Recommended Books for Governance, Risk and Compliance Professionals

A beginner's guide to Claude: setting up an account, writing clearer prompts, checking the answers you get back, and building simple workflows. Start here if you have never used an AI assistant for research or drafting.

View on Amazon (paid link)

A short book (104 pages in print) on turning work you do the same way every time into reusable Claude Skills, then testing and maintaining them. It fits compliance work well, since so much of it repeats.

View on Amazon (paid link) · Read our full overview of Building Claude Skills

Mollick teaches at Wharton and studies what happens when people actually use AI at work. One of his rules is to stay the human in the loop, which is a governance principle written in plain words.

View on Amazon (paid link)

Three economists argue that the big gains from AI come when an organization redesigns its decisions around better predictions, not when it bolts a tool onto the old process. Helpful when you have to explain to leadership where AI risk actually sits.

View on Amazon (paid link)

How machine learning systems end up learning something other than what their builders meant, told through the researchers working on fairness and interpretability. Good grounding before your first AI risk assessment.

View on Amazon (paid link)

A mathematician who worked in finance looks at the scoring models that decide who gets hired, insured, lent to and policed, and how they fail the people they score. Published in 2016 and still the plainest case for model oversight.

View on Amazon (paid link)

Buolamwini's account of discovering that commercial face analysis systems did worst on darker-skinned women, and of the research and advocacy that followed. Read it before you test any system for bias.

View on Amazon (paid link)

Two Princeton computer scientists separate AI that works from AI that does not, and save their sharpest doubts for predictive tools used in hiring and criminal justice. Keep it close when a vendor's claims land on your desk.

View on Amazon (paid link)

A guide for business leaders on the parts of trust in AI, among them fairness, transparency, privacy, safety and accountability, and how a company puts them into practice.

View on Amazon (paid link)

Crawford follows AI back to the mines and the human labor it depends on. It widens the risk picture well past the model itself.

View on Amazon (paid link)

A DeepMind co-founder argues that governments and institutions have to contain AI and synthetic biology, and explains why that is so hard. Useful context for where regulation may go next.

View on Amazon (paid link)

The case against high, medium and low risk matrices, with simple quantitative methods to replace them. Many of the methods carry over to AI and operational risk.

View on Amazon (paid link)

Written by Jack Jones, who created FAIR, and Jack Freund. FAIR is the model many risk teams use to express information risk in dollars. If a posting asks for FAIR or cyber risk quantification, this is the book to read first.

View on Amazon (paid link)

Janca covers secure requirements, design, coding, deployment and testing, then how to run an application security program, using the characters Alice and Bob to keep it readable. The OWASP Top 10 is the list auditors, risk teams and vendor questionnaires cite most for web application risk, and this book explains the practices behind it in terms a non-developer can follow.

View on Amazon (paid link) · Prefer video? Packt's OWASP Top 10 course

Two Stanford design instructors apply design thinking to careers: try small versions of a new path before you commit to it. A fit for people moving into GRC from law, audit, IT or nonprofit work.

View on Amazon (paid link)

A former FBI hostage negotiator on calibrated questions and careful listening. Worth an evening before any salary conversation.

View on Amazon (paid link)