According to the Risk in Focus 2026 report, organisations in Southeast Asia correctly rank cybersecurity, business resilience, and digital disruption as their top priorities. Yet, with cybercrime losses in Malaysia crossing RM1 billion, there is a glaring gap between risk awareness and real-world preparedness.

BFM explores this "implementation gap" with Suhailah Abdulla and Philip Satish Rao from the Institute of Internal Auditors Malaysia. They argue that risk policies often look good on paper ("form over substance") but fail because organisations treat cybersecurity as a backroom function rather than "organisational DNA."

We also discuss why Internal Auditors must evolve from financial checkers into "nervous system sensors" for the board, and how to navigate the specific dangers of "Agentic AI" while keeping humans in the loop.

We discuss:

The Preparedness Paradox: Why high risk awareness hasn't translated into fewer breaches, and the danger of "compliance on paper" versus actual implementation.
Cybersecurity as DNA: Why treating cyber risk as IT's problem is a fatal error. Philip gets into the need for adaptive controls that evolve as fast as the hackers do.
AI Governance & "Human in the Loop": How to balance the opportunity of AI with the risk of "Agentic Enterprises." We discuss the necessity of establishing governance frameworks that prevent over-reliance on algorithms.
The Auditor as "Nervous System Sensor": Moving beyond the independent mask. Why modern auditors need engineering and supply chain skills to provide true risk intelligence to the board.
Interconnected Risks: Lessons from COVID-19 on why siloed risk management fails, and why boards must view supply chain, geopolitical, and digital risks through a single Enterprise Risk lens.