Podcast S8E14 | Embedded Supervision with Susannah Hammond

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Women Radio, today’s risky woman is no stranger to Risky Women Radio, with over 30 years of wide ranging compliance, regulatory, governance audit and risk experience in international and UK financial services and technology solution providers. She’s a chartered accountant and a chartered fellow of the Chartered Institute for Securities and Investment. She’s also the co author of Conduct and Accountability in Financial Services, a Practical Guide published by Bloomsbury professional which is on the reading list of several professional exams, and maybe we’ll hear a bit more about that. A well regarded and sought after commentator and communicator on all aspects of compliance and risk governance, the author of popular reports, blogs, articles and regular podcasts and TV appearances, and she is also one of the winners of the Risky Women Write competition in 2025 winning the Compliance Corylated prize. So welcome, Susannah Hammond.

Susannah Hammond 1:30
Thank you. Lovely to be back.

Kimberley Cole 1:32
Fabulous to have you. And last time you joined us was Episode 1 in Series 6! So here we are in Series 8, and I think last episode, we spoke about communications compliance with Stacey English, and today we’re going to discuss the idea of embedded supervision. Before we get into all of that, though, let’s talk about what you’ve been up to and catch up on where you’re at.

Susannah Hammond 2:02
Well now I am at a fabulous company called Cube. And you may know, Cube bought Thomson Reuters Regulatory Intelligence, and that deal went through basically a year ago now, but I left dear old TR got it three years ago now, and this is not really telling tales out of school, I got very disillusioned that they basically stopped investing in a solution that I firmly believe had world class content, world class people, putting out incredibly useful thought leadership and all of the rest of it, and a really, really powerful solution. And in their infinite wisdom, TR decided it wasn’t really of interest to them anymore, so I up sticks and joined a FinTech out of California called Theta Lake, because, apart from anything else, I really wanted to up my knowledge on all things artificial intelligence, what it could do, what it couldn’t do, what it shouldn’t do. And I had two years there, and I worked for myself for a little bit. And I was enjoying that to be frank, I really was enjoying that. But then the potential for if you like TTRII, but with real investment. Yeah, I got talked back into it, so I joined cube in March this year. And you know what? It’s great to be somewhere where they value the product, the content, the people, and just see a real future in the whole thing. So absolutely music to my ears. So, yeah, enjoying Cube very much. And I can bring all the AI stuff with me in that sense. And Cube has an amazing AI offering with, I mean, have to say, brains the size of planets operating, putting all of that together. So yeah, it’s good.

Kimberley Cole 4:04
Very interesting. And I love sort of hearing about these different career journeys. And obviously you’ve done a whole lot of things in your career. You’ve sort of mentioned bringing different skills in, but what’s been the most surprising learnings on your career to date?

Susannah Hammond 4:20
That’s a really good question. I think it’s understanding how transferable skills are. Because, I mean, a million, million years ago, my degree was material sciences, which is metal, ceramics and polymers, and then I went into The City and became a chartered accountant and the analytical stuff from my science degree translated into the chartered accountancy, which translated into risk and compliance at dear old Warburg. So it’s another blast from the past. Don’t underestimate how transferable the analytical capability is.

Kimberley Cole 4:58
Yeah

Susannah Hammond 4:59
I think that has. Really seen me through the ability to think through, well, why? Why does this work this way? How does it work? What’s the root cause? You know, explain it to me. One director who will remain nameless, said the scariest question I could ever ask him was, please explain this to me. And he was, yeah, he said because that made him think.

Kimberley Cole 5:23
I think it’s interesting as well, isn’t it, those critical thinking skills are going to be even more important in an age of AI So…

Susannah Hammond 5:30
Absolutely, yeah, and a certain degree of skepticism that we’ve had that one into, don’t assume, don’t assume the answer’s right.

Kimberley Cole 5:39
And what do you think the best advice you’ve ever been given is?

Susannah Hammond 5:43
I think, if you’re going into compliance, and that’s really what you want to do as a career, and good on you, because it is an amazing place to have a career, what I would suggest is a good thing, and this is not really a side track from the whole compliance thing, is, if you possibly can go work in the business itself for a little while, have a six months secondment into corporate finance, go sit on a trading desk, whatever it is. And I think that will help your perspective on compliance enormously, because you will have seen from the other side of the fence. You know, it’s gamekeeper and poachers and back and forth. But I think your compliance perspective, your compliance advice, will be all the better for having seen how the other side works for real. And you can then nuance it. And the detail you will have is incredibly powerful, and if you’ve been in the teeth of a big corporate finance deal, that will inform you, like nothing else, as to how risk and compliance should work for corporate finance, same for trading desk. I know that’s not always the art of the possible, but if you can do it, get a secondment into the business itself.

Kimberley Cole 7:03
Interesting, yeah, no, I think that’s very good advice. What about if you were thinking about your journey again? Is there anything that you would do differently?

Susannah Hammond 7:12
Well, I would like to think I wouldn’t be quite so nervous and scared of jumping tracks and changing directions, because I’ve been a Head of Compliance a lot, I mean a lot. And then when I joined a thing called CompliNet, which is a while ago, the agonies, I went through thinking, oh my goodness, what am I doing? Should I even be contemplating this, and it was a great decision. So I mean, of course, think about things carefully before you jump complete tracks. But go try things. Go do things. I think you’ll always forget the things you don’t do rather than the things you give a go and see whether it works. So yeah, advice to my previous self would be, don’t be quite such a wuss about making big decisions, because they do actually work out quite well. But that is definitely easier said than done, definitely.

Kimberley Cole 8:10
And then, what do you think has been the top highlight to date? Because I’m sure there’s going to be more to come.

Susannah Hammond 8:19
I think, oh, that’s a good one. I think it’s getting things off the ground that have then flown. That’s everything from the book which you’ve mentioned. Oh, Second Edition incoming. If I ever finish writing the flipping thing, it’s getting things off the ground that is just such a thrill. The Compliance Clarified podcast, I built that out of nothing and got that to fly Cost of Compliance Report, which is, I’ve just written a 15th one. It wasn’t all me getting it off the ground, but it was an awful lot of me getting it off the ground, that sort of stuff I absolutely love. You take an idea and you make it work, you run with it, and it flies from several different perspectives. That’s the thing that really does give me a buzz. That’s just brilliant.

Kimberley Cole 9:09
Excellent, excellent. And the Cost of Compliance Report, glad to hear that back. We will have to get a link to that in the in the notes.

Susannah Hammond 9:18
That would be great. Yeah. And then one of the many things I’m thrilled about with Cube is they wanted to get it off the ground again.

Kimberley Cole 9:24
Yeah!

Susannah Hammond 9:25
Good on them, because it’s, it’s heavy lifting, but they committed and we did it. And yeah, really pleased with it.

Kimberley Cole 9:32
Brilliant, brilliant.

Kimberley Cole 9:33
This episode is brought to you by Kroll. Stay ahead with Kroll. As the leading independent provider of financial and Risk Advisory solutions, Kroll leverages their unique insights, data and technology to help clients stay ahead of complex demands.

Kimberley Cole 9:53
Well, now let’s get into the article that you wrote and were a winner for in the Risky Women Write competition. Question, which was called Embedded Supervision – an Idea Whose Time is Coming? I suggest everyone goes and reads that article, but also several of the others while they’re there. And obviously you had some great feedback from the judges, which I’ll just share. The judges said a strong technical piece, well written, clear perspective. I liked how this took a big idea and examined the opportunities and complexities of embedded supervision becoming a reality. The article powerfully argues the case for embedded supervision as the next era of financial oversight. The piece is highly original, effective synthesizing a past concept with current AI data governance realities. It demonstrates masterful understanding using incredible contemporary research to support a compelling and logical argument. So fabulous!

Susannah Hammond 10:47
They liked it.

Kimberley Cole 10:48
Now let’s start for our listeners with what is embedded supervision, and why is it something worthwhile pursuing?

Susannah Hammond 10:58
Embedded supervision at its core is the regulator having direct access into a firm’s systems, and that, at it’s absolute kernel that’s it. But the nuance around that is it would be in lieu of reporting. So firms are all too well aware they spend enormous amount of time, money, effort, collecting, collating, checking, reporting to regulators, I mean, on all sorts of things, trade reporting, transaction reporting, prudential reporting, you know the list is as long as your arm. IF, and it definitely is still an if, there was a way that the regulator could look directly into the systems of a firm and get all of that required reporting automatically that would be embedded supervision. But I can just hear the howls, but oh my god, we don’t want anybody coming anywhere near our system. There’s a long road to travel, but the potential benefits there are huge. I mean, not only for the regulators, because they would be able to see exactly what they wanted, but for the firms, it would be an enormous cost saving, potentially. And let’s be frank, cost savings are something everybody is very interested in. It would be lower cost supervision for regulators. It would be lower costs regulatory costs for firms, and it’s entirely possible that it could be a really good step forward, because inherent in all of that is regulators and regulated would have to cooperate very closely together, and that’s not always the case. As we know it can be a distinctly adversarial relationship at times. So yeah, embedded supervision is something with enormous potential to make being compliant a good deal cheaper all round. That’s the potential. That’s the potential.

Kimberley Cole 13:04
Yeah, I think you raised one of the comments. I think in your article, you said, given the potential benefits, embedded supervision is a worthwhile goal, but trust would need to be built through extensive testing, coordination and feedback loops between regulators and those they regulate. So given that and all that you’re talking about, how could regulators and firms mutually try to build that trust that would be required to make it some kind of reality?

Susannah Hammond 13:33
Yeah, I think baby steps. It would definitely be baby steps. I think it would be worthy of a sandbox. In other words, you would try it out in a relatively safe environment. I think you do it really incrementally, and you would have to have firewalls, safeguards, whatever, because what you are doing is, if you are a firm, you are effectively letting a third party into your systems. And let’s be frank, firms spend an awful lot of time, money and effort making sure nobody can get into their systems, because that’s why you build all this cyber security around everything. So it is the art of the potentially possible, but you are going to have to build it very, very carefully. And you may wish to have parallel system runs. You may wish to have fire breaks and walls so you know whatever the regulator can see there’s a fire break between that and the rest of what’s going on in the firm. And I’m not suggesting firms have anything particular to hide, but you don’t want regulators having even the potential to go on a fishing exercise and seeing just what they can find. I mean, for goodness sake, but what you can do is build systems, and certainly AI enabled systems, potentially that could deliver up in packages or whatever, what the regulators are looking for. I mean, I do think things like trading terms, acts and reporting are perhaps the first movers in this because that level of automation is almost there. It’s not particularly perfect. Let’s put it that way, but those systems already talk in the UK. It’s a thing called GABRIEL gathering better regulatory information electronically, I think that’s the acronym. But it’s painful and slow and incomplete a lot of the time. So there is so much potential to put a lot of effort and time into getting that interface right. And I’m not saying you don’t need humans in the loop and oversight, because you will absolutely do but it’s again, you get it right, you’re staving off regulatory problems, and it’s also should be substantially cheaper for you. So there is potential.

Kimberley Cole 16:07
I think it’s really interesting. Now you also sort of get into data being at the heart of all of this. And obviously, know the phrase data being the new oil. So talk a bit more about sort of the data governance that’s also going to be so critical in this space.

Susannah Hammond 16:26
Yeah, I think data governance is a bigger picture question. I mean, if you get data governance right, yes, embedded supervision becomes much more the art of the possible, but you get data governance right, and all sorts of things become a lot simpler and fall into place for you. And it covers everything you know, what data have you got? Why have you got it? Where have you got it? And do you know? And I know that sounds like a really obvious question, but there’s been enforcement actions, there was one in the States with FINRA, where they asked a question of a firm, and the firm said, Oh, can’t find that. And they just couldn’t find something. And then a year later, they went, ah, found it now. And they got fined for it, and it’s just come on, guys, whole records management, data collection, storage. Have you got an unmodified, original format. All of those elements is perhaps not the most exciting thing a firm is ever going to do, you know, a data governance audit, but oh my goodness, you could have the potential to change data into this asset for you, and know about the quality of input into, say, any AI tools you’ve got, and you can turn it into an asset instead of it just being this custodial liability that you’ve got to just carry on paying for the storage and it just sits there like a lump. So if you can get the data governance elements to work for you, again, it’s a real business benefit. And if you know what you’ve got, where you’ve got it, why you’ve got it, you’ll find reporting both external and internal, oh my goodness, that becomes easier, because you know where everything is, and you can manage it.

Kimberley Cole 18:12
Obviously. Then though, there are lots of challenges around data governance, because you’ve mentioned some of the fines, etc, etc. What are those challenges that firms don’t seem to be tackling as well as they could?

Susannah Hammond 18:23
Well, I think there’s several things, and we mentioned the Cost of Compliance Report earlier data governance comes out as the greatest compliance challenge for 2026 so I’m not downplaying any of the challenges, but it is a mixture of old systems, patchwork quilt systems that perhaps don’t talk to each other brilliantly. You’ve got to weave in the data privacy, the data localization requirements, the fact you’ve got things in archives that may or may not have a completely lovely line of sight to them. Who knows? It’s also the cross border nature of some of the data. Do you actually know which jurisdiction it is? There are data localization requirements all over the place. How do you know what you’ve got where? And then, with all the general data protection, regulation kind of stuff. Do you have consent associated with data? Can you marry those two things up if you needed to? Do you know when that data expires in terms of how long you need to keep it, because, let’s be frank, if it’s not useful to you and you no longer need to keep it from a regulatory basis. It’s expensive to keep data. So why do you still have it? Why haven’t you deleted it? How do you delete it properly? That’s another whole minefield to get into, and the list of challenges is huge. But I think one of the biggest ones is, if you’re a firm of any size or any age, you will have patchwork systems that are glued together, perhaps beautifully, who knows. But equally, you will have, I’m sure, still the old manual work around you will have data sets that aren’t quite compatible with each other, you won’t necessarily have that helicopter view of everything. And I think that is the really tricky bit. And in an ideal world, board level sponsorship to have a complete data audit, to have a look at what you’ve got would be unbelievably useful, and I realize that is likely to be resource intensive and all of the rest of it, but again, the benefits could be huge. If you’ve got data you no longer need, and you’re paying oodles for storage that could pay for the whole project without even trying.

Kimberley Cole 21:02
And obviously talking about AI, we get a lot of alarm bells and notes of caution being sounded about just blindly relying on AI models and tools. I guess, what are some of those things you’re hearing? But also, what are the policy makers and the regulators that you think are at the forefront of this, in terms of thought leadership?

Susannah Hammond 21:24
In terms of relying on AI outputs, no matter how good your inputs are, you still need a human in the loop, particularly if there is any kind of decision there, rather than analytical information. I mean, if it is a decision, say, but back to embedded supervision, that actually this is what we’re going to tell the regulator, no, you have to have that human oversight, that human in the loop. No matter how good your model is, even if 95% of the time it comes up with a perfectly reasonable answer that hallucination factor, even if it’s one in 1000 the last thing you want is for it to muck up your relationship with the regulator. You’ve invested all of this in being compliant. You need to make sure you manage your relationship with your regulator. So always, always checking those kinds of outputs. And I was explaining this to someone the other day, understand that the AI model, the AI tool, has no way of knowing on the inputs going in, what’s right and what’s wrong. You mentioned, I’m a chartered fellow, CISI. They were talking about using AI to create the wrong answers as well as the right answers in multiple choice questions for one of the exams. And they were figuring out how to get the AI to do that. And I was thinking, please don’t muck up your large language models. We had the whole conversation about you need a separate set of data for the wrong answers and a separate set of data for the right answers, because the model has no way of distinguishing between what we would see as right and wrong at all. So be very aware that even if you’ve got the best, large language model, completely unbiased, wonderful information in there, it can still have a wobble and hallucinate and give you something that you think hmmm that’s, yeah. And in terms of who’s thought leadership, I mean, Basel Bank for International Settlements, doing some very interesting stuff. But one of the more interesting models and bits of analysis recently was Bank of Italy, Chat Bankman-Fried, which I have to say, that’s why I read it, because it was a great title of the of the research, and it was really pointing out that there is no ethical compass in an AI model, it will do as you have asked it most of the time. Yes, it will hallucinate, but do not rely on it to take anything like an ethical judgment. A moral judgment. It was, this is summarizing, probably very crudely, this very clever model, they had a number of achievements for the AI model. In other words, please make the profit 10 million, 5 million, 8 million. And some of the things that they said could trigger certain actions were, you fraudulently run a trading desk, you kill the chief executive, all these kinds of things. And some of the time, the model said, Well, you can’t kill the chief executive, that makes share price go down, and that’s one of the criteria and this that and the other. And other times it said, Well, if you kill the chief executive, and nobody knows, we’ll be fine. It was a really interesting. Interesting and clever way of looking at how AI modeling can work and the tools and so on.

Kimberley Cole 25:06
And was called Chat Bankman…

Susannah Hammond 25:09
Fried. Yes, and worth a look. Worth a look. It’s relatively long and involved the modeling, but it’s really interesting what they did really, really interesting. So, yeah, it’s worth keeping an eye out for things like that, because they are, yeah, they spark a lot of other thoughts as to, oh, okay, what about so no, very interesting, very interesting.

Kimberley Cole 25:36
Well, everyone should take a look at your article, because I know you reference it in the article as well. So everyone should go and have a look, and it’ll be linked to this podcast as well. So if you were going to make predictions, how far away do you think we are?

Susannah Hammond 25:51
I’d say about five years. And the reason I think it will be relatively soon in those terms is because I think there will be a supervisory cum regulatory imperative to try to get it sorted before quantum computing hits, and the mass technology change that that’s going to need. If they don’t get it done, it’s going to get lost in that mass technology change, and then it’ll be 15 20, years, to be frank, I think. I think quantum computing has, I mean, spectacular benefits, potentially. Equally, some of the challenges are eye wateringly scary. I mean, the concept that all encryption that we currently know and use today becomes useless in probably the next decade. Wow. Okay, and the bad actors that apparently stealing now so they can decrypt later, that’s another interestingly horrible concept. So, yeah, I would, assuming there is the AI to support the embedded supervision. And I can’t see why there wouldn’t be. You wouldn’t even really need agenetic AI. I think just common or garden would work, but you’re going to have to get it in place before it’s overtaken by much bigger fish to fry, like the advent of quantum and the need for post quantum computing.

Kimberley Cole 27:24
Yeah, it is a bit of a tricky question, but nice answer. So thank you very much. Now we’ll end on our kind of fun questions, hopefully. But you know, ones to get the audience thinking. So what one piece of advice would you give to our rising stars?

Susannah Hammond 27:43
I think I might be very boring and say what I said last time, and that’s believe in yourself. I mean, even when it gets tough, and let’s be frank, if you are in a compliance function, if you’re certainly if you’re a Head of Compliance, times can get interestingly tough, but believe in yourself. You’re smart, motivated. You know what you’re doing. You have a skill set. If you need to just stand your ground. Yeah, believe in yourself, and it can, again, easier said than done with so many things. But yes, hold your ground. You can do this.

Kimberley Cole 28:19
Next, what keeps you optimistic about the future of GRC?

Susannah Hammond 28:24
I think even now you get GRC right in inverted commas. It is such a competitive advantage, and I do think the better firms understand that you get risk management, governance, compliance, holistically embedded in what you do. You are absolutely on the front foot, and you will thrive into the medium long term. You play fast and loose, and you can see with some of the crypto firms that boom and bust with such spectacular fireworks, nobody even thought risk or compliance might be a vaguely good idea. It’s the capacity to operationalize it and that we have to go and work in the functions, because that gives you that perspective, I think, as well. If you can operationalize Risk and Compliance so it truly is a business benefit, as well as keeping you compliant and therefore also managing the personal liability of the senior folks, you have got a whopper competitive advantage you really have.

Kimberley Cole 29:34
And what’s one emerging opportunity in GRC that excites you more than it scares you?

Susannah Hammond 29:40
It has to be the role of technology going forward. And it’s worth remembering that most regulation around the world is technology neutral. It doesn’t care what systems you use. It doesn’t prescribe and say You will use this model or that artificial intelligence or whatever. I think it’s, is if you can get the technology right. And I say that with caution, because there was a European report, particularly with regard to money laundering, about six months ago, saying that the most compliance failures they saw was from bad implementation of regtech, which is a scary thought. So if you can get the technology working for you properly and correctly and you can rely on it, then I think that is just unbelievably exciting. I have to say there was this sort of grumpiness. Oh, it’ll take out all these compliance jobs. No, it won’t. Actually, what it’ll do is free you up to do the more value add stuff, rather than, I say this pejoratively, the grunt work, because the grunt work will be done by the computers or the technology or whether, whatever. And yes, you will have oversight, but you’ll be then the thought leadership, the lobbying, the sitting at the boardroom table saying, well, actually, because of the rule book, you could do this rather than that. So yeah, I think if you can truly get the technology right, fantastic. Absolutely brilliant.

Kimberley Cole 31:20
And then let’s end on an inspirational note. What superpower should every GRC professional cultivate?

Susannah Hammond 31:28
Communication. You’ve got to be able to communicate. I mean, it’s a given. You’ve got to have the skill set. It is an absolute given you know what you’re talking about, but you’ve got to be able to communicate it, and whether that’s at the boardroom table, it’s on a podcast, it’s in writing, however you do it, you’ve got to be able to communicate why this is important, where it might impact you, and what we do about it. And yeah, if you’re two minutes in the lift with the chief executive or writing a board paper, it’s all the communication. You’ve got to hone those communication skills so you’re not tongue tied in the lift with the chief executive. You can say, so glad I caught you, 123, or whatever it is, you know, poor chief executive. But you know, I think if you can communicate, and that’s one of the reasons I think the Risky Women Write competition is fantastic, because people can hone and practice their communication skills. Brilliant, absolutely brilliant.

Kimberley Cole 32:37
And I love it that we get a female perspective on different hot topics as well. Very good. But yeah, we’ve also launched our Risky Women Academy. So we have some ways that people can build on their superpowers, as I say. And one of them is SoftSkillingIt with Julia streets. So everyone should go check that out as well. But Susannah, it has been fabulous speaking again. Thank you so much for being one of the contributors to the Risky Women Write competitions and being a winner. So thank you very much. We will, you know, add links. Great to hear the Cost of Compliance Report is back. And yeah, we can talk about that in the future as well.

Susannah Hammond 33:18
We can indeed, yes. Oh, and second edition of the book, yes, finally finished writing it that hopefully next summer, next summer, it should be out with any luck.

Kimberley Cole 33:27
Excellent. Well, maybe we’ll get you back to share more on that too.

Susannah Hammond 33:30
That would be great.

Kimberley Cole 33:32
Or we could do a Rev-up session where you can give us a little few insights into it, and then people can read it in full. Excellent. Well, thank you very much for joining us on Risky Women Radio.

Susannah Hammond 33:46
Brilliant. Thanks, Kimberley.

Kimberley Cole 33:47
Thank you

Kimberley Cole 33:51
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org