention without direction. Protection matters, but the business case cannot end at "nothing terrible happened." The same thinking informs how they describe AI: the useful question is not whether AI can analyze more information, but whether that analysis changes decisions and delivers measurable value.
- **AI needs context, clear authority, and human judgment**: In a strategy briefing, Rasmussen argues that AI in risk and compliance needs meaningful context, clear authority, and human judgment—and that speed does not fix a bad process. Their formulation: making a broken process faster does not make it better. The wider argument is about orchestration: a trusted system of record connected to systems of intelligence, action, and configuration, allowing an organization to sense, interpret, respond, and adapt around its business objectives rather than document yesterday's uncertainty. They also raise digital twins as a way to test scenarios and alternative paths to resilience.
- **The risk problem is interaction, not inventory**: Reading survey data from a risk conference, Rasmussen argues that the hard part is no longer seeing individual risks but understanding how they combine and what that means for objectives, decisions, and resource allocation. Threats are converging rather than queuing up as independent entries on a heatmap. They are listening for how organizations connect AI governance, cyber resilience, geopolitical disruption, and third- and Nth-party exposure to the way resources are actually allocated.
- **Governance should be about objectives, and about the risks already in the room**: Rasmussen curates other GRC voices in the GRC Insights newsletter, and several arguments in this edition are distinct from their own. They review Tim Leech's book Mission-Critical Governance, making the case that GRC must move beyond inventories of risks, controls, policies, and assessments to focus on the objectives that matter most. Renee Murphy argues that organizations keep stumbling over risks that are visible and knowable rather than rare. Tim Leech argues that the World Economic Forum's risk outlook to 2035 is missing a critical transformation. Norman J Levine argues that treating AI agents like employees before accountability and oversight have caught up is a governance failure waiting to happen. Rasmussen presents these contributors' positions alongside their own.

## Work to read

- ["Trust me, I'm responsible AI" — an analyst briefing on evidence-first assurance](https://www.linkedin.com/posts/mkrasmussen_grc-aigovernance-assurance-activity-7513656692426014722-9nIq)
- [Konnect 2026 keynote notes: from heatmap squares to risk quantification](https://www.linkedin.com/posts/mkrasmussen_konnect2026-riskonnect-grc-activity-7513730917513859072-hdE_)
- [Konnect 2026 day two: the AI adoption-versus-governance-confidence gap, in numbers](https://www.linkedin.com/posts/mkrasmussen_riskonnect-grc-riskmanagement-activity-7513972555930570753-mki-)
- [Inside a vendor's annual planning day: GRC 7.0 and governed action](https://www.linkedin.com/posts/mkrasmussen_grc-agenticai-operationalresilience-activity-7513655695607574529-GUHu)
- [GRC Insights: the curated newsletter, including Rasmussen's own AI governance argument](https://www.linkedin.com/posts/mkrasmussen_grc-insights-expert-commentary-that-activity-7513705682643357696--t4w)

## Brand relationships

- **GRC 20/20 Research** (disclosed_partnership)
- **lextrace** (mention)
- **Battleground** (disclosed_partnership)
- **Riskonnect** (disclosed_partnership)

## Partnerships

No public partnership or sponsorship program, rate card, media kit, or application route for Michael Rasmussen or GRC 20/20 Research appears in the posts, so format, price, and availability remain unconfirmed. The posts show how they work with GRC technology and services vendors: taking an analyst briefing with a vendor team (lextrace), bringing an outside-in analyst perspective to a vendor's annual executive strategy day in Australia (Battleground), delivering conference keynotes and recording podcast conversations at a vendor event (Riskonnect's Konnect 2026 in Denver), and publishing commentary that ties that market contact back to business decisions. The posts do not say whether these engagements are paid, sponsored, or open to inbound requests. A GRC software company proposing a thought-leadership webinar should ask directly about scope, deliverables, exclusivity, rights, timing, and fee; the posts do not support quoting a specific package.

## Alternatives

- Waseem Samaan, CPA, CIA: Book Waseem Samaan instead when the webinar is aimed at internal audit, SOX, and fintech or payments risk teams, and the sponsor wants a practitioner who can speak from inside audit, risk, and governance functions rather than from an outside analyst's market view. Samaan's posts connect internal audit's evolving role to AI, cybersecurity, third-party risk, regulatory expectations, and business transformation. They also draw lessons from a payments and RegTech forum about real-time risk visibility, AI as control and risk, and compliance working with product rather than as a checkpoint. Samaan is a better fit if the sponsor's product story is about audit transformation, integrated assurance, or controls across financial services.
- Jess Mand: Book Jess Mand instead when the webinar is closer to an editorial interview or article-led discussion, and the sponsor wants a host who can draw out a customer CIO or data leader rather than deliver an analyst keynote. Mand's posts show them interviewing Arron Lamp, CIO of Tokio Marine HCC, about AI governance when rules are still being written, and Pierre Bourgeix, CEO of ESI Convergent, about why data architecture determines who wins the AI race. Mand is a better choice if the campaign's value is in structured conversation with a sponsor's customer or technical guest, and the audience needs AI governance and data readiness explained through those voices.
- Michael Brooks CISSP, PMP, MBA: Book Michael Brooks instead when the webinar is centered on cybersecurity assessment, control effectiveness, and accountability after a breach, especially for a public-sector, defense, or critical-infrastructure audience, and the sponsor sells assurance, validation, or continuous monitoring. Brooks's posts argue that continuous cyber resilience must be proven with continuous evidence that controls work; that a breach involving unencrypted personal data raises questions about ownership, safeguards, authorization, and verification; and that exposed information cannot be made secret again. They also show Brooks writing as a veteran potentially affected by the Pentagon breach, giving the session a personal accountability frame that a market analyst cannot replicate.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/