Kategorie: Best Practices

The First Brands Case – What Happened

First Brands, a US supplier of automotive aftermarket parts, filed for Chapter 11 bankruptcy in early 2025. The company had accumulated liabilities in excess of ten billion dollars, much of it hidden in complex structures that were not fully visible to outsiders.

The use of financing methods such as factoring and supply chain finance became particularly problematic, since they often do not appear transparently on balance sheets. As long as liquidity remained stable, the model seemed sustainable. But once lenders demanded more transparency and withheld payments, the liquidity crisis intensified. Within months, the company was insolvent.

Key Takeaways

The US auto supplier First Brands has filed for bankruptcy. The case highlights the dangers that arise when companies rely heavily on debt while using opaque financing models. Off-balance sheet structures, aggressive credit instruments, and weak governance undermined trust among investors and business partners and ultimately led to collapse.

Similar insolvencies in recent years – such as Wirecard, Greensill Capital, or Carillion – demonstrate that these issues are not confined to one sector. The clear lesson for companies in Europe and beyond: Governance, Risk Management, and Compliance (GRC) are essential for building trust and preventing crises.

Parallels to Previous Insolvencies

First Brands is part of a broader pattern. Several high-profile corporate collapses in recent years were driven by excessive debt, opacity, and governance failures.

• Wirecard (Germany, 2020): The largest accounting scandal in postwar Germany, with manipulated balance sheets and weak oversight.
• Greensill Capital (UK, 2021): A supply-chain finance provider that collapsed under opaque credit chains and unsustainable risk exposure.
• Carillion (UK, 2018): A construction and services giant brought down by aggressive accounting and lack of risk controls.

All of these cases share the same DNA: over-leverage, insufficient governance, lack of transparency, and a culture of ignoring risks until it was too late.

Governance – When Oversight Fails

The First Brands bankruptcy shows that governance is only effective when it is actively applied. Boards of directors must have both the competence and the courage to question complex financial structures. If oversight bodies simply rely on management reports without scrutiny, systemic risks remain hidden.

Governance means more than formal oversight. It requires active, critical engagement to ensure that business models rest on solid, sustainable foundations.

Risk Management – An Underestimated Early Warning System

Risk management could have acted as an early warning system in all these cases. Red flags such as high debt ratios, financing instruments off the balance sheet, dependency on a small number of lenders, or a lack of liquidity stress tests should have triggered corrective action.

Organizations applying international standards such as ISO 31000 are better positioned, as this framework provides a systematic approach to identifying, assessing, and monitoring risks. Risk management must be understood as a strategic tool to safeguard long-term viability, not just a compliance exercise.

Compliance – Regulation as a Safeguard

Compliance also plays a crucial role. European regulations such as the CSRD and ESRS standards demand greater transparency in corporate reporting. On a global scale, frameworks like ISO 37301 for compliance management systems provide further guidance.

These requirements are not bureaucratic burdens but safeguards that build trust with investors, regulators, and business partners. Companies that embrace compliance as a protective shield are less exposed to the kind of risks that brought down First Brands.

Lessons for Companies

The central lesson is clear: opaque financing and excessive debt are systemic risks – not only for the companies involved, but also for industries and supply chains. For European and international businesses, this translates into three priorities:

• Strengthen governance structures so that even complex financial models can be critically examined.
• Establish risk management that goes beyond standard scenarios and includes stress tests and worst-case analysis.
• Use compliance requirements as tools to build transparency and prevent crises.

Conclusion

First Brands is yet another reminder that GRC is not an abstract concept or a “nice-to-have” – it is a decisive factor for sustainable corporate success. Companies that take governance, risk management, and compliance seriously protect not only themselves, but also their investors, partners, and customers.

FAQ

Why are insolvencies like First Brands relevant for GRC?
Because they show that lack of transparency, weak controls, and poor risk management can trigger systemic crises.

Can this also happen in Europe?
Yes. Wirecard, Greensill, and Carillion demonstrate that European companies face the same risks.

Which standards help manage risks more effectively?
Key frameworks include ISO 31000 (risk management), ISO 37301 (compliance), ISO 27001 (information security), and the European CSRD and ESRS requirements.

What role does transparency play?
Transparency is the decisive factor in building trust with investors, regulators, and business partners. Without it, risks are discovered too late.

Global business today is more interconnected than ever before. Companies rely on a vast network of suppliers, service providers, and technology partners to keep operations running. This interconnectedness creates efficiency and flexibility – but it also introduces significant risks.

Cyberattacks on suppliers, human rights violations in the supply chain, or the sudden insolvency of a critical vendor can have immediate consequences for an organization. These events threaten operational stability, compliance, reputation, and even financial performance.

In the context of Governance, Risk, and Compliance (GRC), third-party and supply chain risks have therefore become a central management concern. Companies must learn to identify, assess, and control risks beyond their own organizational boundaries.

Key Takeaways

• Supply chains and third-party dependencies are among the biggest vulnerabilities in modern organizations.
• The greatest risks arise from a lack of transparency, weak oversight, and insufficient risk management.
• Regulatory frameworks such as the EU Supply Chain Act, ESG reporting obligations, and NIS-2 increase the pressure on companies to monitor their partners more closely.
• An integrated GRC system enables organizations to capture, evaluate, and mitigate risks systematically while ensuring compliance.

Why Supply Chain Risks Are So Dangerous

Today’s supply chains are complex, global, and highly dynamic. A single product might involve components from five countries, span ten supplier levels, and depend on multiple logistics providers. While this structure offers cost and efficiency advantages, it also creates vulnerabilities.

A single failure or disruption can halt production lines. Even more severe are cases involving ethical, environmental, or security breaches within the supply chain. Human rights violations, data leaks, or environmental offenses committed by partners inevitably affect the company at the top of the chain – leading to reputational damage, regulatory penalties, and loss of customer trust.

The core issue is often invisibility. Many organizations do not have full transparency over their second- or third-tier suppliers. They might know their direct vendors but not who stands behind them. This lack of visibility makes proactive risk management nearly impossible and forces companies into a reactive mode when crises hit.

Increasing Regulatory Pressure

Governments and regulators have started to respond to these challenges. In the EU, Germany, and Switzerland, new laws require companies to assume greater responsibility for what happens within their supply chains.

Germany’s Supply Chain Due Diligence Act (LkSG) and the EU’s upcoming Corporate Sustainability Due Diligence Directive (CSDDD) oblige companies to identify, monitor, and mitigate risks across the entire value chain.

At the same time, sustainability and ESG regulations such as the Corporate Sustainability Reporting Directive (CSRD) and the European Sustainability Reporting Standards (ESRS) introduce stricter reporting duties. Companies must now provide evidence that they are managing social, environmental, and ethical risks throughout their supply chain.

From a cybersecurity and operational resilience perspective, new frameworks like NIS-2 and DORA in the financial sector require organizations to ensure that their third parties maintain appropriate levels of information security and resilience. Compliance is no longer optional – it is a prerequisite for market participation.

The GRC Approach: Structure Instead of Reaction

Meeting these requirements demands a structured, system-based approach. Governance, Risk, and Compliance must extend beyond the company’s own walls and encompass the entire supplier ecosystem.

A modern Third-Party Risk Management (TPRM) program pursues three main objectives: transparency, assessment, and control.

1. Transparency:
   The foundation of TPRM is knowing who your partners are – including indirect suppliers. Building a complete supplier inventory is the first step. Classifying suppliers based on their criticality and risk exposure follows next.
2. Risk Assessment:
   Each partner should undergo a structured risk assessment that covers financial stability, cybersecurity posture, sustainability performance, legal compliance, and reputation.
3. Control and Monitoring:
   Based on these assessments, specific control measures and monitoring mechanisms should be implemented – from audit programs and certification reviews to continuous monitoring and escalation processes in case of red flags.

Digitalization and Automation as Success Factors

Given the scale and complexity of global supply chains, manual approaches are no longer sufficient. Digital GRC platforms can centralize data, automate monitoring, and provide real-time insights into third-party risk exposure.

Modern solutions integrate data feeds from financial risk databases, cybersecurity scoring systems, and compliance registries, allowing for automated alerts when anomalies occur. Reporting and regulatory documentation can also be automated – a major advantage in the context of ESG and audit requirements.

When TPRM is embedded into a broader GRC framework that also includes incident, policy, and audit management, companies gain a holistic risk perspective. This strengthens not only compliance but also strategic resilience.

Key Success Factors for Effective Third-Party Risk Management

Organizations that want to manage third-party and supply chain risks effectively should follow a few guiding principles:

• Define responsibilities clearly: Third-party risk management should be an organizational function with clear ownership, ideally aligned between procurement, compliance, and risk management.
• Prioritize by criticality: Not every supplier carries the same level of risk. Focus on partners that are business-critical or hold sensitive data.
• Review regularly: Risk assessments must be updated periodically as markets, regulations, and supplier relationships evolve.
• Ensure traceability: Every assessment, decision, and action must be documented for audits and regulatory reviews.
• Integrate into GRC systems: Real transparency only emerges when third-party management is embedded in the company’s overall governance and compliance structures.

Conclusion

Third-party and supply chain risks are no longer niche issues but core elements of enterprise governance. In an environment where organizations are increasingly held accountable for their partners’ actions, transparency is essential.

A well-designed Third-Party Risk Management program, integrated into a comprehensive GRC framework, enables companies to identify risks early, maintain compliance, and strengthen resilience across the entire value chain.

---

FAQ

What are third-party risks?
These are risks that arise from the activities or failures of external partners such as suppliers, IT service providers, or consultants. They can lead to financial losses, operational disruptions, or reputational damage.

Why are supply chain risks relevant for GRC?
Because GRC extends beyond company boundaries. Regulators expect organizations to ensure that their partners follow the same governance, risk, and compliance standards they apply internally.

How can companies assess supply chain risks?
Through structured risk assessments that evaluate sustainability, human rights compliance, data security, financial health, and regulatory conformity of suppliers.

What role does technology play in TPRM?
Digital GRC platforms automate monitoring, reporting, and documentation. They provide real-time transparency and streamline compliance efforts.

Which standards support third-party risk management?
Key standards include ISO 31000 (risk management), ISO 27001 (information security), ISO 37301 (compliance), ISO 9001 (quality), and the ESG reporting frameworks under CSRD and ESRS.

When people think of fast-growing fintechs, they tend to picture innovation, agility, and disruption – but rarely governance or compliance. Revolut, the London-based financial platform, has shown that speed and structure can go hand in hand. After years of rapid expansion and growing pains, the company realized that sustainable success requires more than growth alone. Today, Revolut stands as an example of how governance, risk, and compliance (GRC) can become an active part of company culture – and how a system called “Karma” helps employees take shared responsibility for doing the right thing.

Key Takeaways

• Revolut has introduced an internal points system called “Karma,” linking team bonuses to compliance and risk behavior.
• Employees earn points for completing trainings, following internal policies, and reporting risks early.
• The goal is not to punish mistakes but to promote a shared sense of responsibility across teams.
• According to Revolut, the system has improved overall compliance performance by around 25 percent.
• GRC is no longer a control mechanism, but part of everyday behavior and culture.

Why Revolut Changed Its View of GRC

Revolut’s story is one of transformation. The company grew explosively, becoming one of Europe’s best-known fintechs with millions of customers and a presence in dozens of markets. But such speed also brought challenges: high internal pressure, lack of oversight, and compliance issues, particularly around anti–money laundering processes.

Eventually, Revolut decided to rethink its approach. Instead of viewing compliance as an obligation, it began treating it as a business advantage. In 2020, the company launched the “Karma System” – a new way to encourage employees to see risk management and compliance not as tasks imposed from above, but as shared goals that shape everyday work.

How the Karma System Works

The idea is simple but effective. Every department collects points for positive risk and compliance behavior. Completing training, following reporting standards, and identifying issues early all earn points. Failing to meet requirements results in deductions.

These points are tracked in an internal dashboard and influence bonus calculations. However, the focus is on teams rather than individuals. This means employees are motivated to help one another and ensure the whole department performs well. The system creates accountability – but also community.

As one manager at Revolut put it: “It’s not about punishing mistakes. It’s about making good behavior visible – behavior that prevents risks before they turn into problems.”

GRC as Part of Everyday Culture

The Karma System reflects a larger cultural shift inside Revolut. Governance, risk management, and compliance are no longer separate disciplines. They are part of how the company thinks and works.

Governance now means clear responsibilities and transparent decision-making.
Risk management means anticipating problems, not reacting to them.
And compliance means building trust through consistent, ethical action – not paperwork.

By integrating these principles into daily work, Revolut has created a learning organization. Every employee understands that they play a role in managing risk and ensuring accountability.

Lessons for Other Companies

Revolut’s example shows that GRC doesn’t have to slow a business down. Done right, it strengthens it. Here are key takeaways for other organizations:

1. Positive incentives work better than control. When compliance and risk awareness are rewarded, employees engage instead of resist.
2. Team accountability builds stronger cultures. Shared responsibility fosters collaboration instead of fear.
3. Transparency is key. Real-time dashboards and open communication turn compliance into a visible, shared goal.
4. Leadership sets the tone. Culture follows example – GRC must be championed by management, not delegated.

Challenges and Future Outlook

No system is perfect. Some critics argue that linking bonuses to compliance could lead to a “points game” rather than genuine behavioral change. Revolut acknowledges this risk – and emphasizes that the success of Karma depends on leadership, dialogue, and trust.

Still, the initiative shows that compliance can be human, collaborative, and even motivating. When GRC becomes part of company culture, it stops being a box-ticking exercise and starts being a source of stability and trust.

Conclusion

Revolut’s journey from hyper-growth fintech to GRC pioneer illustrates a crucial point: sustainable success comes from balance. The Karma System might sound unconventional, but it works because it treats people as the foundation of governance and risk management.

When employees understand why compliance matters – and feel responsible for it – rules turn into values, and systems turn into culture. In an era of uncertainty, that may be the most valuable form of resilience a company can build.

---

FAQ

What is Revolut’s Karma System?
It’s an internal points-based model that tracks how well departments follow risk and compliance rules. Team performance affects individual bonuses indirectly, encouraging collective responsibility.

How much did the system improve performance?
According to Revolut, compliance performance improved by about 25 percent since the system’s launch.

Why is it team-based rather than individual?
To avoid fear or competition. The goal is to encourage cooperation and shared ownership of risk management.

Can other companies use this model?
Yes, but only if it fits their culture. The key is not the points themselves, but creating real awareness and ownership around GRC topics.

How is Revolut’s approach different today?
It focuses more on transparency, proactive risk management, and ethical leadership – moving away from the old “growth at all costs” mindset.

The recent publication by Swiss Re regarding insured losses in the first half of 2025 sends a clear warning signal to the global economy. With significant losses driven by wildfires and Severe Convective Storms, it is becoming increasingly evident that so-called secondary natural perils are no longer secondary in terms of their financial and operational impact. For companies, this means that mere reliance on insurance policies is no longer sufficient. Instead, an integrated strategy comprising Governance, Risk, and Compliance (GRC) is moving into focus to safeguard organizational resilience.

Key Takeaways

• According to Swiss Re, the first half of 2025 recorded massive insured losses, primarily driven by wildfires and severe storms.
• So-called secondary perils are increasingly exceeding traditional primary perils, such as earthquakes or hurricanes, in both frequency and loss magnitude.
• Companies face rising insurance costs while simultaneously confronting potential protection gaps.
• A robust GRC framework is essential to integrate physical climate risks into corporate steering and reporting (e.g., CSRD).
• Business Continuity Management (BCM) must be adapted to the new reality of volatile weather events.

Analysis: From Loss Balance to GRC Strategy

The data provided by Swiss Re highlights a trend that had already emerged in previous years and has reached a new level of intensity in 2025. The increase in extreme weather events can no longer be viewed as a statistical outlier but must be seen as a new normal fueled by climate change. From a Governance, Risk, and Compliance perspective, this results in concrete areas of action that extend far beyond pure insurance management.

Governance: Management Responsibility

In the governance dimension, the responsibility for natural hazards is shifting directly to boardrooms and supervisory boards. It is no longer enough to merely acknowledge climate risks. The fiduciary duties of corporate leadership require an active engagement with the question of how these external shocks threaten the business model in the long term.

Effective governance must ensure that physical climate risks are an integral part of strategic planning. If locations are threatened by wildfires or supply chains are severed by storms, this is not simply „weather-related bad luck,“ but a foreseeable scenario for which leadership must be prepared. Governance here means releasing resources for prevention and aligning the risk strategy with data from reinsurers like Swiss Re.

Risk Management: Reassessing the Risk Landscape

Risk management faces the task of increasing the granularity of its analyses. Swiss Re’s reports show that thunderstorms and hail cause locally confined but financially devastating damage. Traditional risk models, often based on historical averages, fall short here.

Risk managers must conduct scenario analyses that specifically take so-called „Secondary Perils“ into account. This includes not only direct property damage to own buildings or facilities. Often much more critical are the indirect consequences: business interruptions, failure of critical infrastructure (power, water, data lines), and disruptions in the supply chain. Modern risk management must map and quantify these dependencies. Furthermore, companies must verify whether their insurance policies are still adequate or if premium increases and exclusion clauses are creating an economic risk that requires provisions in the balance sheet.

Compliance: Regulatory Pressure and Reporting

The relevance of the Swiss Re data is also evident in compliance, particularly in the context of sustainability reporting. Regulations such as the Corporate Sustainability Reporting Directive (CSRD) in the EU oblige companies to disclose the financial impacts of climate risks.

If a company operates in regions that are particularly affected according to the Swiss Re report (e.g., wildfire-prone areas in North America or Southern Europe), this must be reflected in reporting. Compliance departments must ensure that the physical risks identified in risk management flow correctly into both non-financial and financial reporting. Ignoring this data can be interpreted as greenwashing or misleading capital market communication, entailing significant liability risks.

Business Continuity as an Operational Response

The interface of Risk and Operations is Business Continuity Management (BCM). The high frequency of storms and fires requires more agile BCM plans. Rigid emergency manuals are of little help against dynamic weather patterns. What is required are flexible response mechanisms, redundant supplier structures, and decentralized warehousing to absorb outages. Insights from the first half of 2025 should flow directly into BCM tests and simulations to harden operational resilience.

Conclusion: From Reaction to Preventive Steering

The loss balance of the first half of 2025 underscores impressively that volatility caused by natural hazards is not a temporary phenomenon but a structural change in the risk landscape. For companies, this implies a mandatory paradigm shift. GRC must no longer be understood as an administrative duty in the background but must function as a central, strategic steering instrument.

Only those who anticipate risks instead of merely settling claims, and who use compliance requirements as a quality mark for resilience, will survive in this increasingly uncertain environment in the long term. Investing in an integrated GRC system and engaging with data such as that provided by Swiss Re is thus far more than a cost item. It is the decisive foundation for operational capability and tomorrow’s economic success.

FAQ

What is meant by „Secondary Perils“ as opposed to Primary Perils?

Primary Perils are large-scale events such as tropical cyclones or earthquakes. Secondary Perils are events that often occur more frequently but are more locally confined, such as severe thunderstorms, hail, tornadoes, droughts, or wildfires.

Why is this report relevant for companies that are not insurers?

The data shows that the probability of business interruptions and property damage is rising globally. Companies must adjust their risk precautions as insurance becomes more expensive or certain risks are no longer covered at all. Additionally, regulators demand transparency regarding these risks.

What role does the CSRD play in this context?

The CSRD requires affected companies to perform a Double Materiality analysis. This involves assessing and reporting the financial risks that climate change imposes on the company (outside-in perspective). The increase in natural catastrophes is a central factor in this regard.

How can GRC help reduce insurance costs?

A strong GRC system demonstrates to insurers that the company knows its risks and actively mitigates them (e.g., through preventive fire protection or redundant systems). This can improve the bargaining position when renewing insurance policies.

Organizations today operate in an environment defined by uncertainty, speed, and growing complexity. Strategic decisions, operational execution, and financial performance can no longer be managed independently of risk. This is exactly where Enterprise Risk Management (ERM) comes into play. A modern ERM framework connects strategy, risk, and performance into a single, integrated management approach.

This article explains how to build an effective ERM framework, why linking risk management with strategy is critical, and why ISO 31000 plays a central role in professional Enterprise Risk Management.

Key Takeaways

• ERM is a holistic approach to managing risks and opportunities across the entire organization
• An effective ERM framework systematically connects strategy, risk, and performance
• Risks should be identified and assessed in direct relation to strategic objectives
• Risk appetite and risk tolerances are core steering elements
• ISO 31000 provides the internationally recognized foundation for risk management
• ERM supports better decision-making, resilience, and sustainable performance

What is Enterprise Risk Management (ERM)?

Enterprise Risk Management is a structured, organization-wide approach to identifying, assessing, managing, and monitoring risks and opportunities. Unlike traditional risk management, which is often fragmented and function-specific, ERM looks at the organization’s overall risk profile.

The goal of ERM is not to eliminate risk, but to enable informed decision-making by creating transparency around uncertainty. A mature ERM system helps leaders consciously take risks when they are aligned with strategy and risk appetite.

Why ERM must connect strategy, risk, and performance

Many ERM initiatives fail because risks are assessed independently of the company’s strategy. In reality, risks are a direct consequence of strategic choices. Without this connection, risk management becomes a compliance-driven or reporting-focused exercise.

An integrated ERM approach ensures that:

• strategic objectives define the starting point for risk identification
• risks are prioritized based on their impact on strategic success
• performance indicators are interpreted in the context of underlying risks
• executives and boards make more balanced, higher-quality decisions

Core components of an effective ERM framework

1. Governance and accountability

Effective ERM starts with clear governance structures and defined responsibilities. The board and executive management hold overall accountability, while oversight bodies monitor effectiveness. On an operational level, risk owners are responsible for specific risks.

Most importantly, ERM must be understood as a leadership discipline, not the task of a single department.

2. Linking ERM to corporate strategy

The design of an ERM framework should always begin with strategy. Key questions include:

• What strategic objectives does the organization pursue?
• What assumptions underpin these objectives?
• What uncertainties could threaten or enable success?

Risks should be identified along strategic initiatives rather than organizational silos.

3. Risk identification and assessment

A structured process ensures that both internal and external risks are considered, including:

• strategic risks
• operational risks
• financial risks
• regulatory and legal risks
• technological and digital risks
• ESG and reputational risks

Risks are typically assessed based on likelihood and impact, often complemented by scenario analysis.

4. Risk appetite and risk tolerances

Risk appetite defines how much risk an organization is willing to accept in pursuit of its objectives. It forms the critical link between strategy and day-to-day decision-making.

Clear risk tolerances make risks measurable and manageable and allow deviations to be identified early. Without a defined risk appetite, ERM lacks real impact.

5. Integration into performance management and decision-making

A mature ERM framework is tightly integrated with budgeting, forecasting, and performance management processes. Risks are systematically considered in investment decisions, strategic initiatives, and target-setting.

This creates a consistent and balanced view of performance and risk.

6. Monitoring, reporting, and continuous improvement

ERM is not a one-time project but an ongoing process. Regular monitoring, meaningful reporting, and clearly defined key risk indicators are essential.

At the same time, the framework must be continuously reviewed and adapted to changing internal and external conditions.

The importance of ISO 31000 for Enterprise Risk Management

ISO 31000 is the internationally recognized standard for risk management and forms the conceptual foundation for many ERM frameworks. It is industry-agnostic and applicable to organizations of all sizes.

Why ISO 31000 matters

• It defines clear principles for effective risk management
• It ensures that risk management creates value rather than bureaucracy
• It emphasizes integration into governance, strategy, and processes
• It promotes a common language and consistent methodology across the organization

ISO 31000 does not prescribe rigid rules but provides a flexible framework that can be tailored to specific needs. This makes it ideally suited for ERM.

Key elements of ISO 31000

ISO 31000 is built around three core elements:

• Principles: value creation, integration, structure, adaptability, and continuous improvement
• Framework: governance, roles, resources, and organizational embedding
• Process: risk identification, analysis, evaluation, treatment, monitoring, and communication

An ERM framework aligned with ISO 31000 is credible, auditable, and internationally comparable.

Benefits of an integrated ERM framework

Organizations that use ERM strategically benefit from:

• better and faster decision-making
• greater transparency of critical risks
• increased resilience in times of crisis
• improved capital allocation
• stronger trust from investors and stakeholders
• sustainable long-term performance

ERM thus evolves from a compliance requirement into a true competitive advantage.

Common pitfalls in implementing ERM

• focusing solely on compliance
• lack of top-management support
• missing link to strategy
• overly complex methodologies
• insufficient integration into existing processes

A pragmatic, strategy-driven approach is essential for success.

Conclusion

A modern Enterprise Risk Management framework is far more than a risk register. It is a core management tool that connects strategy, risk, and performance. ISO 31000 provides the proven foundation for building such a framework.

Organizations that embed ERM consistently lay the groundwork for better decisions, greater resilience, and sustainable success in an increasingly uncertain world.

FAQ about Enterprise Risk Management

What is the difference between risk management and ERM?

Traditional risk management often focuses on individual risks or functions. ERM takes a holistic, organization-wide view and directly links risks to strategy and performance.

Is ERM only relevant for large organizations?

No. ERM is valuable for organizations of all sizes. The scope and complexity of the framework should be proportionate to the organization.

What role does ISO 31000 play in ERM?

ISO 31000 provides the principles, framework, and process for professional risk management and serves as a recognized reference standard for ERM.

How complex is it to implement an ERM framework?

The effort depends on size, industry, and maturity level. A pragmatic, phased approach is usually the most effective.

How do you measure the success of ERM?

Success is reflected not only in fewer losses, but primarily in better decisions, higher achievement of objectives, and increased organizational resilience.

The rapid expansion of generative AI is not only changing how organizations use data – it is fundamentally reshaping risk management and compliance strategies. Gartner predicts that by 2028, 50% of all organizations will adopt Zero Trust Data Governance approaches to address the massive growth of unverified, AI-generated data and to mitigate risks such as so-called “AI model collapse.”

This article explains why this shift is happening, what Zero Trust Data Governance really means, which risks organizations face if they do not act – and how companies should respond now.

Key Takeaways

• Gartner predicts that by 2028, 50% of organizations will implement Zero Trust Data Governance due to growing risks from unverified AI-generated data.
• AI model collapse refers to the degradation of AI model quality when models are repeatedly trained on their own, unverified outputs.
• Zero Trust means data can no longer be implicitly trusted; verification, authentication, and active metadata management become essential.
• Organizations must act by defining clear ownership, building cross-functional teams, updating governance frameworks, and investing in metadata and governance tooling.

Why Now? The Data and AI Transformation

Organizations are significantly increasing their investments in generative AI. As AI adoption accelerates across business functions, two major challenges emerge.

The Rapid Growth of Unverified AI-Generated Data

AI models are increasingly trained on data that already contains AI-generated content, whether from earlier models, automated pipelines, or poorly classified data sources. When models are repeatedly trained on such unverified data, the risk of AI model collapse increases.

Large Language Models may gradually lose accuracy, amplify bias, and reinforce errors because they are effectively learning from their own outputs. Over time, this erodes trust in AI-driven insights while creating a false sense of reliability.

What Is Zero Trust Data Governance?

Traditional data governance often assumes that internal data is trustworthy by default. In the age of generative AI, this assumption no longer holds.

Zero Trust Data Governance is based on a fundamentally different principle:

• No data source is trusted by default
• Every dataset must be verified and authenticated
• Metadata is used to track data origin, quality, usage, and risk
• Data is continuously monitored, not approved once and forgotten

Data is considered trustworthy only after it has passed defined validation and governance controls.

Risks of Ignoring Zero Trust Data Governance

Organizations that continue to rely on implicit data trust face several serious risks.

AI Model Degradation

Without strict governance, AI models may increasingly rely on low-quality or recursive training data, leading to declining accuracy and unreliable outputs.

Compliance and Regulatory Exposure

As regulations around AI transparency, data provenance, and accountability evolve, organizations without clear data lineage and verification mechanisms face audit findings, penalties, and legal risks.

Loss of Business Trust

Decisions based on unreliable data undermine strategic planning, financial performance, and organizational credibility.

How Organizations Should Respond

1. Establish Clear Accountability

Organizations should introduce a dedicated role such as an AI Governance Lead who oversees AI-related data governance, risk management, and compliance initiatives.

2. Build Cross-Functional Governance Teams

Data, analytics, IT security, compliance, risk management, and business stakeholders must collaborate closely to manage AI-related data risks holistically.

3. Extend Existing Governance Frameworks

Current data governance models should be expanded to include Zero Trust principles, enhanced security controls, metadata governance, and ethical guidelines for AI usage.

4. Implement Active Metadata Management

Metadata becomes a central control mechanism. Organizations need solutions that automatically capture, analyze, and monitor data origin, quality, access, and risk indicators.

5. Invest in Skills and Technology

Zero Trust Data Governance requires skilled data stewards, governance professionals, and modern platforms capable of operationalizing governance at scale.

Conclusion

The rise of generative AI is not just increasing data volumes – it fundamentally challenges the notion of data trust. Gartner makes it clear that organizations without Zero Trust Data Governance expose themselves to growing risks, including AI model degradation, compliance gaps, and strategic missteps.

In 2026, Zero Trust Data Governance is no longer optional. It is a foundational requirement for trustworthy AI, reliable decision-making, and resilient governance structures.

Frequently Asked Questions (FAQ)

What is Zero Trust Data Governance?
Zero Trust Data Governance means that data is never trusted by default. Every dataset must be verified, authenticated, and continuously monitored before it is used.

What is AI model collapse?
AI model collapse describes the risk that AI models lose quality and reliability when they are repeatedly trained on their own, unverified AI-generated outputs.

Why is this a GRC issue?
Data quality, provenance, and trust directly impact risk management, compliance, audit readiness, and executive decision-making.

When does Zero Trust Data Governance become relevant?
Adoption is accelerating now. For many organizations, 2026 is the point at which governance strategies must be fundamentally re-designed to remain effective.

The debate around artificial intelligence has entered a new phase with the rise of OpenClaw. OpenClaw is an open-source AI agent that goes far beyond traditional chat functionality and is capable of executing actions independently within process environments. Unlike traditional assistant AI systems, OpenClaw does not merely respond to queries but can carry out linked tasks autonomously — from processing emails and managing appointments to controlling applications.

This new form of “agentic AI” is already transforming how AI is used in digital work environments. At the same time, it raises significant questions regarding governance, risk, and compliance (GRC).

Key Takeaways

• What is OpenClaw?
  OpenClaw is an open-source AI agent capable of executing autonomous actions on systems once appropriate access rights are granted. It combines AI models with direct access to local resources, messaging interfaces, and external services.
• New types of risk:
  Due to its ability to perform tasks without continuous human supervision, OpenClaw can process sensitive data, trigger actions, and access IT infrastructures. This introduces new security, data protection, and liability risks.
• Compliance implications:
  Companies are legally responsible for the behavior of their AI agents. If autonomous agents violate regulations, the company is liable as if an employee had performed the action.
• Governance challenge:
  Traditional governance models are often insufficient when AI systems do not merely provide recommendations but take action. Organizations require new frameworks to control and monitor autonomous AI systems.
• Recommended action:
  Before productive deployment, companies must establish clear policies, risk assessments, permission models, and control mechanisms to prevent misuse, data breaches, or unintended automation.

What Is OpenClaw and Why Is It Relevant?

OpenClaw is a framework for building so-called agentic AI assistants — systems that not only generate responses but independently execute actions. Traditional AI models answer questions or generate content but remain passive. OpenClaw, by contrast, combines AI logic with direct system access, for example via messaging apps, to execute tasks, process data, or interact with external services.

Its defining feature is autonomy: OpenClaw can pursue goals, manage workflows automatically, and adapt to changing contexts without continuous human supervision.

Governance Perspective: Control Frameworks for Autonomous AI

Evolving Governance Requirements

Traditional governance models assume that technology is controlled by humans. With systems like OpenClaw, this assumption becomes limited. When AI acts autonomously, critical questions arise:

• Who decides which permissions an agent receives?
• What level of risk is acceptable for autonomous execution?
• How can organizations ensure that actions are traceable and auditable?

Governance must therefore go beyond classical IT controls and incorporate autonomous behavior management.

Roles and Responsibilities

An effective governance framework should clearly define:

• Responsible individuals and committees for approving and supervising autonomous AI actions
• Approval processes for permissions and system access
• Audit and review mechanisms to track messages, data access, and executed actions

Without such structures, a governance gap may emerge in which agents operate unchecked and management can only react after the fact.

Risk Management: Security, Operational, and Data Risks

The use of OpenClaw introduces specific risks.

Security and Cyber Risk

Autonomous AI agents may access local files, communication channels, and external APIs. This significantly expands the attack surface because:

• Malicious actors may disguise harmful code as “skills”
• Agents may obtain system-wide privileges
• Complex permission structures may facilitate data leaks and misuse

These risks require thorough security assessments, network segmentation, and continuous monitoring of AI activity.

Data Protection and Privacy

Since autonomous agents can read, process, and transmit data, organizations must verify that such activities comply with data protection regulations. This includes:

• Lawful data processing and purpose limitation
• Control over sensitive information
• Transparent logging of all access activities

Violations can result in significant legal and reputational consequences.

Compliance: Legal and Regulatory Considerations

Legal Accountability

When an AI agent acts autonomously, its actions are legally attributed to the company. Organizations must therefore:

• Comply with applicable legal frameworks
• Clarify liability questions
• Adapt compliance policies to autonomous AI systems

This may affect data protection law, commercial law, and competition regulations.

Internal Policies and Controls

Compliance requires clear internal rules defining:

• Which systems may interact with autonomous agents
• Which tasks may be automated
• How permissions and access are documented

Without clear governance, the risk increases that agents operate beyond approved boundaries.

Preparation and Best Practices for Deployment

To responsibly use OpenClaw-like systems, organizations should:

1. Adapt their governance framework to include AI autonomy, approval processes, and accountability structures.
2. Conduct comprehensive risk assessments before deployment.
3. Apply the principle of least privilege and strict permission models.
4. Implement monitoring and logging mechanisms to track AI actions.
5. Provide training and change management to ensure that leadership and employees understand the implications of autonomous AI.

Conclusion

OpenClaw represents an early example of a new generation of AI agents that do not merely inform but act. For organizations, this marks a paradigm shift. Established governance and compliance models are no longer sufficient. Companies must rethink control mechanisms, establish new policies for autonomous AI, and actively manage emerging risks.

At the same time, this technology offers efficiency gains and new automation potential — but only when embedded within a robust and responsible GRC framework.

FAQ

1. What differentiates OpenClaw from traditional AI tools?
OpenClaw can not only generate responses but autonomously execute tasks, such as processing emails, controlling applications, or initiating actions when permissions are granted.

2. Why is governance particularly important here?
Because autonomous actions represent real operational decisions, not just recommendations. Without clear oversight, unintended and non-traceable outcomes may occur.

3. What risks do autonomous AI agents introduce?
Security vulnerabilities, data protection breaches, compliance violations, and legal liability may arise if agents operate without sufficient control.

4. How can companies start safely?
By implementing a structured governance framework, conducting risk assessments, limiting permissions, and ensuring continuous monitoring.

5. Are autonomous AI agents suitable for all departments?
Not necessarily. Areas with high compliance requirements or sensitive data should proceed with particular caution.

2026 marks a turning point for governance, risk and compliance in organizations. What was long perceived as a reactive control function is increasingly evolving into a strategic enabler of resilience, innovation and sustainable corporate management.

The environment in which organizations operate is becoming more complex: new regulatory requirements, digital transformation, global uncertainty and rapid technological change are pushing GRC functions into new roles and responsibilities.

This article outlines the key trends that will shape GRC in 2026 and explains how organizations must prepare strategically in order not only to remain compliant, but to create real competitive advantage through GRC.

Key Takeaways

• In 2026, GRC will no longer be viewed solely as a control function but as a strategic driver of resilience, innovation and value creation.
• AI governance and automation will become central elements for identifying and even predicting risks at an early stage.
• Cybersecurity and operational resilience will continue to move to the top of board-level agendas.
• The integration of ESG factors and supply chain resilience will become a mandatory component of any GRC strategy.
• Increasing regulatory complexity will require integrated compliance systems rather than fragmented solutions.
• Data quality, ethics, culture and continuous compliance will become competitive differentiators.
• Organizations must implement predictive risk strategies instead of acting purely reactively.
• Advanced technologies such as RegTech, autonomous GRC workflows and real-time monitoring will gain prominence.

Why 2026 Is a Defining Year for GRC

In recent years, regulatory requirements and global risks have expanded significantly: from sustainability reporting and AI regulation to cyber and supply chain risks. At the same time, digital transformation is accelerating, and many organizations are increasingly embedding AI and automation into core business processes.

This dynamic forces organizations to stop viewing GRC as an isolated infrastructure function and instead treat it as an integral part of strategic management and decision-making.

The Most Important GRC Trends for 2026

1. Governance Becomes Strategic, Not Just Rule-Based

Governance is shifting from pure oversight of rule-compliant processes to a framework that promotes transparency, accountability and decision quality. GRC will increasingly be expected to shape risk responses proactively rather than merely document risks. Boards demand clear, action-oriented risk reporting instead of static risk inventories.

2. AI Governance and Intelligent Automation

Artificial intelligence will be deeply embedded in GRC processes by 2026. Generative and agentic AI systems will not only process data but also identify risks, automate compliance testing, simulate scenarios and uncover governance gaps. Organizations will need governance frameworks capable of controlling, monitoring and auditing these systems.

3. Cyber Risk as a Governance and Resilience Issue

Cybersecurity is no longer a purely technical discipline; it is a central governance risk. Cyber risks are intertwined with supply chains, third-party dependencies and operational resilience. Organizations must establish integrated risk management frameworks that connect cyber, operations and compliance.

4. Integrated, Data-Driven GRC Platforms

Instead of siloed departments and isolated tools, integrated GRC platforms will become the norm. These platforms unify risk management, compliance, audit, data quality, RegTech and reporting within a coherent system. Data quality becomes foundational, as AI and automation can only produce reliable insights when based on robust data.

5. ESG and Supply Chain Resilience

Sustainability, social responsibility and governance aspects such as human rights in supply chains are no longer optional add-ons. They are regulatory and stakeholder-driven imperatives. Organizations must embed ESG risks into governance and risk strategies while strengthening supply chain resilience.

6. Increasing Regulatory Complexity and Global Requirements

The regulatory landscape continues to grow more complex, with overlapping requirements across regions and industries. Organizations must move from periodic compliance reviews to continuous compliance monitoring to consistently demonstrate adherence to current regulations. This requires automated mechanisms, real-time auditing capabilities and flexible compliance models.

7. Ethics, Culture and Human-Centered Governance

While technology dominates the agenda, the human factor remains decisive. A risk-aware culture in which ethical behavior, accountability and transparency are practiced daily becomes a key competitive differentiator. Governance must operationalize ethical principles and integrate them into decision-making processes.

8. Predictive Risk Strategies and Scenario Planning

Rather than simply identifying risks, organizations must anticipate them and simulate their responses. Advanced analytics, machine learning and scenario testing enable companies to predict risks, prioritize effectively and develop resilient strategies.

How Organizations Must Prepare

To capitalize on these trends, organizations should take several strategic steps:

• Reposition GRC as a strategic function rather than a compliance taskforce.
• Develop AI governance frameworks including policies, control mechanisms and audit structures.
• Integrate cyber risks holistically into enterprise risk management and business continuity planning.
• Invest in integrated GRC platforms with real-time monitoring capabilities.
• Embed ESG and supply chain resilience into GRC processes.
• Foster a risk-aware and ethically grounded corporate culture.
• Establish data quality and model governance as foundational pillars.
• Operationalize predictive risk analytics and scenario planning.

Conclusion

2026 will be a year in which governance, risk and compliance move beyond reactive obligation programs and become active drivers of organizational success. Companies that strategically align their GRC functions, responsibly integrate technology and view governance, risk and compliance as an interconnected system will be more robust, resilient and trustworthy in the long term.

FAQ

What does GRC mean in 2026?
GRC is no longer merely a control mechanism but a strategic function that integrates risk, compliance, ethics and resilience.

Why has AI governance become so important?
Because AI systems no longer just analyze data; they influence decisions and can automatically identify or even trigger risk scenarios.

How is cyber risk connected to GRC?
Cyber risks directly affect governance responsibilities, resilience and compliance, as they impact operations and regulatory obligations.

What does an integrated GRC platform mean?
It refers to a unified system that combines data, risk insights, compliance controls, audit functions and reporting to eliminate silos.

How can organizations prepare for these trends?
Through strategic planning, data-driven risk management, investment in modern GRC systems and cultivating a culture that integrates risk awareness and ethics into decision-making.

If you would like, I can also provide an English LinkedIn teaser or adapt the article into a more executive-level version.