Innovation comes in many areas, and compliance professionals need to not only be ready for it but embrace it. Join Tom Fox, the Voice of Compliance, as he speaks with top innovators, thinkers, and creators on the award-winning Innovation in Compliance podcast. In this episode, host Tom interviews GRC professional Jeff Kushner about Fox’s book Deluge Before Dawn and its risk management lessons from the 2025 Kerr County flood that killed 119 people.
Kushner argues a policy is not a control: policies must be specific, operationalized, tested, monitored, and continuously improved, with clear roles, successor plans, training, and communication protocols. He contrasts document-centric assurance (having a written plan and passing inspections) with outcome-centric assurance (whether plans work in real conditions), citing Camp Mystic’s one-page “shelter in place” plan that passed a DSHS inspection two days before the flood. They discuss alerts as information that requires predetermined response sequences, the need for redundancies in communications, proactive scenario exercises (“what happens next?”), benchmarking against other sites like Mo Ranch, and board-level questions on impact, accountability, timelines, and measurable protections for life, property, and data. Kushner also describes his role at Allgress and its Rexina solution for identifying compliance and risk changes and guiding remediation.
Key Highlights:
- Policy Versus Control
- Alerts and Control Steps
- Inspection Paradox
- Outcome-Based Assurance
- Scenario Testing Exercises
- Rexina and Allgress
- Board-Level Risk Questions
Resources:
Jeff Kushner on LinkedIn
Allgress on LinkedIn
For a report Jeff Kushner created on the risk management issues we discussed in the podcast, click here.
Tom Fox