Why Digital Trust Should Be a Business Advantage, Not a Cost Center | Amy Worley

Russ Fordyce (00:00): Welcome back to the winner circle, everybody. Today I'm here with Amy from BRG. She is the latest winner in the AI Excellence Awards. We're gonna talk to her about AI and privacy and all the goodness of her expertise. So, Amy, welcome to the show and congratulations on the award. Amy Worley (00:00): Thank you so much. Happy to be here. Russ Fordyce (00:00): So give us a little background on BRG. What do you guys do? What are you all about? Amy Worley (00:00): Yeah, so BRG is a multinational consulting firm. we are an expert services firm, so what we do is try to try to provide the right expertise to help our clients address complex issues. our consultants are some of them are from me like me from industry. we also have leading academics and cutting-edge data scientists, and we collaborate literally across the world to help business clients address their unique challenges. Russ Fordyce (00:00): Yeah, and and now you have a kind of a unique perspective you bring to this organization. You spent sixteen years as a lawyer before kind of moving into into the industry and then into consulting. What does a former trial lawyer see in corporate data breach that someone who came through IT security might miss, you know? Amy Worley (00:01): my gosh, that's a great question. So I always tell people I'm a recovering lawyer. And I ended up in this field almost entirely by accident. My career and the internet sort of happened at the same time. And so I was in big law doing at first, well, actually, when I first started out, I was doing Fourth Amendment search and seizure civil rights law at a little firm in Charlotte, North Carolina. And so my intro into the privacy world came from like old school government search and seizure privacy in the Constitution. Then I went into big law and I was doing employment work at the time that the internet happened and was working on a lot of like stolen corporate information. And then the privacy statutes sort of started coming online. The data breach reporting statute started coming online. FTC started focusing on data privacy and security. And so I just kind of followed my interest and did that. And then in 2016 I was like wow I've been doing the big Law thing, it's really cool, but I want to go build a program. Like, I've been giving advice, but I would have clients say, like, Amy, I that's great advice. How do you do that? And I was like, offering very hypothetical how do you do that information. And so I went in-house for a multinational pharmaceutical company and built a program. And I realized, hey, this is hard. but I loved it. I love the build. And so I kind of found my passion and Where law meets actually how do businesses operate in the world, built a GDPR program, ran it, loved it, and then came into consulting in 2019 because I saw this need for this meshing of what does the law require versus how do we build it? And that's what I do now. I help clients do data protection, privacy, cybersecurity, and AI governance, and go in and build. And it's really fun. Russ Fordyce (00:03): Yeah, now you don't just help your clients do this. You've written a book on this. Your book Yeah. Your book's called The Confidence Advantage and you introduced confidence by design. When did you first see that kind of this privacy, cybersecurity, AI functions all needed to kind of be unified and not just kind of coordinated? Amy Worley (00:03): I did that too, yeah. Amy Worley (00:03): Yeah, so it's really been emerging twenty twenty four, twenty twenty five. So once LLMs became a real thing, and you know, I mean AI has been around for a lot longer than ChatGPT going out in twenty twenty-three, but once businesses were really really using it and my clients were coming to me and I thought, this is all a data problem. This is this is how do we put controls around data in a human-centric fashion to make Sure, that these technologies are enabling businesses to do what they need to do, but we're still complying with privacy rules, we're still complying with cybersecurity rules, and we're putting AI governance controls. And then I love really gnarly problems like a lot. And so I built a crosswalk that took the privacy framework, the cybersecurity framework, and the AI governance frameworks, and put them into one 11 principle framework. Because I was like, people can't be working with all three of these. That doesn't When you're building a program, that's too hard. We don't, we can't have the 30 commandments. I really, really tried to get to 10, but I landed on 11. It drives my my business partner who works with me here at BRG nuts because he's an even numbers guy and he's like, you really, really should have gotten to 10. Russ Fordyce (00:04): Yeah, we don't need the thirty commandments. Russ Fordyce (00:04): And your graphic designer's gonna hate you. Amy Worley (00:04): Yes, yes. Unfortunately there are eleven, but I feel like hey, I combined privacy, cybersecurity, and AI into eleven. Come on. Russ Fordyce (00:05): So you kind of walk us through, you've seen a lot of this in in your history, kind of this organized or this organizational dysfunction. you know, where you know AI governance is over with, you know, admin and privacy is with legal and security is with IT. When those are all siloed, what breaks? Amy Worley (00:05): Yeah. Amy Worley (00:05): Everything. Everything breaks. No, it it really what happens is you have language barriers, right? So you have an executive team at the top who's trying to solve a business problem. They have a mission, they have numbers they're trying to hit, they're trying to drive business goals. I always say I'm the only one in the privacy of cybersecurity and AI business. My clients have a business. And when these are siloed, you have privacy professionals talking about the GDPR or HIPAA or the FTC, and they're using their words and they're Asking for their budget and they're using their systems. And then you have the cybersecurity people doing their thing, and they're talking about things like attack surface and threat actors and vulnerabilities, and they're asking for their budget and they're working in their programs, and AI governance is doing the same thing. And in fact, if you take the language aside and put those at a principal's level, it really is people trying to do the same thing. And because of these different languages, And because of the budget fights and because of the different systems, all three of those are less effective than they would be. Then I and my clients are finding when we actually implement this confidence by design than they are. If everybody has a common framework, a common language, and we're all speaking to the executives about risk using the same words. And it's just infinitely more effective. Russ Fordyce (00:06): Do you recommend that one organization kind of owns that unified vision or does it does it sit kind of pooled with everybody? Is that is it the collaboration? Amy Worley (00:07): It can be done either way. It really can be done either way. What is common is the language, the principles, and the metrics. So I do still think that security professionals need to be focused on security by design, which is one of security by design, AI by design, and privacy by design is one principle. And so you do still need experts in their fields doing that. But can the can a program be owned by one part of the organization? Yeah, absolutely. Legal can own it, IT can own it, commercial excellence can own it. What matters is though that everybody's talking about the same principles, we're talking about risk using the same words. We're using the company's risk matrix. So what are your risk tolerances? So that we're providing one unified picture up to executives who need to make decisions to drive business. Russ Fordyce (00:07): Yeah, now when you're brought into lead an organization through kind of one of these regulatory programs, you know, the GDPR or a data incident, what does day one look like? You know, kinda what where do you go in? What do you establish first and you know, why do you start there? Amy Worley (00:08): Yeah, so there's there's really two ways that we start. If we're starting in like an a security incident, it's different than if we're starting in a build. If we start in a security incident, you know, the first thing we establish is the rules of communication, right? Who's communicating what to who about what, and then decision-making authority. most most of the and I've worked hundreds of cybersecurity incidents, the breakdown is almost never on the technical side. It's almost always on who's deciding what when and who's talking. Who about what. And so we come in really quickly and say, no gossiping, no guessing. We will give you good information as soon as we have it, when we have it. and so that's what we do on the incident side. On the program build side, we actually start with what I call a pre-mortem, which is let's assume that this whole project failed. What killed it? And there it's fascinating because they always know. So the client always What's going to drive it off the rails? It's like, we have too many people wearing two hats, so we don't have enough time on this side. Or we have impartial stakeholder buy-in. We don't actually have the buy-in we need to do to do this. And so we start with the poor dead project on the table, and then we figure out what life support it needs. And we build the program implementation around the roadblocks that the client already knows is there. And so are we we going to need more buy-in we go and we figure out how we're going to need more buy-in. Do we have a a capacity problem on the client side? Then we need to phase and scale. And so that's how we start on program build. And I love it. It's a really fun exercise to do a pre-mortem. Russ Fordyce (00:09): Is it Russ Fordyce (00:10): I I I like the idea. Is there a is there something that is, you know, kind of said most commonly between those clients and those onboarding kind of Amy Worley (00:10): Yeah, there's two things that that almost always come up. i and then there are a lot of different things, but the but the two most common things are our our executive team doesn't really understand what we're doing. So we've been we've been tasked to go do this, but they don't really know what this is gonna look like. Or we really don't have the people on our side. You guys are gonna give us a lot of great work and we don't have enough bandwidth on our side to implement. And like and then I'm like, hey, this doesn't have to be a fire hose, right? We can meter this. We can give it to you, support you in a way that you have the bandwidth to do. Because the last thing that I want to do is cause pain for the client that we're trying to help. So and and as a part of the primordium, we also get really granular on what does winning look like? So that we can make sure that as a consulting team, our definition of win and their definition of win are the same. Because when I was an in-house in-house lawyer, I worked with some outside help and I came to realize that we had different definitions of what winning looked like. And so we get really granular on you know, how do you walk out of this as the hero of the story internally, you know, for yourself? Russ Fordyce (00:11): Yeah, it's it's funny how often that stuff goes undefined and the processes are really undefined and you can come in and make a significant impact just by defining and defining the process and defining the goals or you know, what winning looks like. Now you go ahead. Amy Worley (00:11): Yeah, and and they often know like we, you know, 'cause we're using this like kind of gory pre-mortem language, they also know where the bodies are buried. And so I'll say like, you know, what are some quick wins that are laying out there that if you just had time, you know right now we could do this, this, and this. And so a lot of times we start at the bottom with some of the easy stuff, again, to the building buy-in to making sure people have time to do what they need to do and then build up from there. Russ Fordyce (00:12): Yeah. Now you've worked as as an attorney, you know, kind of in industry and now as a consultant. You've also testified as an expert in federal courts on kind of all this data breach notifications. What is that what does that courtroom kind of testimony teach you about how organizations should document governance kind of day to day? Amy Worley (00:12): So I love that question. and it's actually the the courtroom testimony and the lawyer life. So I really do know what it's gonna look like when this stuff gets tested. And I know it from the advocate side. And then I also do talk to juries and judges about what is the standard of care, what does reasonable look like. And so when I am working with a client, we are thinking like, hey, when the very bad day happens, how are we gonna demonstrate that we did the things that a responsible company is supposed to do? And I frequently talk to clients about hey, I I've either as a as a trial lawyer on that side, like I I know the questions you're gonna get asked, or I have sat in courtrooms when juries are hearing these things and I'm called to give expert testimony, and this is what good looks like, and this is what somebody is gonna say good looks like. So let's get you to good. Russ Fordyce (00:13): Yeah, now you're out there now, I imagine, like every board is telling every business to be, you know, AI if I'd I thought it was going to be the year of the chief AI officer, but I think it's I yeah, and I think we we've somehow blown by that. I guess I guess the role has gone to CISO or CTO or CIO. Somebody got the job, right? I really thought it'd be a different role. Amy Worley (00:14): I too. Amy Worley (00:14): Yes. Russ Fordyce (00:14): Because it's it you you really have to kind of treat it differently. And I imagine that's what a lot of your customers are coming to you to do. When a so when a business leader kind of says to you we want to deploy AI responsibly and securely, what's the first ninety days of actually implementing, you know, that kind of responsible, secure AI look like? Amy Worley (00:14): So they don't ask me that anymore. They've already done it. so last year was the year of board mandate saying we need to get this, you know, embedded in our systems, we need to create efficiencies, we need to control costs. So last year I got the phone call. This year I get the phone call, we've done it, and we put some policies in place, but there's bottlenecks everywhere. And so people are going, they're not using our process, they're not using our procedure, and it's going so fast that we can't keep up. That's the call I get now. And so what we do is go in and do diagnostics, right? what I find is causing the holdup is they're over evaluating low risk issues. And so what we do is is try and help them sort what's really risky from I mean nothing is risk free, right? my old CEO at my pharma company used to say, I take on more risk when I send a sales representative in to tell a doctor about a drug than I ever do, you know. Traditional risk and compliance stuff, and it's like, yeah, that's really true. So when we talk about rolling out AI, it's not all the same. And so we go in, help organizations build what I call an agile governance program. And the confidence by design is part of this, right? Let's let's take these simple principles, let's teach them. AI literacy is so important. You have to empower people at the user level to know this is how AI works, this is a good Russ Fordyce (00:15): It is true. Amy Worley (00:15): good use, this is a bad use, you've you've got to put power of people's hands, and then you've got to streamline that assessment process based on risk tiers so that they can go at the speed of the business because the business will go whether you're going with it or not. Russ Fordyce (00:16): Yeah, now g if you c had to sum up the kind of confidence by design framework in thirty seconds, give us kind of the elevator pitch on that. Amy Worley (00:16): Yeah, so it's a simplified framework that is legislation neutral, principles-based, designed to create digital trust. And what we know from the research is that effectively implemented digital trust programs actually grow the bottom line. And so it is both risk-producing and revenue generating if you get implementation. And we really focus on change management and implementation when we go in and build it with clients. Russ Fordyce (00:16): Yeah, you also talk about maximizing the value of your data. And I am a huge proponent of this. because I don't think I I think a l especially small businesses don't realize how much data they have. I was at an event at an event space in New York and I spoke with the owner and she was she was, you know, opening up different event spaces, kind of multipurpose event spaces all the time. And Amy Worley (00:17): Yeah. Russ Fordyce (00:17): She was big into AI and we were talking about she's like, I'm so excited to use my business. And I said, What are you doing? And she's like, I use it for marketing and dah-da-da. And I was like, Why aren't you hooking up to your door sensors and why aren't you doing this in your life? You know, and she's like, I never thought about that. Right. And that's all that's all the data they have. It's like she can know how many people are in the, you know, in the room at any given point of time and and all this stuff that they don't understand that they have. And it's it's interesting to me. I wonder if you're running that to into that in a corporate world. Amy Worley (00:17): Right. Amy Worley (00:17): Right. Amy Worley (00:17): gosh yes so it and honestly it's not always more data is better sometimes it's more data is too much what what my goal is is to get the right data in the right place at the right time for the right people And so what we're finding in the LLM, like people are rolling out enterprise LLMs and they have not done any data cleanup in 15 years. And so it's surfacing outdated information and also they're spending a bunch of money on tokens to process stuff that they don't need to process. And that's where like I call it a data debt. whether it's hey, you have more data than you know, and you could actually answer interesting questions with this and let us like help you. Do that in a responsible and compliant way, or hey, you have way too much data, and you need to narrow this down. Frankly, for compliance reasons, you need to narrow it down. For cybersecurity reasons, your attack surface is huge. You're just a sitting duck for a breach. But also to get the value out of it. this is not an efficient way to use data to drive decisions. Russ Fordyce (00:18): Yeah. Now your your design framework has those eleven principles. what's the one that organizations skip the most? The one that's kinda hiding in plain sight that almost nobody gets right. Amy Worley (00:18): We design with accountability in mind. We're accountable. So accountability is absolutely critical to any program working. And if anybody's ever worked in a blame culture, they know exactly what it's like. It's dysfunctional, it sucks, people are constantly trying to cover their backside. accountability is I made a decision, I own the decision, I own the risk going forward, and I did it on purpose. And in an accountability culture, you're not blaming people, you just make the risk call, and then if it didn't go the way you thought it was gonna go, you learn, you iterate, you change, you're accountable again. but accountability is crucial. It's also in the law. the AI laws have an accountability function. The privacy laws have an accountability function. So I always say everybody's like well who owns this and I'm like whose day is ruined if it goes wrong? That's who I say. Russ Fordyce (00:19): It's a it's a very good way of looking at it. Amy Worley (00:19): You know, who's who who is going to have the worst day if this fails? That's usually your accountable person at an executive level. Like I don't mean the individual contributor. It's that person works for the person whose day is going to be ruined and who's accountable for this. Russ Fordyce (00:20): Now as you're talking with the CEOs and boards, are you finding that the CEOs understand that this is now a board level kind of strategic issue and not just something that's sitting in the legal department? Amy Worley (00:20): More this year than last year. Yeah. Last year I still had a lot of my general counsel's got this. And I was like, your general counsel's not got this. Often your general counsel is an old mergers and acquisitions lawyer who's really great at growing business but isn't a data lawyer. but more and more I think so, and boards are being educated that it's their responsibility. But part of the reason I wrote the book was to provide a board level education and overview of what this looks like, and to help CEOs, especially not of tech. Companies, right? A pharma company or a building supply company or or whoever really understand the risk and understand the research the executive responsibility for it. So, you know, some of my peers will read the book and go, well, this is all very obvious. And I'm like, Well, yes, that's because this is what you do all day, every day, but it's not very obvious to a CEO, a board member, or investor, and that's that's where the book came from. Russ Fordyce (00:21): Do you think we need that CAIO officer or chief data officer to kind of lead this charge inside of the organizations? I imagine, you know, giant organizations, those those people probably already exist. But I'm just thinking about, you know, you're kind of a mid size enterprise. Does somebody need to own that data and and kind of that policy? Amy Worley (00:21): So my My dream is, and there are businesses that do this. Actually, a gentleman who works with me used to have this title at another company, is it is a chief trust officer. Not in the banking and finance sense, but a chief trust officer that has cyber privacy, AI governance, data governance, and all that rolls up to one person because ultimately you're trying to establish trust. You are and that's actually where the commercial advantage is, is you have evidence-based. digital trust. And so a chief trust officer is is where I love seeing this because they're accountable across all of those work streets. Russ Fordyce (00:22): Yeah. Well this has been fascinating, Amy. If there was something that, you know, every leader could walk away with who watches this that they're gonna do differently tomorrow morning around kind of the privacy and AI governance and data, what would it be? Amy Worley (00:22): I would say stop thinking about it as a cost center and start thinking about it as digital trust as a competitive advantage. And when you think about and and I'm not the one saying this, Forbes is saying this, it's in Accenture research, it's in Deloitte research. I mean the research shows it. Gotta make a mindset shift. A mind shift. Let me say that again. You need to have a mindset shift around it to think in this digital first world, now that we're in The AI revolution. Digital trust is a competitive differentiator. And it's not a marketing term, it's evidence-based digital trust. And so start thinking of this as a component part of your product and part of what differentiates you in the market. And You'll end up with a business advantage from it, not just risk production. Russ Fordyce (00:23): Yeah, no, I agree. This is such an important topic. Amy, thank you so much for joining us and walking us through this kind of unification. And boy, is it gonna be a different world in five, I think, when when all of this kind of settles out. Amy Worley (00:23): Absolutely. And I I do not do predictions. I just know it's going to be different and it'll probably be cool. So thanks. Russ Fordyce (00:23): Yeah. Appreciate it.