# Dr. Nath Alagbe

> Dr. Nath Alagbe: IT audit and AI governance leader with 12+ years in U.S. banking. ISO/IEC 42001 Lead Auditor, CISA, CISM, CISSP. Speaker and advisor.

Dr. Nath Alagbe (Nathaniel Adebayo Alagbe) is an IT audit, technology risk, and AI governance leader based in Burlington, New Jersey. Dr. Nath Alagbe brings 12+ years of experience in technology audit, risk, and GRC, currently at a federally regulated U.S. savings bank, and helps regulated organizations prove their technology controls work and adopt AI responsibly.

## Expertise

- IT audit and technology risk and controls
- IT governance, risk, and compliance (GRC)
- Third-party and vendor technology risk
- Cybersecurity and cloud security assurance
- AI governance, AI risk management, and AI audit (NIST AI RMF, ISO/IEC 42001)
- Risk reporting for executives and boards

## Credentials

- CISA, CISM, CISSP, CRISC, CCAK, AAIA, AAISM, AAIR, CFE, FCA, ISO/IEC 42001 LA, ISO/IEC 27001 LA, ISO/IEC 27701 LA
- PhD, Forensic Accounting and Audit; MSc, Forensic Accounting; MBA, Finance and Investment; BSc, Accounting

## Pages

- [Home](https://www.nathalagbe.com/): profile, expertise, approach, speaking, resources, and contact
- [About](https://www.nathalagbe.com/#about)
- [Expertise](https://www.nathalagbe.com/#expertise)
- [Speaking](https://www.nathalagbe.com/#speaking): talks and workshops on technology risk, audit, and responsible AI
- [Contact](https://www.nathalagbe.com/#contact): recruiters, peers, and event organizers

## Resources

- [Closed is not the same as fixed: validating remediation before the issue closes](https://www.nathalagbe.com/resources/closed-is-not-fixed/): An issue closed on management assertion is not a risk reduced. How to agree closure criteria up front, test that the fix works over time, and report aging and repeat findings honestly.
- [Assurance language is not evidence](https://www.nathalagbe.com/resources/evidence-brief-01-assurance-language-is-not-evidence/): Words like reviewed, monitored, and in place sound like control. They are claims. Here is how to tell a claim from proof, and how to ask for the difference.
- [Shadow AI is already inside your organization. Start with an inventory, not a ban.](https://www.nathalagbe.com/resources/shadow-ai-is-already-inside-your-organization/): Banning AI tools pushes use out of sight. Find what is already running, triage it by risk, and make the approved path easier than the workaround.
- [Six AI questions every board should ask management](https://www.nathalagbe.com/resources/six-ai-questions-every-board-should-ask/): Directors do not need technical depth to oversee AI. Six plain questions, with what a good answer sounds like and the red flags that should prompt a follow-up.
- [The recovery plan nobody has tested: ransomware resilience as a control](https://www.nathalagbe.com/resources/the-recovery-plan-nobody-has-tested/): A recovery plan that has never been exercised is a hope, not a control. What it takes to prove you can restore after ransomware, from immutable backups and full restores to the dependencies nobody planned for.
- [When AI acts on its own: what agentic AI changes about your controls](https://www.nathalagbe.com/resources/when-ai-acts-on-its-own/): AI agents send, approve, change, and buy, not just suggest. That shifts the control model toward agent identity, action limits, traceable decisions, real human oversight, and a way to stop.
- [Why access reviews pass the audit and still fail the business](https://www.nathalagbe.com/resources/why-access-reviews-pass-audit-and-still-fail/): A signed access certification proves a review happened, not that access is right. How to fix the population, the reviewer, and the revocation evidence so the review actually reduces risk.
- [Who owns the AI decision?](https://www.nathalagbe.com/resources/who-owns-the-ai-decision/): Questions about approval, performance review and escalation across the AI lifecycle. Establish who owns the use case and who acts when conditions change.
- [Does the assessment still reflect the service?](https://www.nathalagbe.com/resources/does-the-assessment-still-reflect-the-service/): A practical perspective on vendor reassessment triggers, assurance scope and the control responsibilities an organization retains.
- [What decision does this report support?](https://www.nathalagbe.com/resources/what-decision-does-this-report-support/): Connect risk movement and control performance with accountable ownership and the action management needs to consider.

## Contact

- Email: alagbenat@gmail.com
- LinkedIn: https://www.linkedin.com/in/nathalagbe/
- X: https://x.com/prowess007