Bruce Turner, “an active company director and audit committee chair”, was recently interviewed on this topic. You can see the full interview at CERM Risk Insights and there is also an article in Future of Professions.
Richard Chambers has shared his valuable insights in another post. In Europe’s Internal Auditors Are Already Identifying the Risks for 2021 he makes a number of excellent observations, especially his opening paragraph.
What is a control, at an abstract level: what is it supposed to achieve, and how is it supposed to operate within an organization?