Robert Wright

I find as I start removing things from my life that the more I take away, the more I feel relieved. The amount of stuff that is in my life – from clothes to old games, to nick-knacks, is just so much that I find myself weighted down from being able to experience life.

I think about “do I need this?” when I am just trying to go out to grab a burrito, or “what should I wear?” and considering one of the 10 hoodies I have before I even step outside the house.

Things make me feel like I’m happy – but they’re distractions. They distract me from looking out the window and just enjoying the warm afternoon in front of me. The things that actually make me happy.

The roles and responsibilities of the three lines of defense in governance, risk, and compliance (GRC) are crucial for maintaining a practical risk management framework. The first line of defense comprises frontline managers responsible for owning and managing risk. They are closest to the business processes and are ideally positioned to design and implement controls that mitigate identified risks. The second line consists of risk management and compliance functions, while the third is internal audit, which provides independent assurance.

However, a notable concern arises when control test design, which is typically associated with the first line, becomes the responsibility of the third line. This shift raises questions about the effectiveness and appropriateness of such an arrangement. When an internal audit takes on control design responsibility, it can lead to a disconnect between control design and operational realities. This misalignment can result in overly complex controls or controls irrelevant to the organization's actual risks.

Auditors might design controls with a focus on compliance rather than operational efficiency, leading to cumbersome and resource-intensive processes. Furthermore, there is a crucial need to maintain the independence of the third line which slips away the more involved Audit is with the business activities. This dual role can compromise the integrity of the assurance it provides to senior management and the board.

The shift of control test design to Audit might be due to a perceived lack of capability or capacity within the first line, prompting the auditors to step in. Or the business teams evaluate their time and focus and deprioritize documenting the testing methodologies by the control teams. It could also be a response to increasing regulatory pressures, where organizations seek to leverage the expertise of internal auditors to ensure compliance. However, these reasons do not justify the departure from established best practices in risk management.

After talking with many second line teams about this, they all agree that with the right amount of time and investment in resources, they could realign roles and responsibilities and ensure that each line of defense operates within its intended scope. The problem often turns to a lack of investment by leaders in the value of what GRC can bring to their organizations – the documentation of controls alone becomes a burden on the business, let alone designing and validating testing is effective for their activities.

At FOSDEM while working at the Fedora booth, lots of different people approached us to talk about Fedora Linux, the various communities they were in, and their interests.

On Sunday, a small group walked up to the booth and asked me, “Do you know what I Love Free Software Day is?”. Having not been broadly in the open source community until last year, I asked them what it was.

Every February 14th, community members say Thank You and show appreciation to contributors in open source communities and the amazing things they do. The Free Software Foundation Europe team hold this as an annual event and send postcards to different communities.

The team introduced themselves as members of the FSFE and they had a simple ask – “Are you up for a challenge?”. How could I say no?

They gave me a set of materials and a card with a link to a Git repo and wished me luck. I placed it in my backpack and went along with the rest of the day handing out stickers to everyone who walked by.

---

After returning home to Portland, I set out to try to figure out how to do this. I needed to take this Arduino and somehow make this thing flash lights. I am not a hardware guy, and the FSFE team warned me I needed to be able to solder.

I’ve never soldered anything before nor do I own a soldering iron. So the first task was to acquire one of those. After visiting Home Depot, I managed to find both electrical solder and a soldering iron.

After reading the instructions briefly and figuring out how hard it could be, I fired it up.

The first attempt I made at soldering was the grey wire you see below. As someone who is not a hardware person and has not used a soldering iron before, this was exceptionally difficult.

I knew I needed to heat the solder and tap the tip against the wire. I prepped each wire by cutting a bit of the tip down and got them lined up. And afterward, I attempted to make a connection to the first wire.

After fussing with it for quite some time, I ended up pausing and finding a YouTube video since it was 3 in the morning where I was, and I couldn’t call my brother, who is an actual engineer, to ask for help.

The video instructed me to prep the iron and to get a sponge to help dampen and remove some of the excess solder from the iron as I was working. This seemed to help as my two and three attempts of soldering wires were much smoother. I tried my best to clean up the first wire where I could.

I cleaned up the cabling, plugged in the wires to the Arduino, and went to work to compile the included software.

This part was much more straightforward as I could read code. I also like to just do things until they work, as I can do easily with software, so installing the PlatformIo on my Fedora laptop was a breeze. The script that was included was compiled successfully, and I was able to flash it without any error to the Arduino.

I waited for a few moments after the flash was complete, expecting to see some lights. But sadly as more time went on, and the lights did not activate, I wondered if my soldering job was behind this.

I looked back at the Git repo that was included with the project and reread the instructions to make sure I didn’t miss something when I discovered my fatal mistake.

Oops – if you noticed above, I soldered the wires to the wrong end of the LED strip.

After a quick cut of the wires and the blessing in disguise to get to resolder all the wires, I ended up with a new, cleaner version of the wire connections.

See – much better.

And while holding my breath, I reconnected the wires to the Arduino and plugged it back in. 3 seconds later…

We have light! I did it! It started to glow lights as it went along! I tidied up the case, attached the strip to the two ends, and then attached the Arduino to the back of the heart. It now glows slowly as it covers my desk like this:

Now it wouldn’t be I Love Free Software Day if I didn’t say thank you to the amazing contributors and community at the Fedora Project. There are so many of you I’ve met over the past year who have made my life better by welcoming me into the community. Our Friends foundation is what matters most, as when we are working together and helping each other – we’re able to do amazing things!

I am grateful for everyone, not only in the Fedora Project but also in the open-source communities around the world who make technology better for everyone! Thank You!

And for this heart – I will find it a good home in the Fedora community. <3