Organizations today operate in an environment defined by uncertainty, speed, and growing complexity. Strategic decisions, operational execution, and financial performance can no longer be managed independently of risk. This is exactly where Enterprise Risk Management (ERM) comes into play. A modern ERM framework connects strategy, risk, and performance into a single, integrated management approach.

This article explains how to build an effective ERM framework, why linking risk management with strategy is critical, and why ISO 31000 plays a central role in professional Enterprise Risk Management.

Key Takeaways

• ERM is a holistic approach to managing risks and opportunities across the entire organization
• An effective ERM framework systematically connects strategy, risk, and performance
• Risks should be identified and assessed in direct relation to strategic objectives
• Risk appetite and risk tolerances are core steering elements
• ISO 31000 provides the internationally recognized foundation for risk management
• ERM supports better decision-making, resilience, and sustainable performance

What is Enterprise Risk Management (ERM)?

Enterprise Risk Management is a structured, organization-wide approach to identifying, assessing, managing, and monitoring risks and opportunities. Unlike traditional risk management, which is often fragmented and function-specific, ERM looks at the organization’s overall risk profile.

The goal of ERM is not to eliminate risk, but to enable informed decision-making by creating transparency around uncertainty. A mature ERM system helps leaders consciously take risks when they are aligned with strategy and risk appetite.

Why ERM must connect strategy, risk, and performance

Many ERM initiatives fail because risks are assessed independently of the company’s strategy. In reality, risks are a direct consequence of strategic choices. Without this connection, risk management becomes a compliance-driven or reporting-focused exercise.

An integrated ERM approach ensures that:

• strategic objectives define the starting point for risk identification
• risks are prioritized based on their impact on strategic success
• performance indicators are interpreted in the context of underlying risks
• executives and boards make more balanced, higher-quality decisions

Core components of an effective ERM framework

1. Governance and accountability

Effective ERM starts with clear governance structures and defined responsibilities. The board and executive management hold overall accountability, while oversight bodies monitor effectiveness. On an operational level, risk owners are responsible for specific risks.

Most importantly, ERM must be understood as a leadership discipline, not the task of a single department.

2. Linking ERM to corporate strategy

The design of an ERM framework should always begin with strategy. Key questions include:

• What strategic objectives does the organization pursue?
• What assumptions underpin these objectives?
• What uncertainties could threaten or enable success?

Risks should be identified along strategic initiatives rather than organizational silos.

3. Risk identification and assessment

A structured process ensures that both internal and external risks are considered, including:

• strategic risks
• operational risks
• financial risks
• regulatory and legal risks
• technological and digital risks
• ESG and reputational risks

Risks are typically assessed based on likelihood and impact, often complemented by scenario analysis.

4. Risk appetite and risk tolerances

Risk appetite defines how much risk an organization is willing to accept in pursuit of its objectives. It forms the critical link between strategy and day-to-day decision-making.

Clear risk tolerances make risks measurable and manageable and allow deviations to be identified early. Without a defined risk appetite, ERM lacks real impact.

5. Integration into performance management and decision-making

A mature ERM framework is tightly integrated with budgeting, forecasting, and performance management processes. Risks are systematically considered in investment decisions, strategic initiatives, and target-setting.

This creates a consistent and balanced view of performance and risk.

6. Monitoring, reporting, and continuous improvement

ERM is not a one-time project but an ongoing process. Regular monitoring, meaningful reporting, and clearly defined key risk indicators are essential.

At the same time, the framework must be continuously reviewed and adapted to changing internal and external conditions.

The importance of ISO 31000 for Enterprise Risk Management

ISO 31000 is the internationally recognized standard for risk management and forms the conceptual foundation for many ERM frameworks. It is industry-agnostic and applicable to organizations of all sizes.

Why ISO 31000 matters

• It defines clear principles for effective risk management
• It ensures that risk management creates value rather than bureaucracy
• It emphasizes integration into governance, strategy, and processes
• It promotes a common language and consistent methodology across the organization

ISO 31000 does not prescribe rigid rules but provides a flexible framework that can be tailored to specific needs. This makes it ideally suited for ERM.

Key elements of ISO 31000

ISO 31000 is built around three core elements:

• Principles: value creation, integration, structure, adaptability, and continuous improvement
• Framework: governance, roles, resources, and organizational embedding
• Process: risk identification, analysis, evaluation, treatment, monitoring, and communication

An ERM framework aligned with ISO 31000 is credible, auditable, and internationally comparable.

Benefits of an integrated ERM framework

Organizations that use ERM strategically benefit from:

• better and faster decision-making
• greater transparency of critical risks
• increased resilience in times of crisis
• improved capital allocation
• stronger trust from investors and stakeholders
• sustainable long-term performance

ERM thus evolves from a compliance requirement into a true competitive advantage.

Common pitfalls in implementing ERM

• focusing solely on compliance
• lack of top-management support
• missing link to strategy
• overly complex methodologies
• insufficient integration into existing processes

A pragmatic, strategy-driven approach is essential for success.

Conclusion

A modern Enterprise Risk Management framework is far more than a risk register. It is a core management tool that connects strategy, risk, and performance. ISO 31000 provides the proven foundation for building such a framework.

Organizations that embed ERM consistently lay the groundwork for better decisions, greater resilience, and sustainable success in an increasingly uncertain world.

FAQ about Enterprise Risk Management

What is the difference between risk management and ERM?

Traditional risk management often focuses on individual risks or functions. ERM takes a holistic, organization-wide view and directly links risks to strategy and performance.

Is ERM only relevant for large organizations?

No. ERM is valuable for organizations of all sizes. The scope and complexity of the framework should be proportionate to the organization.

What role does ISO 31000 play in ERM?

ISO 31000 provides the principles, framework, and process for professional risk management and serves as a recognized reference standard for ERM.

How complex is it to implement an ERM framework?

The effort depends on size, industry, and maturity level. A pragmatic, phased approach is usually the most effective.

How do you measure the success of ERM?

Success is reflected not only in fewer losses, but primarily in better decisions, higher achievement of objectives, and increased organizational resilience.

The recent publication by Swiss Re regarding insured losses in the first half of 2025 sends a clear warning signal to the global economy. With significant losses driven by wildfires and Severe Convective Storms, it is becoming increasingly evident that so-called secondary natural perils are no longer secondary in terms of their financial and operational impact. For companies, this means that mere reliance on insurance policies is no longer sufficient. Instead, an integrated strategy comprising Governance, Risk, and Compliance (GRC) is moving into focus to safeguard organizational resilience.

Key Takeaways

• According to Swiss Re, the first half of 2025 recorded massive insured losses, primarily driven by wildfires and severe storms.
• So-called secondary perils are increasingly exceeding traditional primary perils, such as earthquakes or hurricanes, in both frequency and loss magnitude.
• Companies face rising insurance costs while simultaneously confronting potential protection gaps.
• A robust GRC framework is essential to integrate physical climate risks into corporate steering and reporting (e.g., CSRD).
• Business Continuity Management (BCM) must be adapted to the new reality of volatile weather events.

Analysis: From Loss Balance to GRC Strategy

The data provided by Swiss Re highlights a trend that had already emerged in previous years and has reached a new level of intensity in 2025. The increase in extreme weather events can no longer be viewed as a statistical outlier but must be seen as a new normal fueled by climate change. From a Governance, Risk, and Compliance perspective, this results in concrete areas of action that extend far beyond pure insurance management.

Governance: Management Responsibility

In the governance dimension, the responsibility for natural hazards is shifting directly to boardrooms and supervisory boards. It is no longer enough to merely acknowledge climate risks. The fiduciary duties of corporate leadership require an active engagement with the question of how these external shocks threaten the business model in the long term.

Effective governance must ensure that physical climate risks are an integral part of strategic planning. If locations are threatened by wildfires or supply chains are severed by storms, this is not simply “weather-related bad luck,” but a foreseeable scenario for which leadership must be prepared. Governance here means releasing resources for prevention and aligning the risk strategy with data from reinsurers like Swiss Re.

Risk Management: Reassessing the Risk Landscape

Risk management faces the task of increasing the granularity of its analyses. Swiss Re’s reports show that thunderstorms and hail cause locally confined but financially devastating damage. Traditional risk models, often based on historical averages, fall short here.

Risk managers must conduct scenario analyses that specifically take so-called “Secondary Perils” into account. This includes not only direct property damage to own buildings or facilities. Often much more critical are the indirect consequences: business interruptions, failure of critical infrastructure (power, water, data lines), and disruptions in the supply chain. Modern risk management must map and quantify these dependencies. Furthermore, companies must verify whether their insurance policies are still adequate or if premium increases and exclusion clauses are creating an economic risk that requires provisions in the balance sheet.

Compliance: Regulatory Pressure and Reporting

The relevance of the Swiss Re data is also evident in compliance, particularly in the context of sustainability reporting. Regulations such as the Corporate Sustainability Reporting Directive (CSRD) in the EU oblige companies to disclose the financial impacts of climate risks.

If a company operates in regions that are particularly affected according to the Swiss Re report (e.g., wildfire-prone areas in North America or Southern Europe), this must be reflected in reporting. Compliance departments must ensure that the physical risks identified in risk management flow correctly into both non-financial and financial reporting. Ignoring this data can be interpreted as greenwashing or misleading capital market communication, entailing significant liability risks.

Business Continuity as an Operational Response

The interface of Risk and Operations is Business Continuity Management (BCM). The high frequency of storms and fires requires more agile BCM plans. Rigid emergency manuals are of little help against dynamic weather patterns. What is required are flexible response mechanisms, redundant supplier structures, and decentralized warehousing to absorb outages. Insights from the first half of 2025 should flow directly into BCM tests and simulations to harden operational resilience.

Conclusion: From Reaction to Preventive Steering

The loss balance of the first half of 2025 underscores impressively that volatility caused by natural hazards is not a temporary phenomenon but a structural change in the risk landscape. For companies, this implies a mandatory paradigm shift. GRC must no longer be understood as an administrative duty in the background but must function as a central, strategic steering instrument.

Only those who anticipate risks instead of merely settling claims, and who use compliance requirements as a quality mark for resilience, will survive in this increasingly uncertain environment in the long term. Investing in an integrated GRC system and engaging with data such as that provided by Swiss Re is thus far more than a cost item. It is the decisive foundation for operational capability and tomorrow’s economic success.

FAQ

What is meant by “Secondary Perils” as opposed to Primary Perils?

Primary Perils are large-scale events such as tropical cyclones or earthquakes. Secondary Perils are events that often occur more frequently but are more locally confined, such as severe thunderstorms, hail, tornadoes, droughts, or wildfires.

Why is this report relevant for companies that are not insurers?

The data shows that the probability of business interruptions and property damage is rising globally. Companies must adjust their risk precautions as insurance becomes more expensive or certain risks are no longer covered at all. Additionally, regulators demand transparency regarding these risks.

What role does the CSRD play in this context?

The CSRD requires affected companies to perform a Double Materiality analysis. This involves assessing and reporting the financial risks that climate change imposes on the company (outside-in perspective). The increase in natural catastrophes is a central factor in this regard.

How can GRC help reduce insurance costs?

A strong GRC system demonstrates to insurers that the company knows its risks and actively mitigates them (e.g., through preventive fire protection or redundant systems). This can improve the bargaining position when renewing insurance policies.

When people think of fast-growing fintechs, they tend to picture innovation, agility, and disruption – but rarely governance or compliance. Revolut, the London-based financial platform, has shown that speed and structure can go hand in hand. After years of rapid expansion and growing pains, the company realized that sustainable success requires more than growth alone. Today, Revolut stands as an example of how governance, risk, and compliance (GRC) can become an active part of company culture – and how a system called “Karma” helps employees take shared responsibility for doing the right thing.

Key Takeaways

• Revolut has introduced an internal points system called “Karma,” linking team bonuses to compliance and risk behavior.
• Employees earn points for completing trainings, following internal policies, and reporting risks early.
• The goal is not to punish mistakes but to promote a shared sense of responsibility across teams.
• According to Revolut, the system has improved overall compliance performance by around 25 percent.
• GRC is no longer a control mechanism, but part of everyday behavior and culture.

Why Revolut Changed Its View of GRC

Revolut’s story is one of transformation. The company grew explosively, becoming one of Europe’s best-known fintechs with millions of customers and a presence in dozens of markets. But such speed also brought challenges: high internal pressure, lack of oversight, and compliance issues, particularly around anti–money laundering processes.

Eventually, Revolut decided to rethink its approach. Instead of viewing compliance as an obligation, it began treating it as a business advantage. In 2020, the company launched the “Karma System” – a new way to encourage employees to see risk management and compliance not as tasks imposed from above, but as shared goals that shape everyday work.

How the Karma System Works

The idea is simple but effective. Every department collects points for positive risk and compliance behavior. Completing training, following reporting standards, and identifying issues early all earn points. Failing to meet requirements results in deductions.

These points are tracked in an internal dashboard and influence bonus calculations. However, the focus is on teams rather than individuals. This means employees are motivated to help one another and ensure the whole department performs well. The system creates accountability – but also community.

As one manager at Revolut put it: “It’s not about punishing mistakes. It’s about making good behavior visible – behavior that prevents risks before they turn into problems.”

GRC as Part of Everyday Culture

The Karma System reflects a larger cultural shift inside Revolut. Governance, risk management, and compliance are no longer separate disciplines. They are part of how the company thinks and works.

Governance now means clear responsibilities and transparent decision-making.
Risk management means anticipating problems, not reacting to them.
And compliance means building trust through consistent, ethical action – not paperwork.

By integrating these principles into daily work, Revolut has created a learning organization. Every employee understands that they play a role in managing risk and ensuring accountability.

Lessons for Other Companies

Revolut’s example shows that GRC doesn’t have to slow a business down. Done right, it strengthens it. Here are key takeaways for other organizations:

1. Positive incentives work better than control. When compliance and risk awareness are rewarded, employees engage instead of resist.
2. Team accountability builds stronger cultures. Shared responsibility fosters collaboration instead of fear.
3. Transparency is key. Real-time dashboards and open communication turn compliance into a visible, shared goal.
4. Leadership sets the tone. Culture follows example – GRC must be championed by management, not delegated.

Challenges and Future Outlook

No system is perfect. Some critics argue that linking bonuses to compliance could lead to a “points game” rather than genuine behavioral change. Revolut acknowledges this risk – and emphasizes that the success of Karma depends on leadership, dialogue, and trust.

Still, the initiative shows that compliance can be human, collaborative, and even motivating. When GRC becomes part of company culture, it stops being a box-ticking exercise and starts being a source of stability and trust.

Conclusion

Revolut’s journey from hyper-growth fintech to GRC pioneer illustrates a crucial point: sustainable success comes from balance. The Karma System might sound unconventional, but it works because it treats people as the foundation of governance and risk management.

When employees understand why compliance matters – and feel responsible for it – rules turn into values, and systems turn into culture. In an era of uncertainty, that may be the most valuable form of resilience a company can build.

---

FAQ

What is Revolut’s Karma System?
It’s an internal points-based model that tracks how well departments follow risk and compliance rules. Team performance affects individual bonuses indirectly, encouraging collective responsibility.

How much did the system improve performance?
According to Revolut, compliance performance improved by about 25 percent since the system’s launch.

Why is it team-based rather than individual?
To avoid fear or competition. The goal is to encourage cooperation and shared ownership of risk management.

Can other companies use this model?
Yes, but only if it fits their culture. The key is not the points themselves, but creating real awareness and ownership around GRC topics.

How is Revolut’s approach different today?
It focuses more on transparency, proactive risk management, and ethical leadership – moving away from the old “growth at all costs” mindset.

Global business today is more interconnected than ever before. Companies rely on a vast network of suppliers, service providers, and technology partners to keep operations running. This interconnectedness creates efficiency and flexibility – but it also introduces significant risks.

Cyberattacks on suppliers, human rights violations in the supply chain, or the sudden insolvency of a critical vendor can have immediate consequences for an organization. These events threaten operational stability, compliance, reputation, and even financial performance.

In the context of Governance, Risk, and Compliance (GRC), third-party and supply chain risks have therefore become a central management concern. Companies must learn to identify, assess, and control risks beyond their own organizational boundaries.

Key Takeaways

• Supply chains and third-party dependencies are among the biggest vulnerabilities in modern organizations.
• The greatest risks arise from a lack of transparency, weak oversight, and insufficient risk management.
• Regulatory frameworks such as the EU Supply Chain Act, ESG reporting obligations, and NIS-2 increase the pressure on companies to monitor their partners more closely.
• An integrated GRC system enables organizations to capture, evaluate, and mitigate risks systematically while ensuring compliance.

Why Supply Chain Risks Are So Dangerous

Today’s supply chains are complex, global, and highly dynamic. A single product might involve components from five countries, span ten supplier levels, and depend on multiple logistics providers. While this structure offers cost and efficiency advantages, it also creates vulnerabilities.

A single failure or disruption can halt production lines. Even more severe are cases involving ethical, environmental, or security breaches within the supply chain. Human rights violations, data leaks, or environmental offenses committed by partners inevitably affect the company at the top of the chain – leading to reputational damage, regulatory penalties, and loss of customer trust.

The core issue is often invisibility. Many organizations do not have full transparency over their second- or third-tier suppliers. They might know their direct vendors but not who stands behind them. This lack of visibility makes proactive risk management nearly impossible and forces companies into a reactive mode when crises hit.

Increasing Regulatory Pressure

Governments and regulators have started to respond to these challenges. In the EU, Germany, and Switzerland, new laws require companies to assume greater responsibility for what happens within their supply chains.

Germany’s Supply Chain Due Diligence Act (LkSG) and the EU’s upcoming Corporate Sustainability Due Diligence Directive (CSDDD) oblige companies to identify, monitor, and mitigate risks across the entire value chain.

At the same time, sustainability and ESG regulations such as the Corporate Sustainability Reporting Directive (CSRD) and the European Sustainability Reporting Standards (ESRS) introduce stricter reporting duties. Companies must now provide evidence that they are managing social, environmental, and ethical risks throughout their supply chain.

From a cybersecurity and operational resilience perspective, new frameworks like NIS-2 and DORA in the financial sector require organizations to ensure that their third parties maintain appropriate levels of information security and resilience. Compliance is no longer optional – it is a prerequisite for market participation.

The GRC Approach: Structure Instead of Reaction

Meeting these requirements demands a structured, system-based approach. Governance, Risk, and Compliance must extend beyond the company’s own walls and encompass the entire supplier ecosystem.

A modern Third-Party Risk Management (TPRM) program pursues three main objectives: transparency, assessment, and control.

1. Transparency:
   The foundation of TPRM is knowing who your partners are – including indirect suppliers. Building a complete supplier inventory is the first step. Classifying suppliers based on their criticality and risk exposure follows next.
2. Risk Assessment:
   Each partner should undergo a structured risk assessment that covers financial stability, cybersecurity posture, sustainability performance, legal compliance, and reputation.
3. Control and Monitoring:
   Based on these assessments, specific control measures and monitoring mechanisms should be implemented – from audit programs and certification reviews to continuous monitoring and escalation processes in case of red flags.

Digitalization and Automation as Success Factors

Given the scale and complexity of global supply chains, manual approaches are no longer sufficient. Digital GRC platforms can centralize data, automate monitoring, and provide real-time insights into third-party risk exposure.

Modern solutions integrate data feeds from financial risk databases, cybersecurity scoring systems, and compliance registries, allowing for automated alerts when anomalies occur. Reporting and regulatory documentation can also be automated – a major advantage in the context of ESG and audit requirements.

When TPRM is embedded into a broader GRC framework that also includes incident, policy, and audit management, companies gain a holistic risk perspective. This strengthens not only compliance but also strategic resilience.

Key Success Factors for Effective Third-Party Risk Management

Organizations that want to manage third-party and supply chain risks effectively should follow a few guiding principles:

• Define responsibilities clearly: Third-party risk management should be an organizational function with clear ownership, ideally aligned between procurement, compliance, and risk management.
• Prioritize by criticality: Not every supplier carries the same level of risk. Focus on partners that are business-critical or hold sensitive data.
• Review regularly: Risk assessments must be updated periodically as markets, regulations, and supplier relationships evolve.
• Ensure traceability: Every assessment, decision, and action must be documented for audits and regulatory reviews.
• Integrate into GRC systems: Real transparency only emerges when third-party management is embedded in the company’s overall governance and compliance structures.

Conclusion

Third-party and supply chain risks are no longer niche issues but core elements of enterprise governance. In an environment where organizations are increasingly held accountable for their partners’ actions, transparency is essential.

A well-designed Third-Party Risk Management program, integrated into a comprehensive GRC framework, enables companies to identify risks early, maintain compliance, and strengthen resilience across the entire value chain.

---

FAQ

What are third-party risks?
These are risks that arise from the activities or failures of external partners such as suppliers, IT service providers, or consultants. They can lead to financial losses, operational disruptions, or reputational damage.

Why are supply chain risks relevant for GRC?
Because GRC extends beyond company boundaries. Regulators expect organizations to ensure that their partners follow the same governance, risk, and compliance standards they apply internally.

How can companies assess supply chain risks?
Through structured risk assessments that evaluate sustainability, human rights compliance, data security, financial health, and regulatory conformity of suppliers.

What role does technology play in TPRM?
Digital GRC platforms automate monitoring, reporting, and documentation. They provide real-time transparency and streamline compliance efforts.

Which standards support third-party risk management?
Key standards include ISO 31000 (risk management), ISO 27001 (information security), ISO 37301 (compliance), ISO 9001 (quality), and the ESG reporting frameworks under CSRD and ESRS.

The First Brands Case – What Happened

First Brands, a US supplier of automotive aftermarket parts, filed for Chapter 11 bankruptcy in early 2025. The company had accumulated liabilities in excess of ten billion dollars, much of it hidden in complex structures that were not fully visible to outsiders.

The use of financing methods such as factoring and supply chain finance became particularly problematic, since they often do not appear transparently on balance sheets. As long as liquidity remained stable, the model seemed sustainable. But once lenders demanded more transparency and withheld payments, the liquidity crisis intensified. Within months, the company was insolvent.

Key Takeaways

The US auto supplier First Brands has filed for bankruptcy. The case highlights the dangers that arise when companies rely heavily on debt while using opaque financing models. Off-balance sheet structures, aggressive credit instruments, and weak governance undermined trust among investors and business partners and ultimately led to collapse.

Similar insolvencies in recent years – such as Wirecard, Greensill Capital, or Carillion – demonstrate that these issues are not confined to one sector. The clear lesson for companies in Europe and beyond: Governance, Risk Management, and Compliance (GRC) are essential for building trust and preventing crises.

Parallels to Previous Insolvencies

First Brands is part of a broader pattern. Several high-profile corporate collapses in recent years were driven by excessive debt, opacity, and governance failures.

• Wirecard (Germany, 2020): The largest accounting scandal in postwar Germany, with manipulated balance sheets and weak oversight.
• Greensill Capital (UK, 2021): A supply-chain finance provider that collapsed under opaque credit chains and unsustainable risk exposure.
• Carillion (UK, 2018): A construction and services giant brought down by aggressive accounting and lack of risk controls.

All of these cases share the same DNA: over-leverage, insufficient governance, lack of transparency, and a culture of ignoring risks until it was too late.

Governance – When Oversight Fails

The First Brands bankruptcy shows that governance is only effective when it is actively applied. Boards of directors must have both the competence and the courage to question complex financial structures. If oversight bodies simply rely on management reports without scrutiny, systemic risks remain hidden.

Governance means more than formal oversight. It requires active, critical engagement to ensure that business models rest on solid, sustainable foundations.

Risk Management – An Underestimated Early Warning System

Risk management could have acted as an early warning system in all these cases. Red flags such as high debt ratios, financing instruments off the balance sheet, dependency on a small number of lenders, or a lack of liquidity stress tests should have triggered corrective action.

Organizations applying international standards such as ISO 31000 are better positioned, as this framework provides a systematic approach to identifying, assessing, and monitoring risks. Risk management must be understood as a strategic tool to safeguard long-term viability, not just a compliance exercise.

Compliance – Regulation as a Safeguard

Compliance also plays a crucial role. European regulations such as the CSRD and ESRS standards demand greater transparency in corporate reporting. On a global scale, frameworks like ISO 37301 for compliance management systems provide further guidance.

These requirements are not bureaucratic burdens but safeguards that build trust with investors, regulators, and business partners. Companies that embrace compliance as a protective shield are less exposed to the kind of risks that brought down First Brands.

Lessons for Companies

The central lesson is clear: opaque financing and excessive debt are systemic risks – not only for the companies involved, but also for industries and supply chains. For European and international businesses, this translates into three priorities:

• Strengthen governance structures so that even complex financial models can be critically examined.
• Establish risk management that goes beyond standard scenarios and includes stress tests and worst-case analysis.
• Use compliance requirements as tools to build transparency and prevent crises.

Conclusion

First Brands is yet another reminder that GRC is not an abstract concept or a “nice-to-have” – it is a decisive factor for sustainable corporate success. Companies that take governance, risk management, and compliance seriously protect not only themselves, but also their investors, partners, and customers.

FAQ

Why are insolvencies like First Brands relevant for GRC?
Because they show that lack of transparency, weak controls, and poor risk management can trigger systemic crises.

Can this also happen in Europe?
Yes. Wirecard, Greensill, and Carillion demonstrate that European companies face the same risks.

Which standards help manage risks more effectively?
Key frameworks include ISO 31000 (risk management), ISO 37301 (compliance), ISO 27001 (information security), and the European CSRD and ESRS requirements.

What role does transparency play?
Transparency is the decisive factor in building trust with investors, regulators, and business partners. Without it, risks are discovered too late.

The growing dependence on information technology makes organizations increasingly vulnerable to disruptions, outages, and cyberattacks. A single IT failure can bring entire business processes to a standstill, disrupt supply chains, or permanently damage customer relationships. To address this, the International Organization for Standardization (ISO) released the revised version of ISO/IEC 27031 in May 2025. This standard provides guidance on ensuring ICT Readiness for Business Continuity (IRBC) and links information security with business continuity management.

Key Takeaways

• ISO/IEC 27031:2025 was published in May 2025
• Provides a framework for ICT readiness to support business continuity
• Based on the PDCA cycle (Plan-Do-Check-Act)
• Strong integration with ISO/IEC 27001 (Information Security) and ISO 22301 (Business Continuity Management)
• Focus on cloud services, cyber threats, and modern IT infrastructures

What is ISO/IEC 27031?

ISO/IEC 27031 is an international guideline that describes how organizations can prepare their information and communication technologies to ensure they reliably support business continuity in case of disruptions. The standard defines principles, processes, and measures to help ICT systems remain operational or recover quickly after an incident.

It bridges the gap between classic business continuity management and modern IT security. While ISO 22301 defines the general framework for business continuity, ISO 27031 specifies how ICT systems should be prepared, monitored, and restored.

Key Elements of the Standard

ICT Readiness Framework

The standard introduces a framework that helps organizations systematically prepare their ICT environments for outages and emergencies.

PDCA Cycle

ISO/IEC 27031 is based on the Plan-Do-Check-Act cycle. Organizations plan measures, implement them, monitor their effectiveness, and continuously improve.

Recovery Objectives

A central aspect is defining recovery objectives, such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO). These determine how quickly systems must be restored and how much data loss is acceptable.

Focus on Modern Technologies

The 2025 version places special emphasis on cloud environments, virtualization, and external service providers, reflecting today’s IT infrastructure realities.

Why ISO/IEC 27031 Matters for GRC

The standard is closely tied to governance, risk, and compliance management.

• Governance: Organizations must assign clear responsibilities for ICT readiness and establish leadership to actively manage cyber resilience.
• Risk Management: ICT risks are better integrated into enterprise risk management. Threats such as cyberattacks, system downtime, or supplier failures can be assessed and mitigated more effectively.
• Compliance: ISO/IEC 27031 complements standards like ISO/IEC 27001 and ISO 22301, enabling organizations to build consistent, auditable, and verifiable management systems.

Practical Benefits for Organizations

• Faster, more structured response to IT disruptions
• Improved resilience against cyberattacks and system failures
• Seamless integration with information security and business continuity programs
• Greater transparency and audit-readiness
• Stronger trust among customers, investors, and regulators

Conclusion

ISO/IEC 27031:2025 is an important step toward making organizations more resilient against IT risks. With its clear structure, links to existing management systems, and focus on modern technologies, it provides a practical framework for integrating ICT resilience into GRC strategies. Organizations that adopt the new standard early will not only improve their responsiveness but also strengthen long-term competitiveness.

---

FAQ

What is the difference between ISO 27031 and ISO 22301?
ISO 22301 defines the general framework for business continuity management. ISO 27031 specifies how ICT systems should be prepared and managed within that framework.

Is ISO/IEC 27031 certifiable?
No, the standard serves as guidance. It complements certifiable standards like ISO 27001 and ISO 22301, which can be used for audits and external certification.

Which organizations should apply ISO 27031?
Any organization that relies heavily on IT and digital processes. It is especially relevant for finance, manufacturing, energy, healthcare, and public sector organizations.

What does ICT readiness mean?
ICT readiness refers to the ability of information and communication technologies to support business continuity and remain functional during crises.

What are the main benefits of applying the standard?
Improved resilience, clear response processes in crises, stronger compliance, and enhanced stakeholder trust.

The Summer 2025 edition of the Regulatory Radar makes one thing clear: the regulatory landscape for companies—especially in the financial sector—is becoming increasingly complex. Between cyber risks, AI governance, ESG reporting obligations, and data protection regulations, organizations must not only stay compliant but act proactively.

Governance, Risk & Compliance (GRC) is evolving from reactive compliance tasks to strategic success factors. Organizations that modernize their risk management systems and build digital compliance architectures will gain a clear competitive edge.

1. Regulation 2025: DORA, CSRD, AI Act & Sanctions in Focus

Companies are facing a wave of new national and EU-level regulations. The most critical include:

• DORA (Digital Operational Resilience Act) – strengthens IT resilience and mandates incident reporting
• CSRD & ESRS – binding sustainability reporting standards across the EU
• AI Act – governance of AI use based on risk classification and accountability
• Sanctions and geopolitical risk – increasing demands on business partner screening and third-party risk management

Trending keywords: RegTech, real-time monitoring, control frameworks, business continuity.

2. ESG Compliance: From CSR Reporting to Strategic Management Tool

ESG is no longer a marketing label—it’s a regulatory, financial, and reputational imperative. Companies must:

• Apply double materiality assessments
• Understand SFDR requirements
• Integrate ESG factors into Enterprise Risk Management (ERM)
• Connect ESG data to internal control systems (ICS)

Strategic benefit: ESG becomes a driver of access to capital, brand value, and long-term viability.

3. AI Governance and Cybersecurity: New Risk Classes, New Responsibilities

As organizations adopt artificial intelligence in compliance, lending, and customer service, robust AI governance structures are needed. At the same time, cyberattacks are increasing in scale and complexity.

Priorities for 2025:

• Develop a comprehensive AI compliance framework
• Classify AI use cases according to EU risk categories
• Integrate into ISMS (Information Security Management System)
• Establish a functional incident response plan

Emerging focus: Zero trust architecture, cyber resilience testing, explainable AI, model risk governance.

4. Compliance Goes Strategic – and Measurable

Modern compliance management systems (CMS) are moving beyond policies and training. They deliver real-time risk insights, support automation, and ensure full auditability.

Key elements include:

• Automated legal inventory tools
• Workflow-based policy management systems
• Anonymous whistleblowing platforms
• Integration with GRC platforms and data governance solutions

Vision: Embedded compliance – scalable, measurable, and connected.

5. Recommendations for 2025 and Beyond

✔ Digitalize risk management – shift from static heat maps to real-time risk dashboards
✔ Embed ESG into GRC frameworks – sustainability is a core business imperative
✔ Integrate cyber risks into ERM – prevention, detection, and response as a unified chain
✔ Break down silos – connect legal, compliance, risk, ESG, and IT
✔ Automate reporting – real-time dashboards instead of annual reports

Conclusion

The Regulatory Radar Summer 2025 sends a clear signal: The era of fragmented risk and compliance functions is over.
Organizations that embrace integrated, technology-driven, and strategic GRC approaches are not only staying compliant—but unlocking trust, innovation, and resilience.

FAQ – Regulatory Radar & GRC in 2025

What is the Regulatory Radar?
A regular summary of the most relevant regulatory developments, particularly in finance, ESG, cybersecurity, and AI governance.

Why is 2025 a turning point?
Because new regulations such as DORA, CSRD, and the AI Act are converging, forcing companies to rethink how they manage risk and compliance.

How does this affect compliance teams?
Compliance becomes a cross-functional driver of strategy, requiring automation, real-time monitoring, and governance integration.

What’s the role of risk management?
ERM bridges legal obligations, strategic goals, and operational resilience—and is becoming increasingly data-driven and agile.

What happens if companies fail to adapt?
Regulatory penalties, loss of trust, reduced access to capital, and long-term reputational risks.

How should companies get started?
Begin with a GRC maturity assessment, integrate regulatory updates into ERM, and invest in smart compliance technology.

For years, traditional risk management and operational resilience were treated as separate disciplines. While risk management focuses on identifying and assessing threats at a strategic level, resilience ensures business continuity in the face of disruptions.

But this separation is becoming a liability. In a world of overlapping crises—volatile supply chains, rising cyberattacks, geopolitical instability—isolated thinking is no longer effective.

The key lies in integration: risk management and resilience must be planned and implemented together.

1. Risk Management vs. Resilience – and Why the Distinction No Longer Matters

Risk management involves the systematic identification, assessment, and monitoring of potential threats. It answers:

• What could happen?
• How likely is it?
• What would the impact be?

Resilience, by contrast, is about ensuring the organization remains operational during disruptions—through contingency plans, redundancies, and fast response mechanisms.

In theory, both disciplines complement each other. In practice, however, they often operate in isolation:

• Different tools and systems
• Separate teams with distinct goals
• No unified risk evaluation or scenario planning

The result: Risks are recognized but not operationally addressed—or vice versa.

2. Why Integration Is Essential

a) Strategic risks must translate into operational readiness

Identifying a cyberattack as a top risk is not enough without concrete action: tested backup systems, trained response teams, and clear communication protocols.

b) Crises are multifaceted and don’t respect boundaries

A power outage affects IT, customer relations, legal obligations, and supply chain operations. Without coordination, responses are fragmented and ineffective.

c) Speed is the new currency of resilience

Modern threats escalate in real time. Only integrated structures—combining strategic foresight with operational agility—allow fast, aligned responses.

3. How to Connect Risk Management and Resilience

1. Establish a common language

Agree on shared terminology for “risk,” “impact,” “criticality,” and “scenario” across departments.

2. Use a unified platform

Consolidate risk and continuity data into one system to ensure transparency and eliminate duplication.

3. Conduct joint simulations

Risk managers and crisis teams should regularly run combined scenario exercises.

4. Rethink governance structures

Rather than reporting separately, create integrated dashboards for the board and executive management.

5. Promote a culture of collaboration

Operational departments must recognize that resilience is not an add-on—it is a leadership priority.

4. From Static Risk Reports to Dynamic Resilience

Traditional risk management is often backward-looking: annual reports, heat maps, risk categories.

Modern resilience, however, requires:

• Real-time data (e.g. supply chain alerts, IT status, social media)
• Forward-looking indicators
• Organizational agility, communication, and adaptability

What’s needed is not separation—but a shared ecosystem where risk insights lead directly to readiness and action.

5. What Organizations Should Do Now

Action	Impact
Align risk and resilience strategies	Derive priorities systematically
Build cross-functional teams	Break down silos, leverage expertise
Implement integrated reporting	Provide clarity to leadership and regulators
Institutionalize scenario planning	Strengthen anticipation and decision-making
Foster shared ownership culture	Make resilience a strategic responsibility

Conclusion

In a volatile and complex world, isolated silos are no longer sustainable. Organizations that integrate risk management with operational resilience gain faster reaction times, better decision-making, and stronger long-term stability.

The future belongs to those who not only understand risk—but know how to respond with clarity and confidence.

---

FAQ – Risk Management and Resilience

What’s the difference between risk management and resilience?
Risk management identifies and evaluates potential threats. Resilience ensures the organization can operate during and after those threats.

Why are these functions often separated?
Historical growth, distinct responsibilities, and different reporting structures have led to functional silos—despite their shared goals.

What are the benefits of integration?

• Faster crisis response
• Shared understanding of risk scenarios
• More efficient use of resources
• Better decisions under pressure

How can companies get started?
Launch a joint workshop between risk and crisis teams, define shared terms, and begin working with combined scenarios and reporting structures.

Is this relevant for small and mid-sized companies too?
Absolutely. Any business facing operational complexity or regulatory scrutiny can benefit from integrated risk-resilience thinking.

What tools support this approach?
Modern GRC (Governance, Risk, Compliance) and Integrated Risk Management (IRM) platforms that unify risk analysis, continuity planning, incident management, and communication.