Karmine Consulting

Author: Karmine Team

  • Part 7: MANAGING INSIDER RISKS IN GROWING ORGANISATIONS

    Part 7: MANAGING INSIDER RISKS IN GROWING ORGANISATIONS

    Introduction

    When it comes to risk management, mid-sized listed companies often focus on external threats—cyberattacks, market volatility, regulatory changes. Yet, one of the most damaging risks can come from within: insider risk, where employees or trusted parties collude to commit fraud.

    Insiders are behind a significant share of corporate fraud and data breaches, costing businesses millions. A recent global study by the Association of Certified Fraud Examiners (ACFE) found that organizations typically lose 5% of their annual revenue to occupational fraud (which by definition involves insiders), with total losses exceeding$3 billion in the cases studied. The median loss per internal fraud case was$145,000—a hefty hit for a mid-sized firm. Losses as a percentage of revenue tend to be higher in smaller organizations than in large enterprises.

    In short, the threat from within can be as damaging as any external attack, yet it doesn’t always get the attention it deserves.

    Defining the Insider Threat Spectrum

    Insider threats span a spectrum of behaviors—malicious, conflicted, fraudulent, or negligent—each with distinct triggers and impacts. Understanding these typologies is essential for proactive risk management.

    Malicious Insiders

    Malicious insiders intentionally harm the organization through actions like data theft or sabotage. Triggers include financial distress, disgruntlement, or external coercion. For example, an IT administrator at a mid-cap tech firm might leak customer data to a competitor for financial gain, exploiting elevated access privileges. The 2025 Ponemon Institute report noted that 27% of insider incidents involve deliberate data exfiltration, costing$15.3 million on average.

    Conflicted Insiders

    Conflicted insiders prioritize personal gain through undisclosed vendor ties or related-party deals. Triggers include personal relationships or financial incentives. A 2023 EY Fraud Survey found 38% of fraud cases in mid-caps involve conflicts of interest, such as a procurement officer awarding contracts to a relative’s firm without disclosure. Weak oversight exacerbates these risks, as mid-caps often lack automated vendor screening.

    Silent Fraud

    Silent fraud involves subtle misconduct, such as skimming, expense misreporting, or privilege abuse, often enabled by weak controls. For instance, an employee inflating expense reports might go undetected without automated reconciliation, draining resources over time.

    Negligent Insiders

    Negligent insiders cause harm through human error or poor control hygiene, such as clicking phishing links or mishandling sensitive data. For example, an employee downloading malware via an unverified link could expose customer data, leading to costly breaches.

    Third-Party Threats

    Contractors or vendors who have inside access can compromise security, either intentionally or via lax practices.

    Why Growing Companies Are Especially Vulnerable

    Growing companies are often large enough to present ample opportunities for internal fraud, but they may not yet have the robust controls and corporate governance that mature enterprises deploy. Rapid growth can strain internal processes. New departments, higher transaction volumes, and more employees may outpace the development of a strong control environment.

    Informal Trust Culture

    Tight-knit teams often prioritize harmony over scrutiny. Employees hesitate to report colleagues, fearing conflict or disruption. Without formal escalation channels, early red flags go unnoticed. A study found 60% of employees avoid reporting conflicts of interest to preserve team dynamics, underscoring how silence becomes the norm in trust-heavy environments.

    Limited GRC Resources and Budget Constraints

    Most mid-sized companies operate with lean GRC teams. Budget constraints hinder investment in fraud detection tools like user behavior analytics or real-time alert systems. According to ACFE’s 2024 study, over half of all fraud cases occur due to weak or overridden internal controls—a risk magnified in firms lacking dedicated compliance capacity.Most mid-sized companies operate with lean GRC teams. Budget constraints hinder investment in fraud detection tools like user behavior analytics or real-time alert systems. According to ACFE’s 2024 study, over half of all fraud cases occur due to weak or overridden internal controls—a risk magnified in firms lacking dedicated compliance capacity.

    Blind Trust in Long-Serving Employees

    Familiarity breeds complacency. Many insider incidents involve staff considered loyal or beyond suspicion. The Ponemon Institute found that 1 in 5 insider frauds involved “trusted” employees exploiting privileged access. When firms equate tenure with integrity, they often ignore the need for independent oversight or segregation of duties, leaving room for misconduct.

    Compliance Gaps in Listed Mid-Caps

    Being publicly listed doesn’t guarantee governance maturity. Many mid-cap firms face regulatory obligations without scaled internal systems to meet them. A 2024 survey showed 55% of listed mid-sized firms lacked robust compliance frameworks, increasing exposure to fraud, conflicts of interest, and enforcement risks.

    Neglect of Insider Behavior Monitoring

    While external threats like cyberattacks, audits, and investor scrutiny often dominate risk discussions, internal behavior in mid-sized firms remains largely unmonitored. A 2024 report found that while insiders were involved in 60% of data breaches, only 25% of companies regularly monitor user activity. This oversight gap allows repeated privilege abuse or policy violations to slip through undetected.

    Cultural Resistance to Monitoring Tools

    Employee pushback is common when firms try to implement tracking tools. In trust-driven environments, monitoring feels intrusive and misaligned with the culture. A recent survey revealed that 63% of employees would consider leaving their company if strict monitoring measures were put in place. This resistance slows adoption of essential controls like access logging or behavioral alerts.

    Overlapping Roles and Conflicts of Interest

    In mid-sized setups, employees often wear multiple hats, including approving vendors, processing payments, and handling reconciliations. This lack of segregation weakens internal checks. ACFE reports that 42% of frauds stem from the absence or override of internal controls, such as dual approval or independent reviews.

    Manual Workflows and Silent Fraud

    Email-based processes, spreadsheet approvals, and informal reimbursements create room for “quiet” fraud. Without automated alerts or audit trails, misconduct can persist unnoticed. A 2025 Bloomberg case revealed how a mid-sized retailer lost$1.8 million over two years through undetected expense fraud, highlighting the cost of informal systems.

    Regulatory Burden Without Execution Support

    Compliance demands are growing, but mid-sized firms often lack the structure to execute. From data protection to ESG, obligations now rival those of large enterprises, without matching resources. The U.S. Chamber of Commerce noted in 2024 that 51% of small and mid-sized businesses see regulation as a key operational burden.

    Overreliance on Financial Audits

    Annual audits offer false comfort. ACFE data shows external auditors detect only 3% of fraud cases. Behavioral misconduct like override abuse or insider collusion rarely shows up in financial statements. Without internal controls focused on behavior, red flags remain buried in day-to-day operations.

    Mitigating Insider Risk

    Mid-sized firms often walk a tightrope between agility and oversight. With lean GRC teams, fast-moving operations, and high dependence on trust, insider risk becomes a quiet but potent threat, often surfacing only after the damage is done. Fortunately, leading companies are showing how risk exposure can be materially reduced through deliberate, scalable steps:

    1. Build Professional Skepticism Across Vulnerable Functions The absence of healthy doubt is a core enabler of internal fraud. Teams often trust colleagues or assume “it must have been reviewed.” Embedding professional skepticism via training, risk orientation, and scenario-based workshops can shift the mindset from “compliance” to “risk management.” For example, a Southeast Asian mid-cap embedded a red-flag checklist in monthly reviews, flagging odd vendor payment cycles, duplicate invoices, and large round-number payments, unearthing a 3-year-old ghost vendor scheme.
    2. Layer Forensic Thinking Into Control Design Traditional controls (approvals, reconciliations) often lack the forensic intent to catch manipulation. Mid-sized firms should embed anti-fraud thinking into finance and procurement workflows, e.g., flagging new vendors created by the same user who approves invoices, or detecting payment splits just below approval thresholds. In one Indian mid-cap, forensic review of vendor master data found multiple entries linked to a single PAN number, leading to the unravelling of a procurement kickback loop.
    3. Regular Rotation of Duties in Sensitive Functions Fraud schemes often rely on a single insider managing a process end-to-end. Periodic job rotations, especially in roles like vendor onboarding, payroll processing, or loan disbursements, introduce fresh eyes and reduce opportunity. This approach helped a fintech firm in India detect a backdated disbursement manipulation after a temporary replacement questioned an old approval trail.
    4. Maintain an Always-On Fraud Ledger Beyond incident response, firms should maintain a fraud event registry tracking red flags, near misses, overrides, and ethical hotline tips, even if they don’t lead to confirmed fraud. Patterns often emerge when seen over time. One APAC manufacturer built such a ledger, which helped internal audit connect repeated override incidents across multiple geographies, ultimately leading to the identification of a multi-country expense fraud ring.
    5. Use Analytics to Spot What Human Eyes Miss User Behavior Analytics (UBA) and Data Loss Prevention (DLP) tools help surface subtle anomalies—after-hours logins, file transfers, unusual access routes—that are easy to miss otherwise. A Pune-based fintech used behavioral analytics to flag an employee repeatedly sending encrypted files to a personal account. The employee claimed it was for “offsite backup,” but further investigation revealed attempted IP theft. Behavioral AI can flag anomalies across cloud apps, VPNs, endpoints, and collaboration tools. Analysts report time savings of up to 70% during investigations when AI assistants triage alerts and surface contextual patterns.
    6. Treat Culture as a Control Layer Controls fail silently when employees are conditioned to ignore red flags or assume silence is safer. Embedding ethical tone through leadership modeling, anonymous reporting channels, and regular training creates cultural antibodies. In one APAC energy firm, a junior procurement executive flagged a vendor relationship via an anonymous whistle-blower tool, leading to the early unravelling of a collusion ring that had persisted for over a year.
    7. Secure Offboarding as if Breach is Guaranteed Exit events are when many insider incidents peak. Integrating HRIS and IAM systems ensures that resignations or terminations trigger immediate access revocation. Tesla’s 2023 incident, where former employees leaked sensitive data after their departure, is a case in point. A Southeast Asian R&D firm avoided similar fallout by enforcing just-in-time provisioning and de-provisioning protocols linked to HR workflows.
    8. Have an Insider-Specific Response Playbook Most companies have IR plans, but few have tailored playbooks for insider threats, which are often more subtle and reputationally sensitive than external attacks. One U.S. retailer that received a tip-off of employee theft initiated an internal investigation within 48 hours, preserving digital forensics, locking access, and launching containment discreetly. The firm suffered minimal reputational damage, unlike a peer that took weeks to act and landed in the media.
    9. Audit What You Assume Is Working Internal audit/assurance functions should be empowered to do anomaly-led investigations, e.g., looking for outlier spend patterns, non-business hour approvals, or repeated manual journal entries just before quarter close. Even one such “audit sprint” per quarter can raise deterrence significantly and align IA more closely with forensic objectives.
    10. Run Integrity Checks on Third Parties and Employees Collusion risk is highest in procurement, sales, and distribution. Instituting continuous third-party screening, conflict-of-interest disclosures, and employee lifestyle audits (especially in high-risk roles) helps detect early signs. One Indian mid-cap FMCG firm used a third-party integrity check and found that a key distributor was also a silent partner in a logistics vendor, triggering reallocation of contracts.

    Conclusion: Don’t Underestimate the Enemy Within

    Insider risk is often under-discussed in boardrooms, overshadowed by flashier external threats. Recent cases from banks in India to factories in America demonstrate that misuse of trust and collusion are alive and well in 2024-25, costing businesses dearly. As companies push for growth, they must ensure not to fall into the trap of assuming “it can’t happen here.”

    The truth is that as organizations grow, so do the opportunities for insiders to exploit gaps, especially if controls and culture don’t keep up.

    The encouraging news is that many insider risks are manageable with foresight and vigilance. By learning from studies like the ACFE’s annual report and industry surveys, companies can understand where they are most exposed. For example, knowing that operations, accounting, and sales departments account for a large portion of internal fraud cases can prompt targeted control improvements in those areas.

    Recognizing that collusion multiplies damage fourfold should spur better cross-checks and rotation in high-risk functions. And remembering that employees are often the heroes in detecting fraud emphasizes the value of a speak-up culture and employee training.

    Ultimately, effective insider risk management is a balancing act: trust but verify. Companies should cultivate a high-trust workplace but verify that trust through robust controls and oversight. External defenses and cybersecurity matter, but they are not sufficient on their own. Internal vigilance is equally crucial.

    In an era of advanced analytics and AI, businesses have powerful tools to monitor for anomalies; combined with human ethics and sound governance, these tools can tip the balance in favor of the honest majority. Mid-sized firms that embrace these principles will not only protect themselves from insider threats but also create a more transparent, accountable environment that investors, regulators, and employees themselves can have confidence in.

    In the journey of growth, keeping an eye on the “enemy within” is now an essential part of sustaining success.

    Infographic Sources; https://www.acfe.com/report-to-the-nations/2024/, https://www.proofpoint.com/us/resources/threat-reports/ponemon-cost-of-insider-threats, https://www.ey.com/en_gl/forensic-integrity-services/global-integrity-report-2023, https://www.acfe.com/report-to-the-nations/2024/, https://hbr.org/2022/01/why-employees-dont-report-unethical-behavior, https://www.acfe.com/report-to-the-nations/2024/

  • The Silent Chasm: Why Risk Culture Fails to Take Root and What It Costs Us

    The Silent Chasm: Why Risk Culture Fails to Take Root and What It Costs Us

    Background:

    In boardrooms and town halls, “risk culture” often gets generous lip service. It’s in slide decks, policy documents, and compliance manuals. But in far too many organisations, it remains a concept in theory—not a lived practice. And when this culture fails to penetrate the organisation’s bloodstream, even the most sophisticated systems collapse under the weight of blind spots, missteps, and avoidable disasters. When that happens, organisations end up being exposed to reputational damage, financial loss, and, in extreme cases, systemic collapse.

    In 2015, Volkswagen’s emissions scandal rocked the world, exposing how a weak risk culture allowed deliberate rule-breaking to flourish, costing the company over $30 billion in fines and settlements. This wasn’t an isolated failure but a stark reminder: a deficient risk culture can silently erode even the most robust organisations, leading to financial, reputational, and operational devastation. 

    Here we explore why risk culture fails to permeate, what gets overlooked, the potential fallout, and how to turn intention into action.

    The Culture Disconnect: Understanding Risk Culture 

    Risk culture isn’t just about identifying red flags or having a policy or framework – those are structures. It refers to the set of shared values, beliefs, knowledge, attitudes, and understanding about risk that is established and upheld across an organisation. Risk culture isn’t about eliminating risk it’s about creating an environment where intelligent, risk-based decisions are second nature. It dictates how people behave when facing uncertainty, how they respond to potential threats, and how they make decisions that involve trade-offs. A strongly embedded risk culture dictates how people think about, engage with, and manage risk. It’s about how people actually behave when no one is watching. 

    A strong risk culture empowers employees at all levels to identify, discuss, and act on risks proactively, aligning with frameworks like COSO ERM, which emphasises integrating risk management into strategic and operational decisions. Yet, many organisations struggle to embed this mindset.

    According to a 2023 Deloitte survey, only 30% of firms integrate risk KPIs into leadership performance appraisals, highlighting a gap between rhetoric and reality. Without a pervasive risk culture, organisations are vulnerable to blind spots that can escalate into crises.

    Organisations often remain compliance focused rather than culture focused leading to an absence of risk culture penetration.

    At its core, a risk culture should answer the following questions: 

    • Are employees encouraged to speak up? 
    • Are trade-offs between risk and reward openly discussed? 
    • Do incentives promote prudent decision-making or reckless risk-taking? 
    • Is short-term gain prioritised over long-term resilience? 

    In a healthy risk culture, employees speak up about red flags without fear, risk is integrated into strategy, not bolted on after, trade-offs are acknowledged, not denied, and leaders walk the talk. When risk culture is absent or superficial, the opposite happens — silence, shortcuts, silos, and surprises.

    Why Does Risk Culture Often Fail to Penetrate?

    • Tone at the Top Goes Mute: If leaders don’t consistently champion risk management, employees perceive it as a secondary priority. In a recent Global Operational Risk Management Survey Report, 80% of executives said that organisational culture is vital for effective risk management, yet only 21% felt that it was a strong part of their existing system. When leadership does not model prudent risk behaviour, then employees feel disconnected from decision-making and culture becomes a checkbox. Overoptimism or “disaster myopia,” exhibited by leadership at times, can also foster a false sense of security. The 2008 financial crisis exemplified this, where banks’ collective belief in market stability led to excessive risk exposure. 

    Common Symptoms of Poor Risk Culture:

    1. Inconsistent messaging: Leaders preach risk awareness but reward short-term gains.
    2. Lack of accountability: Risk failures are ignored or scapegoated.
    3. Siloed decision-making: Risk considerations are absent from strategic planning. 
    • Top-Down vs. Grassroots Disconnect: Risk awareness is often seen as a compliance responsibility delegated to risk or audit departments. While risk and compliance professionals have noticed a shift from “checkbox compliance” to a more strategic mindset in recent years, gaps in embedding still remain. Risk culture on the other hand, is behavioural, it must be lived by all, not just checked by a few. A study by Drata revealed that 71% of organisations rate their compliance maturity as “excellent” or “very good,” but culture and operational risk management still lag behind.
    • Misplaced Confidence in Controls: Organisations frequently mistake tools for culture. Implementing an enterprise risk management platform or conducting a few trainings doesn’t mean risk thinking is embedded in how daily decisions are made. Frameworks like ISO 31000 provide structure, but they’re ineffective without a shift in mindset. If performance metrics prioritise financial targets over risk-adjusted outcomes, employees may cut corners to meet goals.
    • Punitive Environments: In companies where raising a risk is seen as exposing a flaw, rather than preventing a future problem, people stay silent. Fear of blame leads to information suppression, and eventually, catastrophic surprises. A risk-aware culture thrives on open dialogue. Many organizations also suffer from siloed communication channels, where risk information doesn’t flow across departments or up the chain. Fear of blame further stifles reporting. For instance, a 2022 PwC study found that 60% of employees hesitate to report risks due to fear of retaliation, undermining proactive risk management.
    • Lack of Cross-Functional Risk Ownership: Risk is often not seen as everyone’s job. Departments like sales, operations, or HR assume it’s someone else’s concern.
    • Inadequate Training and Awareness: Employees need role-specific training to understand their impact on the organization’s risk profile. Without it, they’re ill-equipped to identify or respond to risks. A 2024 EY report noted that only 25% of organizations offer regular risk management training, leaving employees disconnected from the risk culture. 
    • Success Bias: Organizations that have “always done it this way” often become victims of their own track record. They underestimate emerging risks or novel threats.  Example : Blockbuster’s demise wasn’t just technological—it was cultural. The leadership underestimated digital disruption risk, believing customers wouldn’t abandon physical stores so easily.

    What Gets Overlooked in a Weak Risk Culture?

    High Cost Consequences of Risk Culture Oversight

    • Wells Fargo Fake Accounts Scandal (2016): Driven by an aggressive sales culture, Wells Fargo employees created millions of unauthorized accounts to meet targets. Leadership’s failure to align incentives with ethical risk-taking fostered a culture of fear and corner-cutting. Despite multiple red flags and whistleblower alerts, systemic pressure overrode ethical conduct. A weak risk culture allowed misconduct to flourish. The scandal cost the bank $3 billion in fines and eroded public trust, highlighting the dangers of misaligned performance metrics. 
    • Boeing 737 MAX Crisis (2018-2019): Design flaws in the 737 MAX and cost-cutting initiatives drove engineering shortcuts; compounded by a culture that sidelined safety concerns. The organisation prioritised delivery over safety, resulting in two fatal crashes and regulatory overhaul, causing $20 billion in losses, and grounded fleets. Employees feared raising issues, and leadership ignored red flags. This case illustrates the catastrophic impact of poor risk communication and accountability. 
    • BP Deepwater Horizon (2010): Safety protocols were bypassed and early warning signs ignored. The tragedy wasn’t just a technical failure—it was a cultural one. Risk wasn’t seen as a shared responsibility.
    • The Collapse of Archegos: The 2021 implosion of the family office Archegos Capital Management, which caused billions in losses for global banks like Credit Suisse, was a stark example of a deficient risk culture. Archegos used complex derivatives to build massive, highly leveraged positions while avoiding public disclosure requirements. The banks that served them, competing for lucrative business, failed to gain a complete picture of the fund’s total exposure. A culture of weak due diligence, lack of challenge, and fear of losing business allowed a single client to pose a systemic risk. 
    • Silicon Valley Bank (March 2023): The 16th largest bank in the United States collapsed in a stunning 48-hour period. While analysts pointed to interest rate hikes and concentrated tech-sector deposits, the true root cause was far deeper and more insidious: a catastrophic failure of risk culture. For years, a culture prioritising hyper-growth over prudent risk management allowed foundational risks to go unaddressed, ultimately leading to a predictable, yet shocking, demise.

    How to Build a Resilient Risk Culture 

    Building a strong risk culture is not a one-time project but an ongoing journey. It requires a structured, multi-dimensional approach. Organisations can adopt a practical roadmap to architect a culture that lasts.

    Step 1: Diagnose Your Reality  You Can’t Fix What You Don’t Understand

    Before we can build, we must assess. Use a combination of tools to get an honest picture of your current risk culture.

    Frameworks for Diagnosis: 

    1 – The I.C.E. Framework (Intention – Conduct – Environment) – This model is designed to evaluate alignment between internal beliefs, external behaviour, and environmental reinforcements.

    Intention

    • What is the stated philosophy or aspiration around risk?
    • Do leaders genuinely value risk intelligence?
    • Are risk appetite statements embedded in strategy?
    • Are people aware of what “good risk behaviour” looks like?

    Conduct

    • How do individuals actually behave when making decisions under uncertainty?
    • Are shortcuts taken to meet goals?
    • Do managers escalate red flags or suppress them?
    • Are decisions based on data, ethics, and foresight?

    Environment

    • What systems, structures, and incentives reinforce behaviours?
    • Do KPIs support prudent risk-taking?
    • Is psychological safety present?
    • Are systems designed to catch deviations early?

    The goal here is to spot where there is misalignment (e.g., good intention but poor conduct) and recalibrate the culture-building process.

    2 – The R.I.S.K. Diagnostic Lens (Reinforcement – Integrity – Signal – Knowledge)

    This framework emphasises the drivers of behavioural risk alignment—from tone-setting to capability-building.

    Reinforcement

    • Are desired behaviours rewarded and undesired ones discouraged?
    • Are ethics and risk awareness part of performance reviews?
    • Do people who raise concerns receive recognition—or retaliation?

    Integrity

    • Is there consistency between what is said and what is done?
    • Are rules applied equally across levels?
    • Do leaders back their values with tough decisions?

    Signal

    • What cues do people pick up about acceptable risk behaviour?
    • Are there visible consequences when protocols are bypassed?
    • Do peers model responsible behaviour or exploit loopholes?

    Knowledge

    • Do people have the understanding and tools to manage risk?
    • Are frontline staff trained to spot early signals?
    • Are tools, playbooks, and decision-making frameworks accessible?

    The goal here is to diagnose whether gaps in reinforcement, credibility, social modelling, or enablement are undermining the risk culture.

    Step 2: Define Your North Star What Does “Good” Look Like?

    A desired risk culture must be aligned with business strategy and risk appetite, defined within a framework like  COSO’s Enterprise Risk Management, and should effectively integrate with strategy and performance. An innovative tech startup will have a different target culture than a stable organisation. There is a need to create clear, concise statements about the desired attitudes and behaviours needed to achieve strategic goals. This isn’t about eliminating risk; it’s about defining the boundaries for intelligent risk-taking.

    Step 3: Bridge the Gap: a Four-Dimensional Action Plan

    Once the current and target state is defined, efforts can be ou can build a focused change initiative across four key dimensions.

    Strategy & Leadership:

    • Secure Board Backing: Change must be driven from the top. The Board must define the desired culture and hold leadership accountable for embedding it.
    • Integrate Risk into Strategy: Ensure risk discussions are a core part of strategic planning, not an afterthought. This aligns with principles from ISO 31000:2018 (Risk Management).
    • Lead from the Front: Leaders must visibly model desired behaviours. Start management meetings by discussing a risk or a “near miss.” Publicly praise employees who bring problems to light.

    People & Engagement:

    • Align Incentives: Review performance criteria. Does it reward only short-term output, or does it also recognise ethical conduct and proactive risk management?  Regulatory bodies like the RBI are increasingly scrutinising incentive structures.
    • Build Psychological Safety: Create a “no-blame” environment where employees feel safe to report errors and challenge decisions without fear of retaliation.
    • Tell Stories: Share narratives of both successes (where risk was managed well) and failures (with blameless lessons learned) to build institutional memory.

    Process & Governance:

    • Simplify and Demystify: Ditch the jargon. Implement simple, user-friendly systems for reporting risks. A complex process is an unused process.
    • Establish Clear Escalation Paths: Ensure that when a risk is identified, there is a clear and well-understood path for escalating it.
    • Embed in Performance Management: Make risk competency a part of formal job descriptions and performance reviews for all employees, especially managers. 

    Technology & Data:

    • Leverage GRC Platforms: Use centralised Governance, Risk, and Compliance (GRC) platforms to create a single source of truth for risk data, automate controls, and improve visibility.
    • Enhance Training with Tech: Build cost-effective, accessible online training modules to enhance employee capabilities without straining budgets.
    • Use Data for Early Warnings: Implement data analytics to identify trends and anomalies that could be leading indicators of emerging risks. 

    How Risk Culture can penetrate every function

    For risk culture to move beyond the boardroom, it must embed into functional behaviours, processes, and language. Here’s how that happens:

    Step 4: Measure What Matters From Lagging to Leading Indicators

    To maintain momentum, you must measure progress. Move beyond tracking only lagging indicators (e.g., number of incidents, financial losses) and focus on leading indicators that signal a cultural shift.

    “A recent study found that only 30% of firms effectively embed risk-related KPIs into the performance appraisals of senior leadership.”

    Leading Metrics for Risk Culture:

    • Frequency of risk discussions in team meetings.
    • Number of near misses reported.
    • Employee survey scores on psychological safety and trust in leadership.
    • Time taken to close out identified risk actions.
    • Completion rates and feedback scores for risk training.

    The above metrics can be used as a base to refine approach and make changes in the operating model. Culture change is iterative and continuous feedback is essential for sustained improvement.

    Risk Culture Is a continuous cycle, not a one-time effort and will involve an active and persistent effort towards:

    Risk culture is not a dashboard or a document – it’s a living, breathing ethos shaped by behaviour, trust, and shared responsibility. It thrives not in rulebooks but in conversations, in courage, and in the consistency with which organisations reward transparency and ethical decision-making. It is no more a “soft” initiative but a strategic imperative. It transforms risk management from a defensive, compliance-driven function into a forward-looking capability that enables intelligent risk-taking, fosters innovation, and builds sustainable resilience.

    As leaders, we have a duty to recognise that the absence of a risk culture is itself a risk. And it’s one we can no longer afford to overlook.

    The journey begins with a simple, yet profound, question that every leader must ask:

    “Are we just writing the rules, or are we building a culture that lives by them?”

    The answer will define your organisation’s future.

    Essential Reading for Risk Culture Architects

    • Black Box Thinking by Matthew Syed – Explores how high-performing organizations embrace mistakes and risks to learn and grow.
    • The Fifth Discipline by Peter Senge – Emphasizes the role of systems thinking and shared mental models, which directly relate to how risk is internalized culturally. 
    • Amy C. Edmondson – The Fearless Organization – A foundational book on psychological safety and its role in fostering risk-awareness and innovation.

    Sources and References:

    • Deloitte (2023). Global Risk Management Survey.  
    • PwC (2022). Global Risk Survey 
    • EY (2024). Global Risk and Resilience Survey 
    • Volkswagen Emissions Scandal (2015) 
    • Wells Fargo Fake Accounts Scandal (2016) 
    • Boeing 737 MAX Crisis (2018–2019) 
    • Theranos Scandal (2003–2018) 
    • Archegos Capital Management Collapse (2021) 
    • Silicon Valley Bank Collapse (2023) 
    • COSO (2017). Enterprise Risk Management—Integrating with Strategy and Performance 
    • ISO 31000:2018. Risk Management—Guidelines 
    • Institute of Risk Management (IRM). Risk Culture Toolkit 
    • 12 ways to improve your risk culture 
    • Addressing the Unavoidable: Why a Risk Culture is Important 
    • Risk Culture: The Classified Risk Culture 
    • What is risk culture and why should we care about it?  
    • The Role of Risk Culture in Effective Risk Management: Building a Resilient Organization 
    • Say–Do–Enable” models in culture change literature
    • COSO ERM 2017 Framework – Integration of culture and governance
    • McKinsey 7S Framework (especially “Shared Values” + “Style” + “Systems”)
    • Edgar Schein (Levels of Organizational Culture)
    • Daniel Kahneman & Amos Tversky (Behavioural Economics – separating intention vs action)
    • Harvard Business Review’s “Competing Values” model
    • Gartner’s Risk Appetite and Culture research
    • Risk transformation models from PwC, EY, and BCG
    • Influences from “Nudge Theory” by Richard Thaler (Signal & Reinforcement)
  • The Unseen Anchor: Third Party Risk Management

    The Unseen Anchor: Third Party Risk Management

    Karmine Team | 7-9 min read

    Background: The Hidden Threat Multiplying in Your Supply Chain

    Third-party risks are escalating in frequency and sophistication, becoming alarmingly common. Statistics show that 30% of data breaches involve third-party vendors, a figure that has reportedly doubled in a year.

    Small to mid-sized vendors, with less mature security due to their own resource limitations, account for a disproportionate share, implicated in as many as 60% of data breaches. This creates a precarious situation: a mid-sized company’s risk profile is tied to its entire vendor ecosystem. Failure of one critical third party can trigger cascading operational disruptions.  

    Mid-sized companies often underinvest in Third-Party Risk Management (TPRM) due to perceived resource limitations, yet these limitations make them more vulnerable to third-party induced shocks. While firms might assess their own risk as moderate, their vendors are significant breach sources. Attackers increasingly view smaller organizations as softer targets or conduits.   

    This is compounded by a compliance-centric myopia, where TPRM becomes a checkbox exercise rather than a proactive, risk-driven strategy, fostering a false sense of security. Some firms also mistakenly believe they are less attractive targets than larger enterprises, a notion contradicted by evidence showing increased attacks on smaller entities. This often stems from competing priorities and insufficient awareness of the potential impact of third-party failures.  

    Robust TPRM is a strategic imperative for business resilience, operational continuity, regulatory compliance, and customer trust. Approached strategically, TPRM transforms from a cost center to a value driver, safeguarding against financial penalties, reputational damage, and operational disruptions. Mid-sized companies must view TPRM as an indispensable component of their strategic framework for sustainable growth.  

    An Anatomy of Neglect: Critical TPRM Failings in Mid-Sized Companies

    Under-prioritized TPRM in mid-sized companies manifests in critical failings, creating significant vulnerabilities. These shortcomings, often due to resource constraints or lack of expertise, cumulatively weaken an organization’s security.

    The landscape of third-party risk is marked by escalating external threats and stricter regulations. Mid-sized companies face a greater likelihood of incidents and more demanding compliance, increasing the “cost of inaction”.

    1 – The Regulatory Gauntlet: Navigating Mounting Pressures

    Regulators worldwide are intensifying scrutiny of supply chain and third-party risks in response to growing cyber threats. The TPRM market is projected for significant growth due to these pressures. Mid-sized companies, especially in regulated industries or handling sensitive data, must treat these demands seriously. The trend is towards holding organizations accountable for their vendors’ actions, necessitating proactive risk management.  

    This “regulatory squeeze” impacts mid-sized firms. While some regulations target large enterprises, mid-sized firms are caught as supply chain components, compelled to adhere to higher standards via contractual flow-down. Proactive alignment with robust standards can be a competitive advantage.

    Regulatory expectations are shifting beyond incident prevention to ensuring operational resilience during and after incidents, including third-party ones. RBI in particular has been quietly but very firmly targeting TPRM failures with significant penalties. Table below highlights some of their recent actions.

    TPRM governance needs to critically mature from pre-contract due diligence to continuous monitoring, collaborative incident response planning, and resilience testing.

    2 – The Governance Void: Who Really Owns Third-Party Risk?

    Effective TPRM requires clear governance, but responsibility is often fragmented across procurement, IT, legal, and business units. This decentralization leads to inconsistent processes, duplicated efforts, and no holistic view of third-party risk. While organizations are moving towards centralized TPRM, many still use fragmented approaches.

    Without clear governance, accountability is diffuse, making it hard to enforce TPRM policies, manage risks, and align TPRM with ERM objectives and risk appetite. In mid-sized companies, this deficit can be more pronounced, allowing critical risks to be overlooked.  

    3 – Templated and Tick-Box Due Diligence: A False Sense of Security

    Reliance on generic questionnaires for due diligence is common in resource-constrained mid-sized firms. These “one-size-fits-all” templates, aimed at efficiency, often miss industry-specific nuances or true risk exposure, leading to a superficial understanding of vendor security and a false sense of security.

    This creates significant blind spots, especially for “medium-high risk” vendors who may be inadequately assessed, leading to undiscovered vulnerabilities. Prioritizing the appearance of due diligence over substantive effectiveness creates an “illusion of control”.

    4 – The Onboarding Squeeze: When Speed Overrides Scrutiny

    Pressure to rapidly onboard vendors often undermines TPRM. Business units, driven by operational needs, urge expedited onboarding, which can take weeks or months if done thoroughly. This tension frequently leads to rushed security assessments and cut corners in due diligence, with vendors sometimes integrated before assessments are complete.

    This “operational misalignment” means risk exposure expands faster than the capacity to manage it, embedding risks from the start. The desire to “get the deal done” can overshadow prudent risk management, leading to risky standard operating procedures.

    5 – Stale Assessments in a Dynamic World: The Peril of Outdated Risk Pictures

    A recent survey indicated that over 70% of organizations have critically under-invested in supplier risk assessments. Third-party risk is dynamic; a secure vendor can quickly become a liability due to new vulnerabilities, changes in their supply chain (nth-party risks), financial instability, or new threat vectors. Yet, many organizations rely on point-in-time assessments (e.g., annually), assuming ongoing coverage.

    These outdated methodologies fail to keep pace with modern vendor ecosystems. Consequently, organizations operate with an inaccurate understanding of their third-party risk exposure, vulnerable to emerging threats not identified previously. This “set it and forget it” mentality is a critical failure.  

    6 – Incident Response Paralysis: Slow Reactions to Third-Party Breaches

    Effective response to a third-party incident is paramount, but many companies lack structured frameworks for rapid identification, triage, and response. A sluggish response amplifies damage, leading to extended downtime, increased data loss, greater financial repercussions, and severe reputational harm.

    The July 2024 CrowdStrike incident, causing global IT outages, exemplifies how a single third-party failure can paralyze operations. Ffor mid-sized companies lacking dedicated incident response teams, such paralysis can be existential

    7 – Accountability Black Holes: Outsourced vulnerabilities

    Outsourcing a function doesn’t outsource accountability for associated risks. Mid-sized companies often struggle to enforce remediation on larger vendors or lack resources for persistent follow-up.  

    Contractual safeguards outlining security expectations and consequences for non-compliance may be weak or unenforced. This accountability vacuum leads to an accumulation of unmitigated known risks, leaving organizations persistently exposed.

    Real-World Casualties: Unabated third-party failures

    The escalating statistics are mirrored by high-profile incidents where TPRM failures have led to severe consequences, underscoring the global nature of this threat. Recent events have highlighted the diverse ways third-party vulnerabilities can cripple operations and expose sensitive data across various regions and sectors. These real-world examples offer critical lessons for mid-sized companies regarding the imperative for robust vendor oversight.

    In the United States, Progress Software’s MOVEit Transfer platform became 2023’s “super-spreader” event. A zero-day flaw let the Cl0p gang automate data-exfiltration from the servers of more than 2,500 organisations, exposing at least 66 million personal records and triggering months of breach notifications and class-action suits.

    In 2024, at Citigroup, USA, a legacy system error resulted in an $81 trillion transfer mishap, highlighting the risks associated with outdated IT infrastructure. This exposed vulnerabilities in operational processes and the need for modernization to prevent such large-scale errors.

    India saw collateral damage through Infosys McCamish Systems. Attackers infiltrated the insurer-services subsidiary in late 2023 via its eDiscovery provider, ultimately accessing up to 6.5 million policyholder records. The parent firm has already earmarked US $17.5 million to settle US class actions, illustrating how offshore service centres and their subcontractors can propagate liabilities across jurisdictions.

    Toyota confirmed in August 2024 that 240 GB of sensitive data posted on a hacking forum was siphoned not from its own network but from a U.S. dealership-partner, again blurring the boundary between “their” breach and “our” accountability.

    For mid-sized firms, the lessons are clear: rigorous due diligence, continuous monitoring of all vendors and software, understanding shared responsibilities with platforms, and having agile incident response plans that explicitly account for third-party scenarios are no longer optional but essential for survival.

    Building a Resilient Shield: Transforming TPRM into a Strategic Capability

    Mid-sized companies must transition from reactive TPRM to a proactive, resilient, and strategically integrated capability. This requires a holistic approach (people, process, technology, strategy), aiming for continuous improvement towards a “good enough” state proportionate to their risk profile and resources, then iteratively enhancing it.

    1 – The Strategic Shift: Integrating TPRM with Enterprise Goals

    • Aligning TPRM with ERM and Business Objectives: TPRM should be integral to the ERM framework, managing third-party risks in context of business objectives, strategic priorities, and risk appetite. Strategically aligned TPRM supports business goals by preventing incidents, ensuring operational continuity, protecting reputation, and maintaining customer trust.
    • Leveraging Frameworks: Established frameworks such as NIST CSF 2.0’s “Govern” function, ISO 27001:2022, COSO ERM Framework provide a strong pathway along with maturity elements to be considered as the organization progresses further.
    • Measuring TPRM Effectiveness and Demonstrating Value: 
    1. Measure TPRM effectiveness and demonstrate value using Key Performance Indicators (KPIs) such as percentage of vendors assessed by risk tier, due diligence time, number/severity of third-party incidents, remediation rates, compliance metrics.
    2. Regularly report to management/board on TPRM status, risks, and performance is crucial.
    3. Tie metrics to tangible business impacts to frame TPRM as an investment. Robust TPRM can catalyze broader risk management maturity.  

    2 – The People Power: Cultivating a Risk-Aware Culture and Expertise

    • Executive Sponsorship and Clear Ownership: Strong executive sponsorship is essential to elevate TPRM to a strategic priority, secure resources, enforce policies, and embed TPRM in company culture.
    • Building Accountability: Clear ownership is paramount, even without a dedicated TPRM team. A designated individual or small cross-functional group should coordinate TPRM, reporting to a senior executive. A cross-functional TPRM committee (even informal) with stakeholders could be effective.
    • Training and Cross-Departmental Collaboration: Ongoing training and awareness programs cultivate a risk-aware culture for all staff on security protocols, data privacy, and reporting third-party risks.

    3 – The Process Blueprint: Embedding Best Practices Across the TPRM Lifecycle

    • Comprehensive Lifecycle Approach: 
    1. The TPRM lifecycle includes: Planning & Vendor Identification; Due Diligence & Selection; Contracting & Onboarding; Risk Assessment & Control Implementation; Ongoing Monitoring; and Termination & Offboarding.
    2. A foundational step is a comprehensive, centralized, regularly updated vendor inventory detailing services, data access, criticality, and internal owner.
    3. Risk-based tiering (critical, high, medium, low) based on data access, system criticality, regulatory impact, and financial exposure is crucial for resource-constrained firms, dictating due diligence levels.
    • Risk-Based Due Diligence and Continuous Monitoring: 
    1. Due diligence, conducted before onboarding and tailored to risk tier must include security questionnaires, validating certifications, assessing financial stability, and evaluating security posture.
    2. TPRM must move to continuous monitoring to maintain an up-to-date vendor risk profile by tracking changes and emerging threats.
    3. For mid-sized firms, this might mean more frequent reviews for high-risk vendors and leveraging public information or security rating services, avoiding “stale assessments”.
    • Robust Contracting and SLA Management: 
    1. Embed clear, enforceable security requirements (data protection, security controls, breach notification timelines, audit rights, subcontractor responsibilities, liability) with legal counsel.
    2. Service Level Agreements (SLAs) defining performance and security commitments should be clearly articulated and monitored.
    • Agile Incident Response Plan for Third-Party Events:
    1. Integrate third-party scenarios into overall incident response and business continuity plans.
    2. Establish clear protocols for communication, coordination, and remediation with vendors during incidents.
    3. Regularly test these plans, possibly with critical vendors. Simple playbooks for common third-party failures are a pragmatic start.

    4 – The Technology Enabler: Leveraging Tools for Efficiency and Insight

    • There is strong business case today for investment in dedicated end to end third party lifecycle management platforms. They help automate manual tasks: distributing questionnaires, conducting due diligence, integrating risk assessments, streamlining onboarding, centralizing vendor data, enabling continuous monitoring, and providing risk dashboards.
    • Ideally, TPRM tech should integrate with GRC systems for a unified risk view and streamlined reporting. Mid-sized companies should seek scalable, cost-effective, cloud-based solutions. Basic automation offers substantial gains.
    • AI can further enhance efficiency by automating data collection, analyzing contract language, performing predictive analytics, monitoring vendors in real-time, and streamlining compliance. End to end life cycle platforms such as https://clife.ai/ enable organisations to holistically centralise & manage third party risks and enable seamless AI driven decision making.

    Systematically addressing these areas can help mid-sized companies transform TPRM into a strategic capability.

    Conclusion: Moving Beyond Compliance to Competitive Advantage

    Under-prioritizing TPRM is no longer viable for mid-sized companies. Escalating cyber threats, interconnected ecosystems, rising third-party breaches, and regulatory pressure make robust TPRM a fundamental necessity. For resource-constrained mid-sized firms facing severe impacts from third-party failures, neglecting TPRM is indefensible.  

    Mature TPRM protects revenue by preventing breaches, enhances resilience by mitigating dependencies, builds customer trust by safeguarding data, and can offer a competitive advantage. Mid-sized companies with mature TPRM become more attractive partners.  

    This transformation requires leadership commitment and integration into the organizational culture. Leaders should Allocate Resources, Foster Risk Awareness and demand accountability

    The path to robust TPRM has challenges, but inaction’s risks are greater. By adopting a focused, risk-based, continuously improving approach, mid-sized companies can shield themselves from threats, unlock growth, and solidify their position as trusted, resilient players. Their future viability may depend on it.

    References:

  • Good to Great: Why Some Companies Make the Leap… and Others Don’t

    Good to Great: Why Some Companies Make the Leap… and Others Don’t

    Duration: 4-5 hours

    Writing Style: Collins blends rigorous research with engaging storytelling, using vivid metaphors and case studies to make complex concepts accessible.

    What is the Main Hook of This Book?

    The biggest hook of Good to Great is its data-driven dismantling of business myths. It doesn’t promise overnight success or unicorn formulas. Instead, it shows with humility and precision, how companies that were once merely good, evolved into great ones by embracing discipline, confronting reality, and building enduring systems.

    Rather than spotlighting one-off innovators or celebrity CEOs, Collins puts forth a quiet, almost stoic kind of greatness that emerges from consistency, the right team, and clarity of purpose. That perspective immediately resonates because it’s not always clear – what separates momentary brilliance from sustained impact.

    Premise / Core Idea

    At its core, Good to Great presents a compelling case: greatness is not a function of circumstance but of conscious choice and discipline. Through years of research and company comparisons, Collins and his team identify key concepts that repeatedly showed up in successful transitions:

    • Level 5 Leadership: A unique combination of personal humility and fierce professional will.
    • First Who, Then What: Get the right people on the bus, then figure out the direction.
    • Confront the Brutal Facts: Foster a culture where truth is welcomed, not feared.
    • The Hedgehog Concept: Find the intersection of what you can be best at, what drives your economic engine, and what you’re deeply passionate about.
    • The Flywheel Effect: Sustainable change comes from cumulative momentum, not flashy revolutions.
    • A Culture of Discipline: Disciplined people, disciplined thought, and disciplined action – all working within a clear framework.
    • Technology Accelerators: Great companies use technology strategically to enhance their Hedgehog Concept, not as a reactive fix. They pioneer applications that align with their core strategy.

    These concepts aren’t theoretical, they are actionable, and that’s what makes them transformative.

    Application: Where the Book Meets Our Journey

    Level 5 Leadership in Our Daily Work

    This idea strikes a deep chord. The humility to accept your mistakes, take feedback constructively and then quietly persist with the will to deliver results, felt like an ideal to strive for. This moves beyond personal achievement and focuses on how micro effort contributes to the success of the broader project and company. That mental shift not only improves outcomes, but also makes work more purposeful and aligned.

    Moreover, Collins says Level 5 leaders “look out the window” to credit others and “in the mirror” to take responsibility. This perspective reinforces our belief system: when something goes wrong, excuses don’t help, action does. It’s made us more accountable and responsible.

    “First Who, Then What”

    This concept reminds us of how all our core solutions were designed and developed. Identifying subject matter stalwarts with domain expertise, who worked alongside our consulting team laid the genesis of a strong team. The clarity of “putting the right people in the right seats” helps us achieve our goal with far more precision, depth and efficiency.  A strategic team building exercise is crucial for long term success, and Good to Great reaffirmed its long-term value.

    Confronting Brutal Facts in Real-Time Projects

    In the consulting world, we are most often doled out certain hard truths – things don’t work in the manner that we envisioned, timelines are in danger due to unexpected friction or our approach requires a different lens. This book inspires us to face these challenges head on and take immediate action to ensure that intended outcomes are not compromised and client satisfaction reigns supreme.

    The discipline of “autopsies without blame” and honest dialogue helps cultivate trust and agility – both of which are critical in the consulting world.

    The Hedgehog Concept – Strengths Over Weaknesses

    This concept is based on the central idea that encourages companies (and leaders) to achieve greatness by focusing on what they can do best – by simplifying a complex world into a single organising idea, much like a hedgehog defends itself with one powerful trick.

    Why it matters :

    • It brings clarity and discipline.
    • It allows companies to focus energy rather than spread it thin.
    • It provides a framework for strategic alignment across teams and functions.
    • It’s not a goal; it’s an understanding. And it evolves through insight, not planning.

    Culture of Discipline in My Current Role

    At Karmine, we are empowered with the freedom to ideate, express and take complete ownership, while operating within a framework that resides on clarity, consistency communication and effective control. This is in alignment with the fundamental principle of building a core discipline which the book lays emphasis upon. We encourage all tasks and activities to be governed by the above principles.

    Further, this encourages us to  imbibe “rinse the cottage cheese” – a metaphor that represents going the extra mile in pursuit of excellence, even in ways that seem small, unglamorous, or unnecessary to outsiders.  The focus is on three key elements:

    • Discipline in the Details: Great companies (and leaders) exhibit fanatical discipline not just in big strategies, but in small executional habits that compound over time.
    • Consistent Marginal Gains: Success is often built by stacking many small improvements that may seem trivial individually, but collectively make a significant difference
    • Culture of Excellence: The metaphor reinforces a mindset where every action is done with purpose, intentionality, and care, no matter how mundane it seems.

    Our Take

    Good to Great is one of those business books that carries the weight of data-backed frameworks, and yet leaves room for philosophical reflection.

    In contrast to other strategy texts that emphasise market opportunity or visionary thinking, this book roots greatness in unremarkable beginnings, steady leadership, the culture of discipline, and empirical creativity. Interestingly, the celebrated Level 5 Leader is almost anti-charismatic. He leads not by bold declarations, but through quiet resolve; a paradox many leadership theories overlook.

    We believe the strength of the book lies in operationalising what often feels intangible: greatness. Its principles are particularly useful in contexts of turnaround, scaling responsibly, or institutionalising excellence. However, it does little to account for volatile, rapidly changing environments where agility may trump discipline.

    What stood out to us:

    • Greatness is not a function of circumstance but of conscious choice.
    • The importance of talent before strategy.
    • Transformation is not an event, but the compounding of small wins.

    Its a book for those building endurance, not just speed. In a world obsessed with instant success, Good to Great is a refreshing reminder that lasting impact comes from deliberate, often invisible, consistency.

    Challenger Thoughts

    While the book is deeply insightful, there are areas where a more modern context or critical lens might help. For instance:

    • Level 5 Leadership, while inspiring, may seem difficult to sustain in startup or high-velocity environments where quick decision-making and bold presence are often rewarded more visibly than humility.
    • The book’s company examples (e.g., Circuit City, Fannie Mae) have aged poorly in some cases. It raises an important question: Can a company truly be called “great” if its success isn’t durable beyond a decade?
    • The data is U.S centric and may not reflect the diverse market dynamics and leadership cultures in countries like India or others in Asia.
    • The focus on internal discipline doesn’t always account for external disruptions like regulatory shocks, geopolitical events, or tech displacements that can radically impact a company’s trajectory, regardless of leadership intent.

    That said, these critiques don’t diminish the core value of the book. They simply invite a layer of critical application and adaptability.

    Margin Notes Rating Category: Top Drawer

    This book certainly earns a place in your “Top Drawer.” Its lessons on leadership, discipline, and strategic focus shape how we show up every day, guiding decisions with quiet but powerful influence.

    Article content
  • Underdeveloped Data & Reporting Blindspots

    Underdeveloped Data & Reporting Blindspots

    Background:

    As mid-sized listed companies scale, their risk landscape grows more complex. Many still operate with fragmented data systems and ad hoc reporting frameworks. Unlike large enterprises with mature infrastructures, or smaller firms with manageable oversight, mid-sized companies often fall into a blind spot: “too complex to run manually, too constrained to modernize decisively.”

    The result? Data exists but is scattered across systems, spreadsheets, and silos. Unstructured, unsurfaced, or untrusted. Risk visibility becomes partial, reporting cycles are reactive, and decision-making is shaped more by instinct than insight.

    In this article, we unpack the top root causes behind this challenge. We also outline five strategic remediation moves; practical, scalable steps that mid-sized firms can take to build integrated, resilient, and insight-driven risk data ecosystems.

    Because today, risk management is a data problem and solving it is a competitive advantage.

    Top Root Causes of Underdeveloped Data & Reporting Frameworks

    1 – Absence of a Strategic Data Governance Framework

    Most under-developed data environments can be traced to the absence of a robust data governance strategy. Data governance encompasses the policies, standards, and processes that ensure data is accurate, secure, and available. In many mid-sized companies, it is either ad hoc or entirely missing. There’s no centralized framework assigning ownership or standardizing how data must be managed.

    How it manifests: Different business units define and handle data independently. For instance, a single counterparty (customer/vendor/partner) may have multiple IDs across systems, distorting their true profile. These inconsistencies stem from the lack of enterprise-wide data definitions, taxonomies, and data catalogs.

    Why it persists: Instituting data governance is challenging. It requires cross-functional coordination and often a cultural shift. Mid-sized firms may not necessarily have dedicated a Chief Data Officer or equivalent, leaving IT teams to enforce standards without executive clout. Moreover, some firms perceive governance as bureaucracy that slows down operations. If leadership is unconvinced, they won’t allocate time to build a governance committee or policies.

    Impact on risk management: Without strong governance frameworks, companies struggle to aggregate and report risk data effectively leading to poor risk assessments and decision-making. A mid-tier bank without clear data ownership might find that its finance and risk departments use different definitions of “exposure,” resulting in conflicting risk reports. In manufacturing, lack of governance might mean safety incidents or quality defects aren’t logged uniformly, obscuring critical risk trends.

    2 – Siloed Systems and Fragmented Data

    Mid-sized companies often grow through business silos, each department or subsidiary implementing its own framework, models and structure to suit their maturity curve. The result is fragmented data architecture: customer data in one platform, sales in another, risk metrics in a spreadsheet, and so on, with poor integration between them.

    How it manifests: Data silos hinder enterprise-wide visibility.

    Attempts to create a “single source of truth” fail if systems don’t talk to each other. A bank’s lending unit and treasury unit might use separate reporting tools, making it laborious to compile an integrated risk report. Or consider a manufacturer where procurement and production each maintain separate inventory records. Without integration, the company cannot accurately assess supply chain exposures or working capital at a consolidated level.

    Why it persists: Ironically, despite years of trying to build interfaces, the problem has in some cases worsened – over 40% of companies report that the number of data silos has actually increased, while only ~10% have improved company-wide information access.

    Teams might resist sharing data (protecting their turf), and technically it can be challenging (or expensive) to connect legacy systems lacking modern APIs.

    Impact on risk management: Data silos are kryptonite for risk oversight. If risk data is scattered, it’s difficult to get a holistic view of the organization’s risk profile. Correlations between risks may go unnoticed as seen in some recent bank failures. In summary, fragmentation undermines any robust risk management framework by preventing timely, accurate data consolidation.

    3 – Legacy IT Systems and Technical Debt

    The burden of legacy technology, outdated core systems or homegrown solutions that have been patched over time is nothing short of an industry norm. Legacy systems are often inflexible, incompatible with modern data tools, and prone to failure, collectively contributing to underdeveloped reporting frameworks.

    How it manifests: A bank might still rely on a decades-old core banking system that wasn’t designed for today’s data demands, requiring batch processes to produce reports (meaning no real-time insight). A manufacturing company could be running an old version of an ERP that lacks modern analytics modules, forcing employees to export data into spreadsheets for analysis.

    The prevalence of legacy tech is notable. Nearly 96% of IT professionals in one 2023 survey said they still need legacy applications in their environment, and only 4% reported not using any legacy applications.

    Why it persists: Replacing core systems is often viewed as risky, expensive, and disruptive. The classic “if it isn’t broken, don’t fix it” mentality.

    Technical debt (the cumulative cost of quick-fix IT decisions) accumulates because the company opts for short-term patches over long-term rebuilds.

    Impact on risk management: Outdated technology directly impacts risk monitoring and reporting. Legacy systems may not capture the level of data granularity needed for advanced risk analysis (for example, a legacy manufacturing system might not log each production anomaly needed to predict equipment failure risk). They often lack audit trails or modern security, elevating operational and cyber risks.

    4 – Cultural Resistance to Change and Data Sharing

    Organizational culture plays a pivotal role in the success of data initiatives. Long-standing habits and attitudes create resistance to adopting new data practices or sharing information freely.

    How it manifests: Front-line managers may cling to their known and used ‘excel spreadsheets’ and gut-feel decision making, viewing new data systems with suspicion. In many ways, new data systems also expose known but unaddressed failures to the limelight.

    Some departments also treat data as a power source to hoard. For instance, the sales team might be reluctant to input detailed client data into a central CRM if they’ve historically managed relationships personally. The XPLM industry survey highlights that two-thirds of respondents said their corporate culture actually favors the emergence of data silos, and 71% admitted that departments “do not want to share their knowledge” across the organization.

    This culture can doom data projects; employees might refuse to adopt a new reporting tool, or deliberately bypass official processes (keeping shadow records) because they don’t trust or understand them.

    Why it persists: Cultural change is one of the hardest challenges in any organization. Mid-sized companies often have veterans and legacy practices deeply ingrained – “this is how we’ve always done it” can be a mantra. If leadership isn’t actively driving a data-centric culture, middle management is unlikely to enforce it.

    Additionally, without adequate training or clear communication of benefits, staff may genuinely fear that new data systems could make their roles redundant or expose their mistakes, thus resisting involvement. There’s also the issue of incentives: if performance metrics don’t reward data sharing or accuracy (and instead only reward short-term results), employees have little motivation to change their behavior.

    Impact on risk management: Cultural resistance can sabotage even well-intentioned risk data initiatives. If, say, the risk team implements a new enterprise risk management (ERM) system but business units don’t feed it with timely data, the system becomes an empty shell. An unsupportive culture can nullify the best tools and keep the organization in a reactive stance, where data is seen as a threat or burden rather than a shared asset for informed risk-taking.

    5 – Increasing Regulatory and Reporting Complexity

    The external environment is raising the bar on data and reporting, and many companies are finding their frameworks lagging behind these evolving requirements. Whether it’s financial regulations, data privacy laws, or sustainability reporting standards, the complexity and volume of reporting expectations have grown exponentially – and mid-sized firms are struggling to keep up.

    How it manifests: A regional bank might face new stress-testing data requirements from regulators that its current risk systems cannot support, resulting in frantic efforts to pull the right data. Manufacturing companies now encounter detailed ESG expectations, for instance, European mid-sized listed firms will soon need to comply with the EU’s Corporate Sustainability Reporting Directive (CSRD), tracking metrics from carbon emissions to supply chain due diligence. Many are unprepared.

    Why it persists: Unlike large corporations, mid-sized companies typically do not have big compliance departments or the latest Reg-Tech tools. They may be caught off guard by new regulations or find them disproportionately burdensome.

    Impact on risk management: Compliance risk becomes a top concern. But beyond compliance, the spirit of these regulations (be it transparency in risk or sustainability) is to drive better decision-making. If a mid-sized firm is only doing the minimum, it likely isn’t leveraging the data to actually improve risk management.

    6 – Talent and Skills Gap in Data Analytics

    Even with the right tools, organizations need skilled people to build and maintain robust data frameworks. Mid-sized companies often face a talent crunch in this area. They may lack experienced data architects, analysts, or risk data specialists on staff.

    How it manifests: The IT team might be small and generalized, without a dedicated data engineer or data scientist. Mid-sized firms often cannot offer the same compensation or career trajectory as large tech firms or banks, leading to a smaller talent pool.

    Why it persists: The demand for data and analytics talent has exploded in recent years (with the rise of AI, big data, etc.), and supply has not kept up. Mid-sized companies often have to “grow” their own talent internally, which takes time. Hiring experienced professionals is competitive and costly. Additionally, some mid-tier companies are located outside major tech hubs, making recruitment harder. There’s also the issue of retention.

    Impact on risk management: A skills gap can severely hamper risk oversight. Insufficient talent leads to heavy reliance on a few key individuals or external vendors; this concentration is a risk in itself. If those individuals leave or contracts lapse, the organization’s data capability could collapse. Risk professionals in such settings often find themselves doubling as data cleaners and report builders, diverting them from higher-value risk analysis.

    5 Strategic Remediation Moves for Mid-Sized Organizations

    Mid-sized companies can turn these challenges into opportunities by proactively strengthening their data and reporting frameworks. Below are five strategic remediation moves spanning technology, governance, and people to help resolve or mitigate the above root causes. These strategies are interrelated and can be pursued in parallel:

    1 – Establish a Robust Data Governance Framework with Executive Ownership

    Firms should formalize a data governance program that defines clear roles, responsibilities, and policies for data management. This also means appointing accountable data owners/stewards in each domain. To succeed, governance cannot be an IT-only initiative.

    It needs top-down endorsement and enforcement. Leadership should treat data as a strategic asset, regularly reviewing data governance progress just as they would financial results.

    The key is also continuous improvement: governance isn’t a one-time project but an ongoing program that adapts as the company grows and regulations change.

    2 – Invest in Modern, Scalable Data Architecture and Tools

    A strategic upgrade of technology can pay huge dividends. Mid-sized organizations should evaluate and invest in scalable data infrastructure that could involve moving to cloud-based platforms, implementing a unified data warehouse or lake, and deploying business intelligence (BI) and reporting tools that automate data aggregation and visualization.

    Modern cloud solutions are increasingly accessible to mid-market companies (often offered in modular, pay-as-you-go models), lowering the barrier to entry. Key considerations would be to prioritize integration-friendly solutions and adopt tools that reduce manual work, such as ETL for moving and reconciling data

    3 – Strengthen Data Talent and Literacy Across the Organization

    People are the linchpin of any data strategy. Companies should invest in their human capital by both acquiring and developing data skills. If hiring full-time is difficult, engaging external consultants or service providers on a project basis can jump-start initiatives while transferring knowledge to internal staff.

    On the development front, companies should launch data literacy programs so that employees at all levels become more comfortable with data and analytics tools.

    A focus on talent and literacy sends a message that data isn’t just the IT team’s job, it’s everyone’s responsibility.

    4 – Foster a Data-Driven Culture with Strong Change Management and Incentives

    Leaders should consistently communicate the importance of data in achieving the company’s goals, and celebrate data-based decision making.

    Some firms establish cross-functional teams or “communities of practice” around data, which break down silos by design. It can also help to start with small wins. Pilot the new framework in one department, refine it, and then expand, so people see proven benefits.

    A data-driven culture also means employees become more likely to report issues or anomalies when they occur, rather than hiding them, because they know management wants to hear the data even if it’s bad news.

    In essence, technology and processes might provide the tools, but culture is the soil in which a data-driven enterprise either withers or thrives.

    5 – Align Data Initiatives with Risk Management and Compliance Objectives

    Lastly, mid-sized organizations should explicitly try and link their data framework improvements to their broader risk management and compliance goals. In practice, this means using risk-based criteria to drive data projects: focus on the data that matter most for the company’s risk profile and regulatory requirements.  

    Some mid-sized firms establish a Risk and Data Steering Committee that meets regularly to ensure data initiatives are evaluated in terms of risk reduction and compliance impact. Additionally, keep an eye on upcoming regulations and proactively build capability to meet

    Ultimately this alignment creates a virtuous cycle: good data feeds into good risk management, which identifies areas for improvement, which in turn drives further data enhancements. By making risk management a key outcome of data strategy, companies ensure their data framework upgrades truly fortify the organization’s resilience and not just its operational efficiency.

    Conclusion

    Transitioning to a mature data and reporting framework is undoubtedly a journey, not an overnight fix. However, by understanding the root causes behind their current shortcomings, organizations can target their efforts more effectively.

    The challenges outlined often interact, but the good news is that the remediation moves are mutually reinforcing as well. With committed leadership, smart investments in technology, empowered people, and a culture that values information, companies can evolve their data practices significantly. The payoff is more than just better reports. It is improved risk foresight, stronger compliance, and enhanced decision-making agility.

    Sources:

    • Basel Committee on Banking Supervision (BCBS 239) progress reports (2023)
    • BIS reports on supervisory expectations for risk data frameworks
    • Case studies: Silicon Valley Bank collapse analysis, 2023 U.S. Senate testimony and Fed reviews
    • Sero Group: Implementing Data Governance for Small and Medium-Sized Businesses
    • XPLM (2023): Study on Enterprise Data Silos and Cultural Resistance to Data Sharing
    • Gartner, Forrester, and IDC insights on enterprise data architecture adoption
    • QBE Global Risk Index (2023): Mid-Market Risk Prioritization and Preparedness Survey
    • Hyperproof GRC Benchmark (2024): Risk and Compliance Operations in Fragmented Environments
    • Sage (2023): SME Cloud and Sustainability Technology Trends Report
    • IDC SMB Tech Pulse (2023–24): Cloud adoption rates and tech spend forecasts for mid-sized firms
    • McKinsey Digital: The Value of a Scalable Data Architecture for Mid-Sized Enterprises
    • World Economic Forum: 2023 Global Talent Outlook
    • Udemy for Business: Skills Gap in Data Literacy 2023 Report
  • Compliance Fatigue and Bloated Cost of Control

    Compliance Fatigue and Bloated Cost of Control

    Background

    Let us for illustration purposes understand the approximate scale of the compliance requirements for mid-sized enterprises in India.

    India’s regulatory ecosystem has tens of thousands of requirements, over 69,000 unique compliance requirements across 1,536 laws by one count. These are not abstract numbers; they translate into a daily grind of filings and checkpoints.

    A medium-sized manufacturing company in India, for example, might need to comply with 5,500+ distinct regulations, whereas even a small manufacturing unit must follow around 750 regulations. These include everything from labor law registers and tax returns to factory safety displays and environmental permits.

    TeamLease Regtech, a compliance technology firm, estimates that an Indian MSME with just over 150 employees faces 500–900 applicable compliance requirements. It’s no surprise that business owners feel the weight of this “control bloat” in their operating costs.

    Although the organizations are free to assess their own risk appetite and calibrate approach to suit a “Risk Based Approach”, in reality, the fear of potential non-compliance leads to excessive compliance burden.

    Rising Compliance, Spiraling Costs, Unclear Value

    One of the clearest signs of “compliance fatigue” is the growing cost of compliance, relative to its perceived benefit. Compliance budgets have been rising rapidly, often without commensurate clarity on what risks are actually being mitigated or value gained.

    Despite massive compliance expenditures in certain industries, breaches and fines continue unabated. For instance, global banks collectively paid billions in penalties in recent years even as their compliance departments grew larger than ever. Regulators have openly noted that they remain unimpressed by the amount of money spent on compliance, what matters are outcomes. If compliance spending doesn’t translate to fewer incidents, its ROI is fundamentally in question.

    Across industries, leaders are asking hard questions: “What are we really protecting with all this spending?” It’s often difficult for compliance officers to answer with hard data. Ideally, compliance investments protect the business from fines, fraud, data breaches, safety incidents, reputational damage, etc. But quantifying the absence of a crisis is challenging. Compliance’s success is often that “nothing bad happened,” a counterfactual that’s tricky to monetize.

    In fact, most organizations don’t even measure their compliance spending in a holistic way. A 2023 survey by Thomson Reuters found that 45% of firms did not monitor the total cost of compliance across the organization in any form. Without tracking cost, it’s nearly impossible to calculate ROI. It’s not surprising, then, that compliance teams struggle to demonstrate tangible value.

    The bottom line: Many organizations feel trapped in a compliance cost spiral; pouring more and more money and effort in, without a clear picture of risk reduction or business value out. Business leaders don’t want to write blank checks for compliance; they want to know their investments are actually protecting the company’s most critical assets and stakeholders.

    Audit Overload and Tick-Box Compliance Culture

    Why Leaders Are Concerned

    When we weigh fragmented initiatives, audit overload, ballooning costs, reactive spending, and staff burnout, it becomes clear why many organizations see a cost-benefit imbalance in their compliance programs.

    The benefits (risk reduction, avoidance of fines/incidents, improved reputation), while very real, are often opaque and lagging, whereas the costs are immediate, tangible, and rising. This imbalance is leading some executives and board members to question whether they are getting value for money  from compliance.

    In blunt terms, if we doubled our compliance spend in the past 5 years, are we twice as safe? Or as one expert framed it: “What is the probability that the usual GRC investments are genuinely protecting the business?”. If that probability is low or unknown, it signals a problem in how the program is structured or measured.

    Business leaders don’t want compliance to be a necessary evil; ideally, they want it to protect what truly needs protecting and enable the business to thrive. The challenge ahead is how to rebalance the equation so that the compliance function’s value is as plain as its cost.

    Improving ROI Clarity: Strategies for Better Compliance Value

    Despite the daunting picture, there are concrete steps organizations can take to rebalance their compliance efforts and improve clarity. Below are several actionable recommendations and strategic shifts that can help transform compliance from a fatigue-inducing cost center into a more efficient, value-driven function:

    1 – Adopt a Risk-Based, Strategic Approach:

    Rather than treating all compliance activities as equally critical, prioritize resources toward the risks that could most seriously harm your organization. This means clearly answering the question, “What are we really protecting?” Is it customer data? Financial integrity? Safety of employees? Once you identify your crown jewels and top threats, align compliance controls to those areas first.

    A risk-based approach also involves defining your risk appetite (what level of risk you’re willing to accept). This helps right-size compliance efforts; in areas of low risk, avoid over-engineering costly controls that don’t add value. By focusing on what truly matters, you can start to quantify benefits (e.g. “we reduced the probability of a major data breach by X% through these controls”) and thus demonstrate ROI in terms of risk reduction.

    2 – Consolidate and Streamline Programs: 

    • Break down the silos between various compliance initiatives. Often different teams manage overlapping requirements with separate processes and tools.
    • Conduct a program audit to identify overlap and inefficiency. You may find, for example, multiple teams separately assessing vendor risk or multiple tools tracking similar control inventories. Consolidating these efforts not only cuts cost but improves consistency.
    • Consider establishing an integrated GRC (Governance, Risk, Compliance) framework where a single system maps all controls to relevant regulations. This allows one control (say, an access security control) to satisfy multiple requirements at once, reducing duplicate work.
    • Streamlining should also extend to audits: whenever possible, use a single evidence repository so that one piece of evidence can serve multiple audit objectives, alleviating audit fatigue.

    3 – Leverage Technology and Automation:

    Invest in modern compliance tools that automate and improve visibility. According to Accenture research, 93% of compliance leaders agree that AI and cloud-based compliance tools can remove human error and automate manual tasks, boosting efficiency.

    Some areas to target with technology include: continuous monitoring of controls, workflow tools for policy management and attestation, and data analytics to detect compliance issues early. However, technology is not a silver bullet. It should be implemented alongside process improvements, not just layered on top of bad processes.

    4 – Define Metrics and Communicate Value:

    To make ROI clear, define key performance indicators (KPIs) for your compliance program that relate to both cost and benefit. It’s notable that nearly half of the firms do not monitor their cost of compliance at all; simply starting to measure it is step one. Next, translate compliance outcomes into the language of business. Even if not perfect, they signal that the compliance function is evaluating its own effectiveness.

    5 – Foster a Culture Beyond Box-Ticking: 

    • Cultural change is critical. Tone at the top matters. Leadership should emphasize that compliance is about protecting the company and its stakeholders, not just pleasing regulators.
    • Make compliance part of performance evaluations for everyone, not as an extra burden but as an expected aspect of good business practice.
    • When compliance is culturally rooted, people are less likely to see it as an external imposition and more as a shared value. 
    • Engaged employees are the best defense and also the best champions to demonstrate that compliance work has real impact.

    6 – Right-Size the Compliance Organization: 

    • Leverage external expertise strategically. For example, use outside counsel or consultants for niche regulations or periodic compliance program reviews, rather than carrying that full expense in-house year-round.
    • This can provide access to expert knowledge on demand and help answer tricky ROI questions.
    • At the same time, cross-train team members on different aspects of compliance; a well-rounded team can handle a wider range of issues, improving efficiency.

    7 – Align Compliance Objectives with Business Goals: 

    • One way to underscore ROI is to tie compliance initiatives directly to business objectives. For example, if a company’s goal is to expand into European markets, frame the enhancement of your privacy compliance (GDPR, etc.) as an enabler of that expansion (gaining customer trust and avoiding legal roadblocks).
    • If the business is embracing digital transformation, position your cybersecurity compliance upgrades as protecting that digital innovation (thus avoiding costly setbacks from breaches). By framing it this way, you shift the narrative from “compliance is a cost we must bear” to “compliance is helping us achieve X business outcome securely.” 
    • Consider building “compliance by design” into product development and strategy, ensuring that new initiatives consider regulatory requirements from the start. 

    8 – Review and Reduce Bureaucracy: 

    • Periodically conduct a “clean-up” exercise. Many compliance programs accumulate layers of checks over time (often as reactions to past problems) and never shed any.
    • Sometimes, simplifying a control or combining two steps into one can maintain effectiveness and save hundreds of person-hours. Every hour saved is essentially money saved or re-allocated to more meaningful work. This improves the perceived ROI because people see that compliance is mindful of efficiency and not just adding procedures endlessly.

    Implementing the above strategies requires effort and commitment, but the pay-off is two-fold: reduced fatigue and higher ROI clarity. Firms that have pursued such improvements report not only cost savings, but a stronger confidence among leadership that compliance investments are worthwhile.

    Conclusion

    Companies today find themselves juggling a multitude of regulatory demands, from financial controls to data privacy to ESG, with teams that are overloaded and budgets that seem to grow faster than the perceived benefits. The current state in many organizations is fragmented compliance efforts, reactive fire-fighting, and a culture of ticking boxes to get through audits, all contributing to high costs and murky value. Mid-size firms feel this pain acutely as they shoulder enterprise-level rules with far fewer resources.

    Yet, it doesn’t have to remain this way. By reimagining compliance through a strategic lens, focusing on risk-based priorities, integrating programs, leveraging technology, and fostering a compliance-positive culture, businesses can turn compliance into a more streamlined, proactive, and yes, valuable part of operations.

    In the end, the goal is to establish compliance programs that confidently answer the ROI question. That means being able to articulate, at a high level: Here’s what we’re protecting, here’s what it would cost if we failed, and here’s how our compliance efforts prevent that. 

    Sources:

    • Wipro Sustainability Report FY 2023-24 – warning against “compliance fatigue” leading to a checkbox mentality 
    • LinkedIn (A. Agarwal) – challenges for mid-sized firms: limited resources, staff burnout, manual processes 
    • TeamLease Regtech report
    • NorthRow/Drata 2023 survey
    • Indian Economic Survey 2024-25
    • DigFin (LexisNexis study)
    • Drata 2025 survey
    • Secureframe (2024), “Overcoming Audit Fatigue: Causes & Mitigation Strategies” 
    • Thomson Reuters (2023), Cost of Compliance Report 
    • National Association of Manufacturers – NAM (2023), “Regulatory Onslaught Costing Small Manufacturers 
    • PwC (2023), “Risk and Compliance Reimagined: Unlock Hidden Savings” 
    • Corporate Compliance Insights (2023), “From Firefighting to Future-Proofing” 
    • Sprinto (2024), “100+ Compliance Statistics for 2025” 
  • Interconnected Risks Without a Common Language

    Interconnected Risks Without a Common Language

    Background

    Mid-sized companies across the globe are grappling with an increasingly complex risk landscape. From cyber threats and supply chain disruptions to regulatory changes and market volatility, operational risks today are more interlinked across business functions than ever before.

    Yet, many of these organizations lack a harmonized risk language and accountability, a shared, enterprise-wide way to understand, categorize and monitor risks. Instead, each department often speaks its own dialect of risk, using different taxonomies and sometimes, tools to monitor. The result is that critical issues can go unspoken, miscommunicated across silos, leading to unclear ownership of risks, duplicated compliance efforts, and missed early warning signs of trouble.

    What is a “common risk language”? 

    In simple terms, it’s a standardized vocabulary and classification of risks that everyone in the organization uses. This involves agreeing on a risk taxonomy, risk ratings and terms across all teams. The purpose of a common risk language is to ensure that a finance manager, an IT analyst, and an operations supervisor all mean the same thing when they discuss “high operational risk” or a “compliance issue”. A a common framework enables people with diverse backgrounds to communicate effectively about risk and identify issues more quickly.

    According to one benchmarking survey, teams managing risk in silos reported spending nearly 38% of their time on administrative tasks (assembling reports, updating spreadsheets) and the vast majority said at least one-third of their effort went to repetitive manual work. These inefficiencies directly translate to higher compliance costs and lost productivity.

    One common symptom is unclear risk ownership. For example, consider a mid-sized manufacturing firm. The operations team tracks safety incidents and supply disruptions, the IT team handles cybersecurity threats, and CISO monitors regulatory issues. When a critical supplier suffered a cyber breach, operations labeled it a supply chain issue, IT labeled it a vendor cyber risk, and CISO saw a third-party data privacy concern.

    Another example ailing many financial institutions pertains to preventing, detecting Money Mules (Money mule risk refers to the threat posed to a financial institution when its accounts, systems, or services are exploited knowingly or unknowingly by individuals, to move illicit funds, thereby exposing the institution to fraud losses, regulatory breaches, and reputational damage.)

    Who truly owns this risk? Is the fraud risk team or the AML Compliance team or the cyber team or the first line of defense? Money mules are a classic case of an interconnected risk without a common language. Multiple functions in the same organization perceive the risk differently and hence, are never able to solve the root cause issues are a singular unified view. Without a unified view, early indicators that might have been obvious in say, a consolidated dashboard, remain scattered.

    Since there are no common taxonomies linking these perspectives, no single owner is alerted to the full picture. This overlap and ambiguity mean everyone assumes someone else is mitigating the problem. The early warnings are hence, often missed amidst the fragmented reports.

    The problems exacerbate in case of un-regulated sectors. 

    Why a Common Risk Language Matters:

    • Aligned Risk Appetite and Decision Making:  A common risk language helps align the organization’s risk appetite with operational decisions. Risk appetite, the level and type of risk a company is willing to accept in pursuit of its objectives, is typically set at the top. With a unified taxonomy, management can define risk appetite in concrete terms for each risk category, and everyone from the board to the business units understands it the same way. This means decisions on the ground are made with a clear understanding of how they fit the company’s risk tolerance.
    • Clear Ownership and Accountability: With the unification, every major risk category has an owner and stakeholders who all understand what falls under that risk. There’s less chance of “grey area” risks being unowned. Responsibilities can be assigned without ambiguity ensuring someone is watching each risk and accountable for responding.  
    • Enterprise-Wide Visibility: Using one risk language allows aggregation of risk data across the whole company. Executives can see the full risk profile without blind spots. Early warning indicators become more apparent when all inputs feed into one picture. Patterns (like similar issues cropping up in different regions or departments) can be detected via the common categories. This holistic view is essential for spotting systemic risks that individual silos might overlook.
    • Efficiency and Reduced Duplication: Standardizing risk categories and reporting streamlines processes. The same risk does not need to be assessed in triplicate by different teams; one assessment can serve multiple purposes. Controls and mitigations can be designed to address multiple related risks at once. This cuts down the repetitive administrative burden. In mid-sized firms where resources are limited, this efficiency can be a game-changer, freeing staff to focus on high-value risk mitigation.
    • Improved Communication and Collaboration: A shared vocabulary breaks down communication barriers between functions. In day-to-day operations, this means cross-functional teams can come together quickly around emerging issues, because they have a common reference point. Stakeholders from different domains can contribute insights without talking past each other, leading to more robust risk assessments.

    A Contrast: Harmonized Taxonomy in Action

    Building a Common Risk Language: Practical Steps for Mid-Sized Companies

    Implementing a harmonized taxonomy may sound daunting, but it can be achieved with a series of practical, staged steps. Mid-sized corporates, in particular, should tailor these steps to their scale and culture, focusing on enabling cross-functional collaboration without excessive bureaucracy.

    Below is a roadmap to strengthen enterprise-wide risk insight and decision-making through a common language. 

    1 – Inventory and Reconcile Existing Risk Terminologies: 

    • Identify overlaps and gaps – Gather the risk lists and terminologies currently in use across departments (e.g. finance risk register, IT risk log, HR compliance checklist, etc.). It’s common to find different names for essentially the same risk. For instance, “data leak” in IT, “confidentiality breach” in legal, and “privacy compliance failure” in compliance might actually refer to overlapping risk events.
    • Draft an initial unified risk taxonomy – Form a small working group with representatives from key functions to review and start mapping equivalences. Leverage industry frameworks as a starting point, for example, ISO 31000 or COSO ERM categories but customize them to fit the company’s context. This collaborative approach brings deep expertise from each area and ensures the taxonomy isn’t imposed top-down but rather agreed upon.
    • Develop a Common Risk Glossary and Definitions – For each risk category and sub-category in the taxonomy, write down a clear definition and examples. This becomes the glossary of the common risk language and a common rating criterion.

    2 – Assign Clear Risk Ownership and Governance 

    • Assign Risk Owners – With the taxonomy in place, assign risk owners for each major category or for specific key risks. In a mid-sized company, a single executive or senior manager might own multiple related risks (for instance, the Head of Operations might own Supply Chain and Safety risks, the CFO might own Financial and Compliance risks, etc.). The important part is that it’s documented and communicated.
    • Establish a cross-functional working groups – Set up risk workking group that meets regularly to discuss risks enabled through the common language. Having this governance structure formalizes the common language, it’s where everyone “speaks risk” together. It helps break the historical silo mindset and replace it with a culture of information-sharing.

    3 – Implement Enabling Tools and Central Risk Register

    • Establish a single source of truth – This could be as simple as a shared spreadsheet or database in smaller companies, or a module in GRC (Governance, Risk & Compliance) software for those who have it. The key is that all departments log their identified risks, incidents, and mitigation plans in this central repository using the agreed taxonomy and ratings.
    • Provide visibility to the central source of truth – This central risk register gives everyone visibility into risks across the enterprise. It also simplifies reporting; one can generate an enterprise risk dashboard from it for management or board reporting, instead of manually compiling data.

    4 – Integrate Risk Discussions into Operational Processes: 

    Having a common language and tool is half the battle; the other half is making sure it’s used in decision-making. Mid-sized firms should embed the common risk language into their routines. For example:

    • Department heads can be required to include an update on key risks (using the common categories) in their monthly reports.
    • Project proposals can have a section assessing risks in common language terms.
    • Incident post-mortems should map causes and follow-up actions to the taxonomy categories.
    • Gamify or use simple checklists to guide staff on identifying and reporting risks consistently.
    • The goal is to avoid situations where only risk managers talk about risk. Instead, every team uses the common language in their context.

    5 – Link the Common Language to Risk Appetite and Strategy: 

    • Articulate risk appetite – Ensure that the company’s risk appetite is articulated in the same terms as the risk taxonomy.  This practice directly ties operational risk oversight to strategic goals and thresholds. It also helps in aligning mitigation efforts with what the company cares about most.
    • Periodically review enterprise risk profile – Companies should review these appetite statements periodically in their risk committee and adjust as necessary (for instance, if entering a new market or launching a new product, adjust appetite and categories accordingly).

    6 – Continuous Education and Refinement: 

    • Implement Ongoing Training – Conduct periodic workshops or scenario drills where cross-functional teams practice responding to a hypothetical risk event using the shared framework. The risk landscape also changes so the common language must evolve too.

    By following these steps, mid-sized enterprises can gradually build a common risk language that permeates the organization. This is as much a cultural initiative as a technical one. Leadership should articulate the “why”; explain to all staff that the company is establishing a common risk language so that everyone can work together to safeguard the business. Teams start to see how their concerns connect with others’.

    Mid-sized companies may not have the massive risk departments of large corporations, but they can absolutely achieve world-class risk oversight through this exercise. When risks stop being described in incompatible ways and instead are discussed on a shared platform, previously “unspoken” priorities become clear. Early warning signals emerge from noise. Compliance efforts become more about insight than paperwork.

    In an environment of ever-interconnected risks, establishing this shared understanding is fast becoming not just a best practice, but a necessary priority for sustainable growth.

    As the old proverb goes, “if you want to go fast, go alone; if you want to go far, go together”. A common risk language ensures that a company’s departments go together, equipped with unified insight, as they navigate the risks on the road ahead.

    Sources:

    • Boultwood, B. How to Develop an Enterprise Risk Taxonomy. GARP (2021) – Importance of a hierarchical common risk language for ERMgarp.orggarp.org.
    • LogicGate Risk Cloud. The Language of Risk (2021) – Benefits of a shared risk vocabulary; 50% of companies lack consistent risk data/languagelogicgate.comlogicgate.com.
    • Chambers, R. Break Down Silos for Visibility Into Enterprise Risk. MIT Sloan Management Review (Feb 2025) – 86% of risk professionals say silos hinder risk management; need for holistic approachsloanreview.mit.edu.
    • OneTrust Blog. Who Owns Third-Party Risk: Breaking Down Silos (Mar 2022) – Risk silos create duplication of efforts, analysis gaps, lack of knowledge sharingonetrust.com.
    • Hyperproof. 2025 IT Risk & Compliance Benchmark Report (Oct 2024) – Data silos link to higher breach frequency; 46% of siloed-risk firms had breaches vs 30% with integrated approachhyperproof.io. Also, siloed teams spend ~38% time on admin taskshyperproof.io.
    • MetricStream Case Study. Almarai – Enterprise Risk and BCM (2020) – Fragmented approach led to inconsistent risk understanding, limited visibility, duplicate workmetricstream.commetricstream.com; introducing common risk taxonomy improved data accuracy, visibility and cut effort by 50–70%metricstream.commetricstream.com.
    • MetricStream Case Study. Fortune 1000 Insurance Co. GRC Journey (2021) – Lack of common risk language caused inefficiencies, solved by centralized taxonomy and platformmetricstream.com.
    • Chakraborti, A. Challenges of ERM Implementation in India (Jan 2024) – Mid-sized enterprises struggle with resource constraints for risk managementlinkedin.com.
    • DeLoach, J. Using a Risk Model as a Common Language. Corporate Compliance Insights (2014) – Purpose of a common risk language is to ensure completeness in risk identification and effective communicationcorporatecomplianceinsights.com.
  • The Inner Game of Tennis

    The Inner Game of Tennis

    Curated fortnightly reads from Karmine book worms to set discerning minds into motion.

    Book Title: Inner Game of Tennis

    Author: W. Timothy Gallwey

    Duration: 2-4 hours

    Writing Style: Conversational & Reflective

    What is the main hook of this book?

    “The opponent within one’s own head is more formidable than the one across the net.”

    W. Timothy Gallwey wrote a book about tennis that somehow ended up on the shelves of CEOs, therapists, coaches, and just about anyone looking to master their mind. Some of the credit may belong to Bill Gates who couldn’t recommend this book enough. But it is eventually the sheer quality of the perspective that allowed these pages to be revisited by readers again and again.

    Because the real game Gallwey talks about is the one we play against ourselves. Let’s dive into what makes this classic worth returning to — even if you’ve never held a racquet.

    Premise / Core Idea

    Gallwey leverages the metaphor of tennis training to introduce a deceptively simple idea as his ‘core premise’. That we are not one, but two players:

    Self-1: The voice in our head. Critical, controlling, always nudging instructions.

    It’s the voice that judges, plans, worries, compares, and tries to “manage” performance. It thrives on the constant chatter – “Don’t miss,”

    “Why did you do that?”, “You’re messing up again.” In the author’s view, Self 1 doesn’t trust the body (Self 2) and constantly tries to override its natural instincts.

    At workplace, Self 1 often appears in the form of overthinking, micromanagement, perfectionism, and fear of failure.

    Self-2: The natural doer (the body). Instinctive, capable, quietly competent, if left alone.

    This is our intuitive, subconscious self, basically our body that quietly operates with literally no interference from us. The part that knows how to do things once it has learned. The body naturally learns best through awareness and experience, not commands.

    Classic example being, children learn to walk, catch, and run through leveraging Self 2 which is by observing, trying, and adjusting. Self-2 doesn’t talk or ruminate. It simply acts and most often, effortlessly.

    The inner game according to the author is about reducing the interference of Self 1 so Self 2 can do its thing. In practice, it is the difference between ‘thinking about the shot’ and ‘letting your body remember it.’ Self-2 the author maintains, knows how to swing once it’s seen and felt it. But Self-1 disrupts the flow by overanalyzing the motion mid-swing.

    And is it not just about tennis. That’s equally about presenting in a boardroom, pitching a client, even parenting a toddler at bedtime. It of course comes with continuous practice and preparing the Self-2 to naturally adapt to what it intuitively understands rather than the suggestive narrative which Self-1 provides.

    Trying Hard ≠ Performing Well

    One of Gallwey’s sharpest provocations is this: ‘Trying too hard is often the very thing that gets in the way.’

    In a world obsessed with hustle, this feels refreshingly subversive. He suggests that when we grip tighter, we lose fluidity. When we judge every move, we shrink our range. And when we over-correct, we forget how to just be.

    There’s liberation in realizing that peak performance isn’t about doing more, but interfering less. Formulaically speaking, it becomes thus – Performance = Potential – Interference.

    Observation Over Judgment

    This practice of non-judgmental observation is recommended to build awareness without anxiety. Applied off-court, it’s the kind of lens that helps leaders reflect without spiraling, coaches listen without fixing, and professionals learn without flinching.

    Application

    Let us try and apply some of these concepts in our business world. For example, how does this book link to risk management principles?

    Risk management, too, is often less about the risk itself and more about how organizations respond to it internally. Whether with clarity or chaos. The principles can reframe modern risk management.

    Self-1 over-instructs, micromanages and doubt. It is a control culture obsessed with rules, checklists, and optics.

    Self-2 acts with instinct, flow, and trust based on defined boundaries of principles. It is a culture that enables sound judgment, awareness, and empowered decisions.

    Another practical view point is the question we are always asked when we meet our clients – What are the new tools, layers, processes, technology levers that we can build into the system? How much do they cost? What are others in my peer group doing?

    Instead of layering with new information, the better questions to ask might be – What’s getting in the way of existing capability? Are we sufficiently leveraging what we already have? How can we optimize our existing tech stack to enable greater efficiencies?

    An underrated luxury we are all given is also to do with the innate body intelligence or what we often call, ‘intuition’. We select our favourite candidates in the first few minutes of the conversation, the VCs often make up their mind even before they know the numbers and one handshake is good enough to say no. Optimally leveraging the strength of Self-2 is sometimes they key difference between good and bad decisions.

    Our Take (~150–200 words)

    n many ways the concept is not necessarily new. A tangent of this is also dealt with in the seminal work – Thinking, fast & slow, buy Daniel Kahnemann where he talks about the dual nature but with a different lens (system 1 & 2 – the intuitive and the slow, deliberate).

    It is important to bring this up because the conclusions are somewhat different. Gallwey wants us to trust intuition and reduce mental noise to improve superlative performance. It is the mantra of flow. Kanhemann is however wary of intuition. He wants us to question it, be wary of the over confidence is sometimes nudges us towards.

    We think the principles of Inner Game of Tennis are best leveraged in activities that require performance, creative flow, presence and coaching. The principles might somewhat leave us deluded if we apply it to say, building robust strategy, hiring, risk management and judgement calls. Those are the spaces where we need a healthy mix of both, Self-1 & Self-2, to optimize results.

    One concept we particularly liked was that of the value of an ‘opponent’ or an ‘adversary’. The book redefines competition in a very interesting manner. We will let a quote do the talking:

    “Once one recognizes the value of having difficult obstacles to overcome, it is a simple matter to see the true benefit that can be gained from competitive sports.

    In tennis who is it that provides a person with the obstacles he needs in order to experience his highest limits? His opponent, of course! Then is your opponent a friend or an enemy? He is a friend to the extent that he does his best to make things difficult for you.

    Only by playing the role of your enemy does he become your true friend. Only by competing with you does he in fact cooperate! No one wants to stand around on the court waiting for the big wave.

    In this use of competition, it is the duty of your opponent to create the greatest possible difficulties for you, just as it is yours to try to create obstacles for him. Only by doing this do you give each other the opportunity to find out to what heights each can rise.”

    The book offers:

    • A fresh lens that confidence is often quiet trust in your own self.
    • A reminder to coach less and believe more in others and ourselves
    • A perspective to manage performance anxiety by getting out of your own way

    It is a manual for uncluttering the mental court.

    Challenger thoughts

    • Most Cognitive Behavioral Approach (CBTs) suggest we work with our inner dialogue, actively analyse their validity and reshape them instead of completely ignoring the noise. We think inner critic is not always noise. It is our in-house risk manager.
    • Another aspect that is somewhat overlooked in the book is the value of practice and consistent effort in the right manner. Entering in to confident flow does require immense ‘conscious’ practice. Trusting intuition before that may not be fruitful.
    • Self-1 and Self-2 might be an over-simplistic model? Perhaps our internal decision making is not all that straightforward and we are driven by things far more unknowable and uncontrollable.
    • Structure, systems and cadence are crucial to enabling successful utilization of Self-2.

    The Thinking Shelf™ Rating

    This book certainly hits your “Reference Shelf”. We may not open it often. But the insights remain ever more valuable to challenge our assumptions of peak performance.

    Choose one from the below with a short rationale:

    • Top Drawer (Strategic Execution)

    Shapes how we lead. High impact on daily decisions.

    • Reference Shelf (Thought Depth)

    Changes how we think at a macro level. Rarely opened, never forgotten.

    • Backpack Book (Reflective Insight)

    We take it on walks. Influences philosophy more than playbooks.

    • Weekend Window (Light Provocation)

    A light, inspiring read—good for mood, not models.

  • Inner Game of Tennis

    Inner Game of Tennis

    Duration: 2-4 hours

    Writing Style: Conversational & Reflective

    What is the main hook of this book?

    Gallwey wrote a book about tennis that transcended sport, landing on desks of CEOs, coaches, and therapists alike. Part of its cult status may stem from fans like Bill Gates, but its staying power lies in a deceptively simple idea: performance is an inner game – the one we play against ourselves.

    The opponent within one’s own head is more formidable than the one across the net.

    Premise / Core Idea

    Gallwey splits the self into two players:

    Self-1: The voice in our head. judgmental, anxious, controlling. In the author’s view, Self-1 doesn’t trust the Self- 2 and constantly tries to override its natural instincts.

    At workplace, Self-1 often appears in the form of overthinking, micromanagement, perfectionism, and fear of failure.

    Self-2: The natural, intuitive doer (the body). instinctive, capable, and fluid when left alone.

    This is our intuitive, subconscious self, the part that knows how to do things once it has learned. Classic example being, children learn to walk, catch, and run. Self-2 doesn’t talk or ruminate. It simply acts and most often, effortlessly.

    Peak performance, he argues, comes not from trying harder but from silencing Self-1 and trusting Self-2. The body knows what to do and thinking often gets in the way. This principle applies far beyond sport: whether in boardrooms, negotiations, or bedtime parenting routines.

    The inner game according to the author is about reducing the interference of Self 1 so Self 2 can do its thing. In practice, it is the difference between ‘thinking about the shot’ and ‘letting your body remember it.’ Self-2 the author maintains, knows how to swing once it’s seen and felt it. But Self-1 disrupts the flow by overanalyzing the motion mid-swing.

    Trying Hard ≠ Performing Well

    One of Gallwey’s sharpest provocations is this: ‘Trying too hard is often the very thing that gets in the way.’

    In a world obsessed with hustle, this feels refreshingly subversive. He suggests that when we grip tighter, we lose fluidity. There’s liberation in realizing that peak performance isn’t about doing more, but interfering less.

    Formulaically speaking, Performance = Potential – Interference. Observation over judgment is recommended. Instead of critiquing every move, simply notice. Leaders, coaches, and professionals can benefit from this lens thus fostering awareness without anxiety.

    Application

    The book’s principles align surprisingly well with modern business dynamics. Take risk management:

    · Self 1- driven cultures rely on control, checklists, and fear of failure.

    · Self 2- enabled cultures emphasize trust, intuition, and clarity within structured boundaries.

    Instead of endlessly adding tools, the smarter approach might be asking: What’s interfering with what we already have? In high-stakes environments, from VC funding calls to talent selection, gut instinct often leads the charge. Harnessing Self-2 effectively can be the difference between overthinking and insight.

    Our Take

    Gallwey’s core idea parallels Kahneman’s Thinking, Fast and Slow, yet reaches different conclusions. Kahneman warns us of intuition’s flaws. Gallwey wants us to lean into it, especially in performance-driven arenas.

    We think the principles of Inner Game of Tennis are best leveraged in activities that require performance, creative flow, presence and coaching. The principles might somewhat leave us deluded if we apply it to say, building robust strategy, hiring, risk management and judgement calls. Those are the spaces where we need a healthy mix of both, Self-1 & Self-2, to optimize results.

    One standout concept: Your opponent is your ally. The book redefines competition in a very interesting manner. We will let a quote do the talking:

    “… In tennis who is it that provides a person with the obstacles he needs in order to experience his highest limits? His opponent, of course! Then is your opponent a friend or an enemy? He is a friend to the extent that he does his best to make things difficult for you.”

    “…Only by playing the role of your enemy does he become your true friend. It is the duty of your opponent to create the greatest possible difficulties for you, just as it is yours to try to create obstacles for him. Only by doing this do you give each other the opportunity to find out to what heights each can rise…”

    The book offers a manual for uncluttering the mental court, a fresh lens that confidence is often quiet trust and a toolbox to manage performance anxiety by quietening inner critic.

    Challenger thoughts

    • Most Cognitive Behavioral Approach (CBTs) suggest reshaping and not ignoring / silencing our inner dialogue. We think inner critic is not always noise. It is our in-house risk manager.
    • Gallwey perhaps underplays the role of structured, conscious practice. Intuition / flow needs training. Trusting intuition before that may not be fruitful.
    • The Self-1 vs Self-2 model might be too binary. Human behavior is more complex and layered.
    • Structure, systems and cadence are crucial to enabling successful utilization of Self-2.

    Margin Notes Rating Category: Reference Shelf

  • Mind the Gap: Bridging Board Oversight and Operational Realities

    Mind the Gap: Bridging Board Oversight and Operational Realities

    Background

    Risk management failures in mid-sized and emerging companies have made headlines from Silicon Valley to Mumbai, often tracing back to a troubling disconnect between boardroom understanding and on-the-ground realities. This “board-versus-operational reality” gap in risk oversight has tangible consequences; from financial losses and regulatory penalties to reputational damage. A recent consulting survey indicated nearly 55% of board members say their company’s risk management struggles to keep pace with business strategy changes.

    In an era of rising uncertainties, board members and independent directors are expected to serve as crucial sentinels, yet their effectiveness is often hampered by cultural and informational barriers. As a part of this series, we explore in this article as to why mid-sized enterprises are prone to governance gap, the real-world fallout when it goes unaddressed, and how boards can close the chasm between the view from the boardroom and the operational reality on the ground.

    Understanding the Oversight Gap

    Every corporate board has a fiduciary duty to oversee risk, but there’s often a disconnect between what boards believe about risk management and what’s actually happening within the organization. In many mid-sized firms, boards receive periodic risk reports and updates that paint a reassuring picture. Risks identified, controls implemented, compliance boxes checked. Yet the day-to-day reality in business units or project teams can be very different. Metrics and reports presented to the board may be incomplete or overly optimistic, leading to a false sense of security at the governance level.

    Boards often overestimate risk management effectiveness due to incomplete information and structural weaknesses, leaving mid-sized firms vulnerable to crises. This gap is not due to negligence or indifference from boards, but rather structural and cultural challenges.

    Root Causes of the Gap

    • Information Asymmetry: Senior executives may filter what they escalate to the board, and mid-level managers might downplay or fail to report issues upward, especially in a culture that ‘shoots the messenger’.
    • Limited Risk Expertise: Limited expertise in specific risk areas often exacerbates the problem. If directors aren’t well-versed in emerging risks (be it cybersecurity, regulatory compliance, or operational safety), they may not know the right questions to ask or may accept vague assurances. In fact, one analysis observed that a lack of operational risk expertise can make board members reluctant to stray from their domain.
    • Siloed Reporting: Operational risks are often tracked inconsistently, failing to reach the board in a meaningful way. Without the right data and Key Performance Indicators (KPIs), they might not realize the true magnitude of certain risks.
    • Differing Perspectives & Priorities: It helps to recognize that boards and operational teams often view risk through different lenses requiring better communication to align high-level oversight with ground-level realities.

    Why Mid-Sized Companies Are Especially Vulnerable

    • Weak Risk Framework: Large multinational corporations often have extensive risk management frameworks, dedicated risk officers, and layers of oversight. In contrast, small and mid-sized enterprises (SMEs) frequently operate with leaner structures which can widen the board-operational gap. Research shows that many mid-sized companies do not have fully defined Enterprise Risk Management (ERM) programs due to cost constraints, limited resources, and fewer dedicated risk professionals.
    • Lean Structures: Often, employees wear multiple hats; for example, the finance head might also oversee compliance, or operations managers double as safety officers. This can lead to gaps in expertise and bandwidth when it comes to systematically identifying and mitigating risks. The board might assume that “someone in management” is handling risk, but in reality, risk responsibilities can fall through the cracks in a mid-size organization’s structure.
    • Rapid Growth: Mid-sized firms are frequently in high-growth mode. They are expanding into new markets, launching products, or undergoing digital transformation, all of which introduce new risks. However, governance processes in these companies often lag behind their growth. A post-mortem by regulators on Silicon Valley bank observed that the bank’s growth far outpaced the abilities of its board and management to install a suitable risk control infrastructure.
    • Cultural Pressures: A ‘Business Today’ magazine analysis of recent startup scandals noted a “convenient lack of oversight from boards, as start-ups get caught up in the rat race of growth over profits”.  Mid-sized enterprises, especially those led by founders or family owners, can have tight-knit cultures with strong top-down influence. If the leadership’s emphasis is on aggressive growth or hitting targets “at all costs,” employees may feel pressure to prioritize results over risk compliance.
    • Weak Internal Controls: Mid-sized firms often lack the robust internal controls and audit functions that larger firms use to catch issues early. Risk assurance processes in a smaller company might be outsourced or minimal, and risk reporting may not be integrated company-wide. This means the board’s usual safety net, internal audit and compliance reports, may not be effective.

    Understanding Recent Risk Management Failures – Real-World Consequences:

    Governance lapses in mid-sized firms lead to serious failures, underscoring the need for boards to bridge the oversight gap. Recent cases illustrate how the board-operational disconnect fuels crises:

    These examples across different sectors highlight the critical gap between boards oversight and operational realities, where incomplete knowledge of day-to-day operations led to risk management failures. Despite having boards and risk policies on paper, governance breakdowns allowed small issues to escalate into major crises. For mid-sized and emerging companies, closing the board-operations gap in risk oversight is not just a best practice but a strategic necessity for survival and success.

    Closing the Gap: Practical Steps for Boards to Enhance Risk Oversight

    Bridging the divide between boardroom perception and operational reality in risk management requires concerted action. Boards of mid-sized and emerging companies can take practical, actionable steps to enhance the sanctity of their risk oversight role. These steps span tools and technology, structural and process improvements, and cultural shifts. Below are key recommendations for boards and their companies:

    • Unfiltered Communication: Boards must insist on clear and candid risk reporting. Boards should demand that risk reports be forward-looking, impact-focused, and unfiltered. Instead of high-level summaries that gloss over issues, reports should explicitly connect risks to business outcomes. This can be done through reviewing “risk dashboards” that include key risk indicators, incident logs, and mitigation status updates for major / emerging risks. 
    • Strengthen risk governance structure: Many mid-sized companies suffer because no single leader is accountable for enterprise-wide risk – plugging this gap is vital. Establish regular sessions where the risk officer and internal audit head can speak to directors without senior management in the room, fostering open communication. 
    • Translate Technical Risks & Elevate risk discussions: Operational details (e.g., “unpatched firewalls”) should be framed in business terms (e.g., “potential $2M loss from a breach”).

    Make risk a standing priority at every board meeting. Just as financial performance and strategy are regularly discussed, insist that significant operational and strategic risks get airtime in proportion to their importance. Boards could also consider scenario planning and deep-dives: pick a few “what if” scenarios.

    • Leverage Technology and Data for Risk Monitoring: In today’s digital age, even mid-sized companies can afford tools to enhance risk oversight. Boards should encourage management to utilize risk management software, dashboards, and data analytics to gain real-time visibility into risks. According to a 2025 survey, 76% of mid-market businesses already use technology in some aspect of risk management, but only 11% have fully integrated. There is immense room to grow here.  
    • Fostering risk aware culture through appropriate tone at the top: Perhaps the most critical yet intangible fix is cultural. The board and executive leadership must set the tone that risk management is everyone’s responsibility and is valued. Leadership should visibly recognize and reward teams that identify and manage risks well, turning risk management successes into learning moments company-wide. Conversely, there should be accountability when risk processes are ignored or warnings silenced. The board could ask for a “Risk Culture” assessment. If results show problems say, the board must push management to address this through appropriate training. 

    As experts advise, boards should exercise an “inquisitive mindset; digging deeper, challenging assumptions, and encouraging open communication. All before adverse events materialize.”

    In essence, bridging the gap requires aligning these perspectives. When governance and implementation are in sync, Boards can anticipate issues and support management in addressing them proactively, rather than cleaning up surprises after the fact.

    The Strategic Role of Independent Directors in Risk Oversight

    Independent directors are critical for objective oversight, challenging assumptions and fostering a risk-aware culture. Independent directors bridge the gap by:

    • Asking Tough Questions: Free from management ties, they probe operational realities (e.g., “Are cybersecurity resources adequate?”).
    • Bringing Expertise: Directors with cyber or compliance backgrounds enhance oversight, reducing financial irregularities (per governance surveys).
    • Setting Tone: By engaging risk managers directly and rewarding candor, they encourage issue escalation.
    • Leadership in Crisis: As seen in BharatPe (2022), independent director can direct investigation of misconduct, thus protecting stakeholder interests.

    In summary, Independent Directors also play a strategic role as risk sentinels and governance champions. They must use their position to ensure the board isn’t operating with blind spots. As one LinkedIn corporate governance commentary put it, independent directors act as “ethical custodians, guardians of shareholder interests, and champions of accountability,” reinforcing structures that mitigate risk.

    Conclusion: Strengthening the Board’s Risk Guardianship

    We close this article with 10 sharp questions that we believe the board members & independent directors must ask in order to obtain comfort in the risk / governance framework within mid-sized enterprises. Obtaining comfort on these areas will naturally cascade into the direction and investments that need to be made towards better risk management.

    As businesses globally navigate an increasingly volatile world; from cyber threats and supply chain disruptions to regulatory shifts and beyond, closing the board-operational reality gap will distinguish the resilient companies from the rest. With boards committing to the sanctity of their risk oversight role, mid-sized enterprises can confidently stride forward. 

    Sources:

    • AuditBoard Blog – “The Business Resilience Gap: A Tipping Point” (EY Global Board Risk Survey findings) auditboard.com auditboard.com.
    • Risk & Insurance – “Middle-Market Businesses Face Risk Protection Gaps” (Nationwide survey of mid-market firms, 2025) riskandinsurance.com riskandinsurance.com.
    • Harvard Law School Forum (Glass Lewis post) – “Corporate Governance, Board Oversight & the 2023 Banking Crisis” (Analysis of SVB, Signature, First Republic failures) corpgov.law.harvard.edu corpgov.law.harvard.edu.
    • Economic Times (India) – “What’s behind the CEO resignations in India’s private sector banks?” (Governance lapses in mid-tier banks) m.economictimes.com.
    • Business Today (India) – “How Zilingo’s Troubles Bring to the Fore Governance Issues at Start-ups” (Start-up governance lapses, Zilingo and BharatPe) businesstoday.in businesstoday.in.
    • Reuters – “Investors of India’s GoMechanic seek audit into ‘inflated’ financials” (GoMechanic startup financial fraud admission) reuters.com reuters.com.
    • ForensicRisk Alliance – “Navigating the Storm: learning from past corporate failures in the GCC” (Gulf corporate governance failures and lessons) forensicrisk.com.
    • dss+ Consulting – “When Boards Miss the Warning Signs: Elevating Operational Risk Oversight” (Operational risk oversight challenges and recommendations) consultdss.com consultdss.com.
    • LinkedIn Pulse – “Independent Directors: Navigating Corporate Governance” (Role of independent directors in risk oversight and culture) linkedin.com.
    • BusinessToday (India) – “YES Bank independent director…resignation letter” (Yes Bank governance failure, independent director protest) businesstoday.in businesstoday.in.