Drawing on a career spanning Deloitte, Gentari, and IFFCO, Dinesh Kanna shares how transitioning from retrospective audit to forward-looking enterprise risk management requires shifting from independent assessment to strategic ownership.
Key Insights
- Transitioning from audit to enterprise risk management requires moving from a retrospective assessor’s mindset to an owner’s mindset that helps leaders make decisions with incomplete information.
- Structured frameworks like ISO 31000 and COSO break down organisational silos by linking risks directly to strategic objectives and risk appetite rather than treating them as a compliance checklist.
- Effective risk leadership demands strategic foresight to anticipate fast-moving threats like AI adoption, which is currently spreading faster than corporate governance.
Dinesh Kanna built a strong foundation in audit and assurance before transitioning into enterprise risk management.
“My time as an auditor gave me a rigorous grounding in controls, evidence-based thinking, and how organisations actually operate,” he said.
What prompted the shift was a pattern he noticed in his audit work. Because audit is largely retrospective, Dinesh was usually assessing whether controls had worked over a period that had already ended.
On several engagements, he found himself most energised by discussions on what could go wrong next and how the business should prepare, rather than reviewing what had already happened.
After serving as an Assistant Audit Manager and an Assistant Manager in Finance and Accounts, Dinesh kickstarted his risk management career as a Control Assurance and Risk Specialist at an Australian-headquartered global professional services company in the energy, chemicals, and resources sectors.
“The biggest adjustment was moving from an assessor’s mindset to an owner’s mindset. In audit, I was independent: I tested against a standard and reported my opinion. In risk, I am part of the business, helping people make decisions with incomplete information,” he shared.
At Worley, that meant getting comfortable with judgement over certainty, and shifting from pointing out gaps to helping project teams solve them. Dinesh also had to build trust by engaging early and framing risk around delivery goals rather than a compliance checklist.
At a global leading company in employment marketplaces, the challenge scaled up, requiring him to balance governance with speed in a fast-moving tech business. There, he learned that the goal was not to eliminate risk, but to help leaders take it deliberately within their risk appetite. That experience turned him into a trusted advisor rather than just a control checker.
Securing An Enterprise Risk Management Certification
By 2024, Dinesh had solid hands-on experience in risk management. As Head of Risk Management and Governance at a clean energy solutions company, he was working in a fast-growing energy transition business where risks were becoming more strategic, covering areas like new market entry, project investment, and evolving regulation.
Still, Dinesh sought a structured, recognised framework to back up his practical experience and ensure his approach met strong enterprise risk management standards and industry best practices.
“Firstly, the Institute of Enterprise Risk Practitioners (IERP®) gave me a new perspective on risk and how it hinders a company from reaching its objectives,” he shared.
“Secondly, it gave me a common language and framework, such as ISO 31000 and COSO, which made it easier to align stakeholders on how we identify, assess, and report risk.”
He added that the IERP® also helped deepen his thinking on risk appetite and linking risk to strategy, rather than just operational controls.
Applying his learning to the real world, Dinesh shared how the Enterprise Risk Manager™ (ERM™) Certification Programme helped him navigate a complex strategic challenge in his current role as Head of Risk Management and Commercial at a privately held multinational fast-moving consumer goods (FMCG) and agri-business leader..
“Leadership needed to make a significant decision, but risks were being discussed in silos, with no common view of how they affected our strategic objectives,” he explained.
Drawing on his ERM™ training, Dinesh did three things.
First, he linked the risks directly to strategic objectives and the company’s risk appetite, so leadership could see what was at stake rather than reviewing a long risk list.
Second, he ran a structured assessment with cross-functional teams, covering likelihood, impact, and interdependencies, while including scenario analysis for key uncertainties.
Third, he set up clear risk ownership and monitoring indicators so the risks stayed visible after the decision.
Adapting To A Shift in Mindset
Having successfully transitioned from audit to leading risk at organisations, Dinesh found that the biggest mindset shift was moving from reporting on risk to owning the conversation around it.
“As an auditor, my value came from independence: I tested controls, formed an opinion, and reported it. Leading risk in the clean energy sector or FMCG and agri-business, my value comes from helping leaders make better decisions before outcomes are known,” he said.
After all, the core capability a risk professional must develop to anticipate risks is strategic foresight. That means connecting external signals to the organisation’s strategy and asking, “What would have to be true for our strategy to fail?”
In practice, this involves scanning beyond the risk register, using scenario analysis and early-warning indicators, and challenging the assumptions behind the business plan before decisions are made.
Beyond this mindset shift, Dinesh has navigated risk across a wide variety of industries and scales. His key to adapting across different organisations is recognising that the core principles stay constant.
“What I adapt is the language, depth, and engagement model. In some places, risk was project-driven and quantitative. Others, it was lightweight and embedded for speed, strategic and investment-led or focused on commodity and supply chain resilience,” he said.
The Emerging Risk Organisations Are Underestimating
Looking ahead, the emerging risk Dinesh thinks most organisations are underestimating is AI adoption risk.
“It’s often treated as an opportunity or an IT project, but the exposures are broader: unapproved tools handling sensitive data, over-reliance on unvalidated outputs, third-party concentration, and fast-moving regulation,” he shared.
“AI is spreading faster than governance, so organisations that set clear ownership and oversight now will scale with confidence.”
Outside of work and managing risks, Dinesh keeps a balance between staying active and switching off mentally.
“I enjoy food hunting with my wife, trying new cafés and food spots because it gives me fresh perspectives. Lately, I’ve been getting into cooking with my kids,” he shared.
Oddly enough, some of these pursuits connect back to his work. Being active keeps him focused, while his curiosity about new places and ideas helps him spot trends he can bring into his risk thinking.
