Governance Risk Compliance

Audit, Risk & Compliance (ARC): The Three Pillars of Strong Governance "Let me explain why Audit, Risk, and Compliance aren’t just checkboxes—they’re your governance backbone." I’ve had this conversation many times with peers, clients, and boards. And here’s what I often say when someone asks, “How do you build strong governance?” You start with ARC: - Audit - Risk Management - Compliance Each has its role, but when aligned, they become a strategic force. Let me walk you through it from experience: 🔍 Audit is your independent lens. Think of Audit as the team that tells you what’s happening. Their job is to verify that controls are working not just existing on paper. ▶ Example: I once saw an internal audit uncover a $500K billing discrepancy no one had noticed. That wasn’t just cost savings it was a control failure caught before it became reputational damage. The best audit teams today use data analytics and real-time assurance tools to stay ahead. Traditional static audits no longer suffice. ⚠️ Risk is your radar. Risk Management isn’t about stopping risk, it’s about knowing which risks matter, and how much risk you can take to grow. I’ve seen risk teams run scenario analyses ahead of market expansion that flagged FX volatility. With a solid hedging plan, they avoided a 7% EBITDA hit. That’s what proactive risk management looks like. And right now? The strongest risk programs I’ve seen are integrating AI, ESG risk, and third-party oversight into their frameworks. ✅ Compliance is your moral and legal compass. Compliance isn’t just about avoiding fines. It’s about building trust internally and externally. A solid compliance program is the reason one company I worked with navigated new data privacy regulations across multiple countries without missing a beat or getting penalized. What’s changing? Compliance is becoming more automated, more behavior-driven, and more global. And that means compliance officers need better tech and a seat at the strategy table. Now here’s the key: ARC only works when it's integrated. When Audit, Risk, and Compliance operate in silos, things fall through the cracks. But when they collaborate sharing insights, aligning priorities, and using common platforms governance becomes a value driver. A recent PwC survey backs this up: - 73% of execs say ARC alignment improves decision-making - 65% plan to invest in integrated GRC platforms - Over half say Internal Audit is now a transformation partner If you’re leading or supporting ARC functions, my advice is simple: Don’t build walls, build bridges. The future of governance isn’t in functions. It’s in how those functions work together. Let me know how ARC works in your organization today. Do the functions collaborate, or still operate in silos? #Governance #InternalAudit #RiskManagement #Compliance #GRC #BoardEffectiveness #OperationalResilience #Leadership #3prm #tprm #GovernanceExcellence #RiskStrategy #ComplianceCulture

When boards ignore technical judgment, AI spending turns into sunk cost AI budgets are moving into very large numbers while real returns remain limited. Leaders are locking organizations into architectures where cost grows faster than value. The outcome is predictable because spending momentum overrides technical reality. The outlook is simple. Large language models continue to receive funding beyond their business usefulness because markets reward visible investment rather than operational fit. This is happening because boards optimize for signaling instead of deployment results. This means: capital efficiency declines while delivery teams carry the burden. Legacy AI programs are prone to fail because expert warnings arrive late and are treated as resistance rather than risk. This disconnects governance from what actually happens during execution. Replacing domain experts maintains the appearance of stability but erodes learning. When failures are not owned, the same mistakes repeat. One practical place to begin is to audit decisions where AI output directly affects cost or compliance. Avoid using AI where response time or explainability cannot be guaranteed. Using AI to justify spending looks modern but operating with AI requires facing uncomfortable realities. #AIStrategy #EnterpriseAI #BoardGovernance #AIInvestment #TechLeadership #OperationalAI #CapitalAllocation #DecisionMaking #AIReality #FounderPerspective #BusinessOutcomes #AIFirst

Most boardroom failures are not failures of knowledge. The information was there. The expertise was in the room. The warning signs were visible, often to multiple people, often for a considerable period of time before the crisis became undeniable. What was missing was not intelligence or experience. It was a voice. I have spent years studying how boards and leadership teams make decisions under pressure. And one pattern shows up with a consistency that I still find sobering: the single most common precondition for serious governance failure is not incompetence. It is silence. Habitual, culturally embedded, professionally rational silence. A piece recently published in Board Agenda® puts this precisely. Directors are, by and large, conscientious people who want to do the right thing. But when concerns arise, many hesitate. The personal and professional risks of speaking up feel high, the benefits feel uncertain and so legitimate warnings go unspoken while the problem proceeds. The calculation is almost always wrong. Directors tend to overestimate what speaking up will cost them, and systematically underestimate what staying silent will cost the organization. But the calculation feels rational in the moment and feelings of rationality are remarkably persuasive, even when they are misleading. This is not a problem that more regulation fixes. Thick binders of ethical codes and improved governance frameworks have not eliminated it. The problem is cultural and culture is changed by behaviour, not by policy. The first step is honesty about the gap between the board culture that exists and the one that is needed. That gap is measurable. And measuring it is where the work begins. #BoardEffectiveness #Governance #PsychologicalSafety #OrganizationalBehaviour #Leadership

"this toolkit shows you how to identify, monitor and mitigate the ‘hidden’ behavioural and organisational risks associated with AI roll-outs. These are the unintended consequences that can arise from how well-intentioned people, teams and organisations interact with AI solutions. Who is this toolkit for? This toolkit is designed for individuals and teams responsible for implementing AI tools and services within organisations and those involved in AI governance. It is intended to be used once you have identified a clear business need for an AI tool and want to ensure that your tool is set up for success. If an AI solution has already been implemented within your organisation, you can use this toolkit to assess risks posed and design a holistic risk management approach. You can use the Mitigating Hidden AI Risks Toolkit to: • Assess the barriers your target users and organisation may experience to using your tool safely and responsibly • Pre-empt the behavioural and organisational risks that could emerge from scaling your AI tools • Develop robust risk management approaches and mitigation strategies to support users, teams and organisations to use your tool safely and responsibly • Design effective AI safety training programmes for your users • Monitor and evaluate the effectiveness of your risk mitigations to ensure you not only minimise risk, but maximise the positive impact of your tool for your organisation" A very practical guide to behavioural considerations in managing risk by Dr Moira Nicolson and others at the UK Cabinet Office, which builds on the MIT AI Risk Repository.

This isn’t an airline story. It’s a regulation story. Last week’s airline chaos is a preview of DPDP non-compliance. Rules were announced years in advance. Deadlines were clearly communicated. The intent was never a surprise. Yet when enforcement kicked in, India saw: • Thousands of flights cancelled • Passengers stranded across cities • One airline facing massive, visible reputational damage Operational issues will get fixed. Compliance gaps will close. Reputation loss is permanent memory. Now shift this lens to DPDP in India. The Digital Personal Data Protection (DPDP) Act is not upcoming news. It is already in motion. Important timelines every CXO, CISO, Founder, and business owner must note: • Data Protection Board of India is already operational • Penalties can go up to ₹250 crore for failing to protect personal data • Consent, breach reporting, security safeguards, and data principal rights go live by May 2027 This is not a legal checkbox. This is not an IT-only problem. This is a business survival issue. Airlines had time to prepare for FDTL. Some treated it seriously. Some didn’t. The outcome was chaos, government intervention, and severe brand erosion. For large enterprises, DPDP non-compliance will mean: • Regulatory scrutiny • Mandatory breach disclosures • Long-term trust erosion with customers For smaller organisations, one serious violation can mean: • Loss of customer confidence • Public exposure • Business closure DPDP is ultimately about trust. And trust, once broken, rarely comes back. If DPDP is still sitting on a future roadmap slide in your organisation, you’re already late. Solutions like Seqrite’s DPDP readiness framework are designed to help organisations move from awareness to execution early, without panic when enforcement begins. Regulations don’t hurt businesses. Unprepared businesses do. The timelines are clear. The warning signs are visible. The clock is ticking. If this resonates, forward it to the right owner in your organization before deadlines do the talking. #DPDP #DataProtection #DataPrivacy #CyberSecurity #RegTech #IndiaTech #RiskManagement #Compliance #CISO #CXO #DigitalTrust #DataGovernance #EnterpriseSecurity #InformationSecurity

Early-stage founders often treat finance and legal compliances as afterthoughts and consider them relevant only for late-stage companies. Compliance and fiduciary discipline should be ingrained in the startup's DNA right from the beginning. In this article, we highlight 7 common mistakes made by founders: 1. Not reconciling cash with P&L: Cash is the ultimate truth. While different business models require revenue recognition differently, cash is what decides the runway. Reconciling bank statements with cash balances indicated in financial statements is a fundamental control check that should never be overlooked. 2. Treating Compliance as a one time process: Compliance controls should not be reserved only for fundraising events. Founders must work on compliance every month at the minimum, or run the risk of too little too late. 3. Not balancing outsourcing and in-house capabilities: While it is acceptable to outsource compliance functions to external parties initially, it is essential to build these capabilities in-house as the company scales. Over-reliance on external parties can become a bottleneck in the long run, hindering agility and responsiveness to changing compliance requirements. 4. Not considering long-term impacts of ignoring compliance: Focusing solely on short-term cash flow optimisation without considering long-term impacts can be harmful. Ignoring long-term consequences may lead to lower employee morale and confidence in the startup. 5. Not factoring in the true cost of non-compliance: Compliance is often seen as a low-cost item, but the consequences of non-compliance can be significantly high once a breach occurs. Founders should be transparent with investors and advisors about compliance efforts and challenges. Treating compliance as a critical Board agenda item allows experienced Board members to guide and provide alternatives for prompt course correction. 6. Not staying informed on regulatory changes: The regulatory environment constantly evolves, and founders must remain aware of the latest updates. Being well-informed about regulatory changes can turn challenges into opportunities, such as accessing government subsidies, tax breaks, or lower tax rates. Proactive awareness of regulatory changes can give the startup a competitive edge. 7. Not driving improvement of reporting quality: Quality reporting is an ongoing journey for startups. Founders should understand that reporting is not a one-time task; it requires constant improvement. In the fast-paced and ever-evolving startup ecosystem, finance and legal compliances are crucial in ensuring a company's success and growth. By incorporating best practices and avoiding common compliance mistakes, founders can position their startups for sustainable growth and build a strong foundation for success. Shashank Singh Divij Gupta, CFA Nikhil Patil #compliance #financialdiscipline #earlystagestartups #earlystageinvesting

Most model risk frameworks were built to govern predictions. Agentic systems are designed to take actions. That distinction is becoming increasingly important as financial institutions move from isolated AI models toward AI-enabled workflows capable of initiating decisions, triggering processes, interacting with tools, and operating across multiple systems. The challenge is that many governance structures still focus primarily on the model itself: accuracy, validation, explainability, and monitoring. Those controls still matter. But in agentic environments, the real operational risk increasingly sits elsewhere: in orchestration layers, delegated authority, escalation pathways, tool usage, and end-to-end decision flows. In the latest edition of The Data Science Decoder, I explore why traditional model risk frameworks need to evolve for agentic systems and why governance must expand from “model governance” toward “decision-system governance.” The article examines: 💠 where existing MRM approaches still work 💠 where they begin to break down 💠 and what firms should prepare for now This matters because the next generation of AI failures in regulated industries may not come from inaccurate models alone, but from poorly governed autonomous workflows operating inside complex enterprise environments. Curious to hear how others are thinking about governance boundaries, escalation design, and runtime oversight as AI systems become more operationally autonomous.

A founder I know had been building for three years... Strong product. Growing team. Investors were circling. She had everything she needed to expand into the UK market and finally hit the revenue milestone she'd been chasing since day one. Then due diligence started. No documented data privacy policy. Governance gaps the legal team flagged immediately. Security controls that looked fine internally but couldn't survive external scrutiny. The investor didn't walk away. But the close took four extra months, two law firms, and more money than she'd budgeted for the entire expansion. Four months. In a scaling company, that's an eternity. The thing nobody tells you when you're heads-down building: The dream: new markets, bigger contracts, faster raises, compounding revenue, doesn't get unlocked by ambition alone. It gets unlocked by infrastructure. The quiet, unglamorous work of setting up a GRC framework before you need one. ✅ Governance that shows investors you can be trusted with capital. ✅ Risk controls that let you enter new markets without scrambling. ✅ Compliance structures that close enterprise deals instead of delaying them. That founder got there eventually. But she'll tell you herself, the founders who scaled past her that year weren't smarter or better funded. They just had their house in order before the opportunity knocked. Compliance isn't what slows companies down. The absence of it is. #StartupGrowth #Compliance #GRC #FounderMindset

Rumors of the death of US privacy enforcement were premature. ⬇️ Recap of the 5 myths busted on privacy in the US for non-US companies, from my presentation at the Naschitz, Brandes, Amir & Co. - AYR - Amar Reiter Jeanne Shochatovitch & Co. Privacy Day event: Myth 1: I'm under the radar so I'm safe from enforcement -> No, you're not. 🟣Regulators are enforcing against non-US entities with zero boots on the ground. (FTC in Avast & non-public FTC investigations).  🟣The US State privacy laws are also extra-territorial in application. 🟣Your competitors are telling on you to regulators.   🟣Your clients are less inclined to engage you because they are (more) worried about their own compliance. 🟣Private plaintiffs and classes are filing thousands of lawsuits. Myth 2: I can deal with it later  -> Later may be too late.  🟣Buyers (in M&A deals) are increasingly looking into privacy earlier and in more depth.   🟣Customers prefer someone that makes it easy for them to comply with their own higher privacy risk (If they need a DPIA (risk assessment) or a third party bias audit (for AI use) and you don't have one, they will look for someone who does).  🟣Sometimes too late is too late and  without the right setup in place the defect is not curable. (DoorDash case). Myth 3: US privacy is "inadequate" and the Trump Admin doesn't care  -> No US enforcement is very complex, and active.   🟣The FTC is enforcing seriously with a focus in sensitive data, children's data, auto-renewal, pricing, fake reviews, "AI washing" and more.  🟣Sectoral laws like HIPAA (for health data) are being enforced, including for cookies.  🟣50 states have consumer protection laws that apply to privacy violations  🟣20 states have privacy laws, issuing $3 billion in fines in 2025. 🟣California has new CCPA regulations with requirements on cyber audits, DPIA, and transparency. Texas, Connecticut, Oregon and others are enforcing.  🟣Lots of class action lawsuits on all types of violations including: websites, chatbots, health data and biometrics.  Myth 4: US AI regulation is "inadequate" & Trump Admin doesn't care  -> No There are A LOT of difference state laws on AI and Federal may be coming.  🟣There are a number of dedicated AI laws like the Colorado AI Act & Texas TRAIGA. 🟣There AI disclosure, deepfake, AI Companion & transparency in training data laws. 🟣The Executive Order on AI envisions a preemptive, Federal AI law and encourages Congress to get there. Myth 5:  "I did GDPR so I'm fine" -> No.  US laws are different, and GDPR doesn't cover you. 🟣Different privacy notice, DPA and privacy rights.   🟣You need more DPIAs than under GDPR; they need to be more robust, and, in California, your C-Suite needs to submit confirmation, under penalty of perjury, that your DPIAs are in order.  🟣You need to deal with biometrics laws and children's data laws.   🟣US AI enforcement is strict and is already in play in the US. Thank you Dalit and Eyal for inviting me!  

Wildwood Surgical Center waited over a year to notify patients after a June 2025 network breach exposed Social Security numbers and medical records to an unauthorised third party. The Toledo facility discovered suspicious activity in June 2025 but sent notification letters in July 2026. The compromised data includes diagnoses, treatment details and financial information, creating severe identity theft risks. This delay highlights a persistent operational flaw in healthcare cybersecurity. Organisations often prioritise containment and legal consultation over immediate transparency, treating notification as a compliance exercise rather than a critical component of patient care and trust. Yet, the deeper vulnerability lies in data architecture. Storing highly sensitive diagnostic records alongside routine billing information on the same accessible network ensures that a single perimeter failure compromises everything from medical history to bank accounts. Audit your data storage architecture immediately. Separate clinical records from financial and personally identifiable information, enforcing strict access controls so a breach in one domain cannot cascade into another. Protecting patient data requires much more than just strong firewalls; it demands intelligent separation so that a single point of failure never destroys an entire life. #CyberSecurity #DataPrivacy #Healthcare