Generative AI has moved from experimentation to everyday business use in many companies. Chatbots answer customer questions, copilots support employees, internal knowledge assistants search documents, marketing teams create content with AI, and specialist departments use language models for analysis, summaries and decision drafts. What sounded futuristic only a few years ago has become operational reality.

However, this development also increases a risk that has long been underestimated: AI hallucinations. These are responses that appear convincing, professional and linguistically correct, but are factually wrong, incomplete or misleading. This combination is what makes hallucinations so dangerous. The output looks trustworthy, even though it may not be reliable.

The current regulatory pressure from Italy shows that authorities are taking this risk increasingly seriously. AI providers are expected to inform users more clearly that generated content can contain errors and must be verified. At first glance, this may seem like a consumer protection issue. In reality, it is much more than that: it is a clear signal for Governance, Risk and Compliance. Companies must be able to demonstrate that they do not merely know about AI risks, but actively manage them.

For GRC, this means that AI hallucinations are no longer just a matter for the IT department or technical product discussions. They affect corporate governance, risk management, compliance, data protection, information security, internal controls, third-party risk management, internal audit and reputation management. Any company using or offering generative AI needs a robust control framework.

Key Takeaways

• AI hallucinations are false or misleading AI-generated responses that can appear convincing and professionally accurate.
• Regulatory pressure is increasing because authorities expect more transparency, clearer warnings and stronger safeguards.
• For GRC, new requirements are emerging around governance, risk assessment, compliance, internal controls, documentation and auditability.
• Companies need a central AI inventory to understand which AI systems are being used, where, by whom and with what data.
• Disclaimers alone are not enough. Clear processes, human review, training, monitoring and technical safeguards are required.
• AI applications are particularly critical in customer service, legal, compliance, HR, finance, healthcare, insurance, banking and regulated industries.
• Third-party risk management becomes more important because many companies rely on external AI providers.
• The EU AI Act, AI literacy, data protection, information security and sector-specific requirements must be considered together.
• Internal audit and GRC teams should treat AI hallucinations as a standalone risk scenario.
• Companies that manage AI responsibly build trust, reduce liability risks and strengthen regulatory resilience.

What Are AI Hallucinations?

AI hallucinations occur when a generative AI system produces content that is not reliably based on facts. The system formulates an answer that sounds plausible, but is partly or entirely incorrect. The issue is especially problematic because language models often appear very confident. They do not always qualify their responses, but often present incorrect information in a tone that suggests competence and certainty.

For example, a chatbot may refer to a legal provision that does not exist, cite a fabricated court decision, explain a contract deadline incorrectly or promise a product feature that is not actually available. In an internal corporate context, AI may incorrectly summarise figures from documents, misinterpret policies or assess risks inaccurately in a report.

For users, this is difficult to detect. People tend to perceive well-written answers as more credible. This is exactly where the GRC problem begins. The quality of the language can hide the uncertainty of the information.

AI hallucinations are therefore not just a technical problem. They are a trust problem. They influence decisions, processes and expectations. If companies adopt AI outputs without review, risks arise for customers, employees, business partners and the organisation itself.

Why Italy’s Action Sends an Important Signal

The action taken by the Italian competition and consumer protection authority against several AI providers shows that the regulatory perspective is changing. The key question is no longer only whether an AI system is innovative, powerful or commercially attractive. Increasingly, the decisive question is: are users sufficiently informed about the system’s limitations?

This shift is significant for companies. Authorities are no longer treating hallucinations merely as an unavoidable side effect of modern AI. They are interested in whether providers and operators communicate this risk clearly, whether warnings are visible and whether users are adequately informed before making important decisions.

For GRC, the message is clear. Transparency becomes a control. A notice hidden in general terms and conditions is not enough if users do not understand during the actual AI interaction that the content may be wrong. What matters is whether the warning appears where the risk arises: in the chat window, in the application, before registration, before a purchase or before the use of an AI-generated result.

This is an important distinction. Traditional compliance often relies on policies, contract clauses and documentation. With generative AI, compliance must be embedded more strongly into product design, user journeys and operational processes. The user interface itself becomes part of the control framework.

Why AI Hallucinations Are a GRC Risk

Governance, Risk and Compliance deals with how companies are responsibly managed, how risks are controlled and how legal as well as internal requirements are met. AI hallucinations affect all three areas at the same time.

From a governance perspective, the question is who is responsible for AI systems. Many companies use AI in a decentralised way. Business units test tools, employees use public chatbots, SaaS providers integrate AI functions and IT departments deploy copilots. Without clear responsibilities, a control vacuum emerges.

From a risk perspective, the question is what damage false AI outputs can cause. An inaccurate internal draft may be relatively harmless. A false statement to customers, a misleading financial analysis or a fabricated compliance requirement can have serious consequences.

From a compliance perspective, the question is whether companies are meeting their duty of care. Anyone using AI in regulated areas must be able to explain which risks were assessed, which controls are in place and how problematic developments are identified.

For this reason, hallucinations must not be treated as isolated errors. They are a systemic risk because they can occur in many places at once: customer communication, advisory services, documentation, decision support, reporting, contract review, HR processes and internal analysis.

The New Expectation: Companies Must Make AI Risks Visible

One central problem in many organisations is the lack of transparency around their own AI usage. In practice, there is often more AI in use than is officially known. Employees use freely available tools, departments test software with integrated AI functions, external service providers use generative AI and existing platforms gradually activate new AI capabilities.

For GRC, this lack of transparency is dangerous. What is not known cannot be assessed. What has not been assessed cannot be controlled. And what is not controlled cannot be convincingly defended if something goes wrong.

The first step towards effective AI governance is therefore an AI inventory. Companies must record which AI systems are in use, who owns them, what data is processed, which providers are involved, which users are affected and which decisions or processes are influenced.

This inventory should not be understood as a one-off spreadsheet. It must become part of an ongoing governance process. New AI applications should be reviewed before implementation. Existing applications should be updated regularly. Changes to models, data sources, prompts, interfaces or providers should trigger a new risk assessment.

Third-Party Risk Management: Assessing AI Providers Properly

Many companies do not develop their own AI models, but use external solutions. This may be a major cloud provider, a specialised AI service, a SaaS tool with integrated AI or a platform that combines multiple models. As a result, part of the risk shifts into the supply chain.

Third-party risk management must therefore be expanded. Traditional supplier questions around data protection, information security and availability remain important, but they are no longer sufficient. Companies must also understand how the provider handles hallucinations, model updates, training data, user prompts, output safety and transparency.

Role clarity is also important. Is the provider itself the model provider, only the operator of an application, an integrator, a data processor or an interface provider? Does it use additional sub-providers? Are inputs stored? Is customer data used for training? Where does processing take place? What control and audit options exist?

GRC should not only review the contract when assessing AI providers, but also the operational control environment. This includes technical documentation, security evidence, data protection information, model change processes, incident procedures and clear obligations to notify customers of material changes.

Data Protection and Information Security: Hallucinations Are Not the Only Risk

Although hallucinations are the main focus, companies must not ignore other AI risks. Generative AI can process personal data, disclose confidential information, transfer sensitive data to external systems or be influenced by manipulated inputs.

Data protection and information security must therefore be closely connected to AI governance. Companies should define which types of data may be entered into which AI systems. Personal data, trade secrets, customer data, health data, financial data, legal information and security-relevant information are particularly sensitive.

Prompt injection is also relevant. This refers to attempts by attackers, or unintended inputs, to manipulate the behaviour of an AI system. If an AI system has access to internal documents, emails, databases or actions, this can create a serious security risk.

GRC must therefore not view AI merely as a communication tool. The more AI systems are integrated into processes, data sources and automated actions, the more important access controls, role models, logging and security reviews become.

AI Agents Increase the Pressure on GRC

The next stage of development is AI agents. While traditional chatbots mainly provide answers, agents can perform tasks. They can retrieve information, operate systems, prepare emails, process tickets, trigger orders or initiate workflows.

This significantly increases risk. A hallucinated answer is problematic. A hallucinated action can be even more problematic. If an AI agent changes data, contacts customers or triggers internal processes based on false assumptions, new control requirements emerge.

Companies should therefore be especially cautious when AI is allowed not only to generate text, but also to execute actions. The higher the degree of automation, the more strongly permissions must be limited, approvals embedded and actions logged.

A good GRC principle is: AI should only have the rights it truly needs for a clearly defined purpose. Critical actions should not be fully automated, but should require human confirmation.

How Companies Can Integrate AI Hallucinations into Risk Management

Professional risk management does not treat hallucinations as a vague concern, but as a concrete risk scenario. This scenario should be described, assessed, controlled and monitored.

The assessment should consider who uses the AI, which decisions are influenced, what data is used, how easily users can detect errors and what damage is possible. An internal brainstorming tool is less critical than a customer chatbot for insurance coverage. An AI system that generates marketing ideas has a different risk profile than a system interpreting regulatory requirements.

Companies should classify their AI use cases by risk level. Low-risk applications can operate with lighter controls. Applications with customer impact, legal relevance, personal data or proximity to decision-making require stricter requirements.

It is important that the risk classification does not remain static. A use case can become more critical over time if it reaches more users, receives new data sources or becomes integrated into additional processes.

What a Strong Control Model Should Include

A robust control model for generative AI connects governance, technology, processes and people. It starts with clear rules, but goes much further.

Companies should first define which AI usage is permitted and which is not. They then need to specify how new AI applications are requested, assessed and approved. Critical use cases require additional requirements for testing, user notices, data sources, human review and monitoring.

Technical design also plays a role. Systems should rely on verified knowledge sources where possible, make uncertainty visible and hand over to humans for critical questions. If AI cannot provide a reliable answer, an honest non-answer is better than a convincing hallucination.

In addition, companies need incident management for AI errors. If a false AI output leads to damage, a complaint or regulatory risk, it should be clear who is informed, how the incident is assessed and which corrective measures follow.

Impact on Regulated Industries

Regulated industries are particularly affected. Banks, insurers, healthcare providers, energy companies, telecommunications firms, public authorities and other supervised organisations must manage AI risks especially carefully.

In banking and insurance, false AI outputs can lead to poor advice, incorrect risk assessments or inaccurate information about products and claims. In healthcare, incorrect answers can have especially sensitive consequences. In the public sector, false AI communication can damage trust in administration and public institutions.

Regulated companies should therefore not wait until every specific question has been clarified by supervisory authorities. The direction is clear: transparency, risk management, human control, documentation and evidence are expected.

Common Mistakes Companies Should Avoid

A common mistake is addressing AI risks too late. Many organisations only start building governance once AI is already widely used. By then, tools, processes and habits are often established, making later corrections more difficult.

Another mistake is relying too heavily on provider promises. Even large and well-known providers do not relieve a company of its own responsibility. Anyone integrating AI into their own processes or using it with customers must assess whether the deployment is appropriately controlled.

It is also problematic to believe that good prompts solve the hallucination problem. Better prompts can help, but they do not replace governance. A one-time training session is also insufficient if employees do not have clear rules and escalation paths afterwards.

Perhaps the biggest mistake is a lack of evidence. If something goes wrong, it is not enough to say that AI is used responsibly. Companies must be able to prove which risks were assessed, which controls were implemented and which decisions were made.

Conclusion: AI Hallucinations Are a Test Case for Modern GRC

AI hallucinations show how much the risk profile of modern companies is changing. This is no longer only about traditional IT security, data protection or regulatory documentation. It is about how organisations deal with systems that generate convincing content, but are not automatically reliable.

Regulatory pressure makes this clear: companies must inform users clearly, control AI outputs and manage risks in a demonstrable way. For GRC, this is not a side issue, but a central topic for the future.

Companies that want to use generative AI successfully need more than enthusiasm for efficiency and innovation. They need governance, clear responsibilities, robust controls, trained employees, assessed providers and ongoing monitoring. Only then can they prevent AI from turning from a productivity gain into a compliance and reputational risk.

The good news is that companies do not need to eliminate hallucinations completely in order to use AI responsibly. But they must be able to show that they understand the risk, limit it, make it transparent and control it. That is the new task for GRC.

FAQ

What are AI hallucinations?

AI hallucinations are false, fabricated or misleading outputs generated by an AI system. They often appear convincing even though they are factually incorrect.

Why are AI hallucinations important for GRC?

They can cause poor decisions, incorrect customer information, compliance breaches, liability risks and reputational damage. For this reason, they must be addressed in governance, risk management and compliance.

Is a warning about possible errors enough?

No. A warning is important, but not sufficient. Companies also need risk assessments, human review, technical controls, training, monitoring and clear responsibilities.

Which departments should be involved?

Executive management, compliance, legal, risk management, data protection, information security, IT, business departments, procurement, third-party risk management and internal audit should all be involved.

What is the first step towards better AI governance?

The first step is a complete AI inventory. Companies must know which AI systems are being used, who is responsible, what data is processed and what risks exist.

Which areas are particularly critical?

Customer service, legal, compliance, HR, finance, healthcare, insurance, banking and all processes where AI outputs influence decisions or are used with customers are particularly critical.

How can companies reduce hallucinations?

Helpful measures include verified knowledge sources, clear system boundaries, better prompts, human review, regular testing, monitoring, feedback functions and technical safeguards. However, hallucinations cannot be completely eliminated.

What should internal audit review?

Internal audit should assess whether there is an AI inventory, risk assessments, clear responsibilities, user notices, approval processes, provider reviews, training, logging and incident management for AI errors.

What role does third-party risk management play?

Third-party risk management must assess AI providers, model providers, SaaS solutions and sub-providers. Important questions include data processing, model updates, hallucination controls, security, data protection and auditability.

Why will this topic become more important?

Generative AI is increasingly being integrated into business processes. At the same time, regulatory expectations around transparency, control and evidence are rising. Companies that build AI governance now reduce risk and create trust.

For years, Governance, Risk, and Compliance (GRC) was seen as a necessary burden – a box-ticking exercise to satisfy regulators and auditors. But that perception is changing fast. New studies from 2025 show that technology is transforming GRC from a reactive compliance function into a strategic driver of business performance.

Companies that have digitized their GRC processes report greater transparency, faster audits, and significantly improved risk control. Automation, data integration, and artificial intelligence are helping organizations manage complexity, build trust, and stay compliant — all while saving time and resources.

Key Takeaways

• According to “The State of GRC 2025” report, 96 percent of executives now view GRC as a strategic business enabler.
• McKinsey’s research shows that digital GRC systems can reduce audit preparation time by up to 40 percent.
• Automated risk assessment and real-time monitoring dramatically reduce human error.
• Companies with integrated GRC technology respond faster to crises and regulatory changes.

The Evolution of GRC: From Control Function to Strategic Platform

The past decade has seen a profound transformation in how organizations approach GRC. Spreadsheets, manual checklists, and reactive processes are being replaced by integrated digital platforms that connect data, people, and decisions.

McKinsey’s 2025 report “Governance, Risk, and Compliance: A New Lens on Best Practices” highlights that while many companies have strong governance frameworks, they still struggle with “limited tech enablement.” In contrast, organizations that have digitized their GRC processes see clear benefits — higher efficiency, improved visibility, and stronger accountability.

Similarly, “The State of GRC 2025 – From Cost Center to Strategic Business Driver” finds that nearly all surveyed companies (96 percent) now treat GRC as a core part of their business strategy. Technology integration, AI-driven analytics, and automated reporting are turning GRC into the nervous system of modern corporate governance.

How Technology Strengthens GRC

Technology reshapes GRC on multiple levels — structurally, culturally, and operationally.

1. Automation of Repetitive Tasks
   Routine tasks such as risk documentation, policy tracking, and control testing can now be automated. According to the study “GRC Automation in Manufacturing”, companies using automation reduced compliance-related workloads by up to 70 percent.
2. Centralized Data Integration
   Modern GRC platforms consolidate data from ERP, HR, cybersecurity, and audit systems, creating a single source of truth. This integrated view allows leaders to identify interdependencies and manage risks proactively rather than reactively.
3. Real-Time Monitoring and Early Warning Systems
   Real-time analytics enable organizations to detect and respond to risks faster. Automated alerts and risk scoring tools transform GRC from an after-the-fact reporting function into a dynamic early warning system.
4. Collaboration Through Digital Workflows
   Cloud-based GRC solutions promote collaboration across departments. Tasks, reviews, and approvals flow through unified digital workflows, increasing transparency and accountability.
5. Artificial Intelligence and Predictive Analytics
   AI-powered platforms can detect anomalies, analyze emerging threats, and forecast potential compliance breaches. Predictive insights help organizations shift from reactive compliance to proactive prevention.

Measurable Impact: What the Studies Show

The business impact of GRC technology is now quantifiable — and the numbers are compelling.

• McKinsey reports that digitized GRC processes reduce audit preparation times by up to 40 percent.
• The “GRC Automation in Manufacturing” study found that automation can save up to 70 percent of compliance reporting time.
• Financier Worldwide notes that GRC platforms deliver major efficiency gains in third-party and supply chain risk management.
• The Wolfpack Risk “State of GRC 2025” report found that companies with integrated GRC systems respond twice as fast to critical incidents as those relying on manual processes.

In short: GRC is no longer an administrative function — it has become a data-driven management discipline.

Technology as the Enabler of a New GRC Culture

While technology provides the tools, success depends on people and culture. True transformation happens when organizations integrate technology into their governance structures, leadership practices, and decision-making processes.

Companies that view GRC as a shared responsibility — not just a compliance task — achieve not only better control but also greater agility. Digital platforms create visibility, but leadership and culture turn that visibility into trust and accountability.

In 2025, GRC technology is more than an efficiency booster — it’s the backbone of organizational resilience.

Conclusion

In 2025, GRC is no longer a burden; it’s a competitive advantage. Technology enables organizations to connect governance, risk, and compliance in a single digital ecosystem — reducing complexity, accelerating decisions, and building long-term trust.

Those who invest in digital GRC today are not just staying compliant — they are shaping a smarter, safer, and more transparent future. The shift is clear: from obligation to opportunity.

---

FAQ

What does GRC technology mean in practice?
It refers to digital systems that centralize, automate, and monitor governance, risk, and compliance processes — such as integrated GRC platforms, AI-driven analytics, and automated audit tools.

What are the main benefits of GRC platforms?
They reduce manual effort, increase transparency, identify risks in real time, and simplify regulatory reporting.

Which studies confirm these effects?
Key sources include McKinsey (2025), Wolfpack Risk (2025), Financier Worldwide (2025), and GRC Automation in Manufacturing (2025).

Is technology alone enough for effective GRC?
No. Technology must be combined with clear governance structures, defined responsibilities, and a risk-aware culture.

Which industries benefit the most from digital GRC?
Financial services, manufacturing, logistics, healthcare, and other highly regulated sectors benefit most from integrated, technology-enabled GRC systems.

In August 2025, an unexpected disruption to PayPal’s systems caused a significant impact on payment processing in Germany. A malfunction in PayPal’s fraud detection logic resulted in German banks blocking SEPA direct debits worth more than €10 billion. Many customers and merchants were affected, experiencing delayed payments, declined withdrawals, and negative balances. PayPal attributed the issue to a technical error triggered by a system update and has promised automatic refunds as well as close cooperation with affected financial institutions to fully resolve the situation.

Key Takeaways

• System update caused PayPal’s fraud detection to fail on August 23/24, 2025
• German banks blocked direct debits totaling over €10 billion
• Customers faced rejected payments, negative balances, and blocked transactions
• PayPal fixed the error, issued refunds, and warned of phishing attempts following the disruption
• The incident highlights the tight connection between technology, governance, and payment risk – and showcases critical GRC improvement areas

What Happened?

On the weekend of August 23/24, 2025, a scheduled system update disabled PayPal’s automated fraud detection. As a result, direct debit transactions were sent to banks without proper verification, prompting institutions to block them as a security measure. This led to a widespread payment freeze: online merchants couldn’t process transactions, and users faced failed payments or unexpected charges. While there is no confirmed hacker involvement, reports surfaced of PayPal credentials being sold on the dark web – suspected to stem from malware on customer devices rather than a breach of PayPal’s core systems.

Root Causes

Governance Gaps

The change appears to have been implemented without adequate risk assessment, simulation, or executive oversight. Emergency protocols for rollback or escalation were missing or not activated.

Risk Blind Spots

Deploying a system update without robust live simulations or rollback options is high risk. Automated fail-safes and emergency escalation plans were either ineffective or not in place.

Compliance and Testing Shortfalls

PayPal had fraud prevention policies in place, but the technical resilience of these measures proved insufficient. Regular audits, payment flow testing, and anomaly detection systems appear to have been lacking.

How It Could Have Been Prevented

• Controlled Testing Environments: All updates should be fully tested in isolated environments with clear rollback options before deployment.
• Emergency Governance: Strong change management with predefined escalation chains and real-time alerts for deviations.
• Advanced Monitoring: Health checks, automated rollback triggers, and anomaly detection systems running 24/7.
• Stakeholder Communication: Real-time status updates for banks, merchants, and customers to reduce confusion during outages.
• Integrated GRC Audits: Regular simulations and comprehensive GRC audits to assess system readiness and response capabilities.

Conclusion

The August 2025 PayPal outage is a powerful reminder that system updates in payment infrastructures carry systemic risk. It underscores the need for tightly integrated governance, risk management, and compliance processes to ensure continuity. Organizations should treat this disruption as a wake-up call to review their GRC strategies, conduct scenario testing, and establish robust contingency plans.

FAQ

1. Why did German banks block payments?
Due to a system error, PayPal sent unverified debit requests. Banks acted preventively to avoid potential fraud.

2. Was it a hacker attack?
No. PayPal confirmed the issue was internal and not caused by external intrusion.

3. How many users were affected?
PayPal reported that fewer than five percent of German customers were directly impacted, but the scale of payment disruptions was significant.

4. How did PayPal respond?
PayPal fixed the issue, issued refunds, and is working with banks to clear the backlog. The company also warned users about phishing attempts in the aftermath of the outage.

5. What should other companies learn from this?
Major infrastructure changes should be guided by strict change management, GRC-driven risk assessments, constant monitoring, and robust backup strategies – especially in critical sectors like payments.

Intro

Wolfspeed, once celebrated as a pioneer in silicon carbide (SiC) semiconductor technology, is preparing for a Chapter 11 bankruptcy. The company had aggressively expanded its production capacity in anticipation of surging demand from the electric vehicle (EV) sector. However, growth expectations fell short, and the business model collapsed under mounting pressure from market forces and internal strategic missteps.

This article examines the underlying causes of Wolfspeed’s crisis, explores how the absence of robust Governance, Risk, and Compliance (GRC) structures contributed to the situation, and outlines what organizations can learn from this high-profile failure.

1. Wolfspeed’s Trajectory: Ambition Meets Vulnerability

Wolfspeed emerged from Cree Inc. and quickly rose to global prominence as a leading supplier of silicon carbide power semiconductors. With EV adoption growing and governments subsidizing electrification, Wolfspeed positioned itself as a critical player in this evolving landscape.

The company embarked on a capital-intensive expansion, including a $5 billion fab in North Carolina and a wafer facility in Germany. This growth was financed almost entirely through debt, with more than $6 billion in liabilities accumulated by 2025.

2. Key Drivers of the Financial Collapse

a) Overestimation of Market Demand

Wolfspeed built its growth model on the assumption of sustained EV adoption. Yet, by late 2024, automakers in North America and Europe began scaling back their production forecasts, citing stagnating EV sales. Wolfspeed’s order volumes declined, and in early 2025, the company publicly acknowledged “substantial doubt” about its ability to continue as a going concern.

b) Excessive Leverage and Capital Commitments

Wolfspeed’s debt-financed expansion left it highly vulnerable to rising interest rates and market volatility. With $6.5 billion in debt and only $1.3 billion in cash reserves, the company faced significant liquidity constraints.

c) Intensifying Competition – Especially from China

Chinese competitors such as SICC Co., TanKeBlue, and San’an Optoelectronics significantly expanded their SiC wafer production capacity with strong state support. By 2025, the price of SiC wafers had dropped by up to 30%, driven by Chinese firms’ low-cost strategies. Wolfspeed, operating in high-cost regions, was unable to match these prices and began losing market share.

d) Delays in Government Subsidies

Wolfspeed had banked on U.S. CHIPS and Science Act subsidies, expecting up to $750 million in public funding. However, bureaucratic delays and regulatory hurdles meant that funds were slow to materialize, exacerbating the company’s funding gap.

e) Strategic Management Failures

Wolfspeed remained committed to its expansion strategy despite multiple warning signs—declining customer demand, deteriorating free cash flow, and growing competition. There was little evidence of active scenario planning or risk-based adjustment of the company’s investment pipeline.

3. GRC Failures That Amplified the Crisis

Although market conditions clearly played a role, Wolfspeed’s internal systems failed to identify, assess, and respond to emerging risks effectively. The absence of a mature GRC framework left the company structurally exposed.

Governance

• No evidence of strategic scenario planning to evaluate alternative market trajectories.
• Weak board oversight over leverage, capital allocation, and risk exposure.
• Delayed response to operational signals such as revenue declines and customer attrition.

Risk Management

• No clearly defined debt ceilings or investment triggers tied to demand indicators.
• Lack of stress testing to assess interest rate sensitivity or price erosion scenarios.
• Insufficient market intelligence on global competitors and supply chain risks.

Compliance

• Delays in fulfilling conditions for government subsidy disbursements.
• Reactive investor communication, which eroded stakeholder trust.
• No integrated approach to ESG-related risks in global operations.

4. How Strong GRC Could Have Made a Difference

A well-implemented GRC framework would not have guaranteed success—but it would have provided critical foresight, agility, and resilience to manage through adversity.

GRC Component	Preventive Measure	Potential Impact
Governance	Early warning systems and scenario-based reviews	Strategic course correction before financial instability
Risk	Stress testing, debt control, risk-adjusted investment policy	Improved capital discipline and market responsiveness
Compliance	Active subsidy tracking, stakeholder communications	Preservation of creditworthiness and investor confidence
Reporting	Monthly KPI dashboards on operational and financial risk	Transparency for executives and creditors alike

5. Conclusion and Strategic Lessons

Wolfspeed’s crisis is a cautionary tale for high-growth industrial firms. Even with advanced technology and a favorable policy environment, overconfidence and poor risk oversight can derail long-term success.

As Wolfspeed enters Chapter 11, it will attempt to restructure and emerge as a leaner, more stable entity. But the damage—particularly for shareholders and suppliers—is already significant.

The lesson is clear: GRC is not merely a compliance obligation. It is a critical management function that enables informed decisions, protects against overreach, and builds resilience in a volatile global economy.

FAQ – Wolfspeed’s Insolvency and the Role of GRC

What does Wolfspeed do?
Wolfspeed manufactures silicon carbide (SiC) power semiconductors used in electric vehicles, energy infrastructure, and industrial systems.

Why is Wolfspeed in financial trouble?
The company overinvested based on overestimated EV demand, while accumulating excessive debt. At the same time, Chinese competitors eroded market prices, and public subsidies were delayed.

What is Chapter 11?
Chapter 11 is a U.S. bankruptcy process that allows companies to reorganize under court protection without ceasing operations.

How did Chinese competitors impact Wolfspeed?
Chinese producers flooded the market with subsidized SiC wafers, causing prices to fall sharply. Wolfspeed could not compete on cost and lost market share.

Could a strong GRC system have prevented this?
While not a panacea, a robust GRC system would likely have flagged critical risks earlier, supported better decision-making, and protected key stakeholder relationships.

What should other companies take away from this?

• Link capital investments to validated demand indicators.
• Run regular stress tests on liquidity, interest exposure, and market share erosion.
• Use GRC tools not just for compliance, but as an integrated part of strategic planning.

The New EU Deforestation Regulation (EUDR): A Wake-Up Call for Companies

The new EU Deforestation Regulation (EUDR) comes into effect on December 30, 2025, and presents massive challenges for companies operating in the EU. Its aim is to combat global deforestation by allowing the trade of products such as coffee, cocoa, beef, palm oil, soy, rubber, and wood only if they do not originate from deforested areas or contribute to forest degradation.

Why EUDR Compliance Is Now a C-Level Priority

Companies will be required to carefully document the origins of their raw materials. As a result, supply chain transparency becomes central to any sustainable business strategy. However, many organizations are still unprepared:

According to the report “Data-Enabled Supply Chain Transparency”,
77% of companies consider transparency very important,
but only 31% are satisfied with their current level of supply chain visibility.

This gap presents a significant compliance risk and can also undermine customer and stakeholder trust.

The Key Data Challenges for EUDR Compliance

1. Limited Visibility Beyond Tier 1
   Most companies have visibility only into their direct suppliers.
   Only 7% of surveyed organizations know the suppliers of their suppliers (Tier 2 or beyond).
2. Poor Data Quality and Availability
   Over 80% of procurement professionals cite poor data quality and limited accessibility as major barriers to transparency and compliance.
3. Slow Digital Transformation
   Approximately 51% of procurement and supplier management processes remain non-digital.
   This results in inefficient workflows, lack of traceability, and a high risk of poor decision-making.

How to Prepare for EUDR Compliance

1. Accelerate Digital Transformation
   Leverage modern tools for supplier management, risk assessment, and documentation.
   Digital workflows save time and improve traceability.
2. Strengthen Supplier Collaboration
   Build trust-based relationships and involve suppliers in your sustainability strategy.
   Clear requirements and standardized self-assessments help collect data efficiently.
3. Improve Data Quality
   Invest in structured data platforms, automated validations, and AI-based analytics tools.
   This improves decision-making and reduces the risk of non-compliance.
4. Rely on Technology Partners
   Specialized software solutions offer modules tailored to ESG- and EUDR-compliant supply chain management.
   These tools support risk monitoring and the creation of legally required due diligence statements.

Conclusion: Act Now to Secure Compliance

The EUDR is more than just a regulatory requirement – it’s a wake-up call for sustainable supply chains.
Companies that invest early in digital transparency, data quality, and supplier engagement will not only avoid penalties, but also strengthen their brand and gain a competitive edge.

Now is the perfect time to make your supply chain EUDR-ready.

---

Frequently Asked Questions about the EUDR

What is the EUDR?
The European Union Deforestation Regulation (EUDR) is an EU law designed to ensure that certain raw materials and their derivatives do not contribute to deforestation. It applies from December 30, 2025.

Which products are affected?
Products such as beef, coffee, cocoa, palm oil, soy, wood, and rubber, including goods made from them.

Which companies are obligated?
All companies that import, trade, or process these products within the EU must comply with EUDR requirements.

What does a “sustainable supply chain” mean in this context?
A sustainable supply chain is traceable, risk-assessed, deforestation-free, and meets ethical and environmental standards.
Transparency and data quality are critical success factors.

How can I prepare?
Start by analyzing your supply chain, digitizing processes, investing in appropriate tools, and building trust-based relationships with your suppliers.

What penalties apply for non-compliance?
Violations of the EUDR can lead to substantial fines, import bans, and reputational damage.

The acquisition of Monsanto by Bayer in 2018 was a landmark deal in the global agribusiness industry. Bayer, a leading player in pharmaceuticals and agricultural chemicals, paid approximately $63 billion to acquire Monsanto – a company known primarily for its herbicides, particularly the product Roundup. However, what started as a strategic move to expand its portfolio quickly turned into a nightmare filled with legal and financial challenges. The controversial connection between Bayer and Monsanto has led to a series of lawsuits, putting the company under significant financial strain and causing reputational damage.

In this blog post, we will break down Bayer’s acquisition of Monsanto, the challenges surrounding Glyphosate, and the consequences faced by the company. Additionally, we will explore how better Governance, Risk, and Compliance (GRC) systems might have helped Bayer avoid or mitigate the crisis.

1. The Acquisition of Monsanto: A Strategic Move or a Risky Play?

When Bayer announced the acquisition of Monsanto in 2018, the company was seeking to strengthen its position in the agribusiness sector. Monsanto, an American multinational, was a global leader in genetically modified seeds and crop protection chemicals, especially the herbicide Glyphosate. Glyphosate was the key ingredient in Roundup, which had become an essential product for agriculture and industry worldwide.

Bayer saw the acquisition as an opportunity to establish leadership in the global agribusiness market and take advantage of synergies between Bayer’s existing products and Monsanto’s innovations in seed development and crop protection.

Strategic Objectives:

• Market Leadership in Agribusiness: The acquisition was intended to position Bayer as a dominant player in the global agribusiness market.
• Product Portfolio Synergies: Bayer aimed to combine its products with Monsanto’s to develop a more comprehensive offering in plant protection and biotechnology.

However, the purchase of Monsanto was not without risks – and one major risk was already well-known: Glyphosate.

2. Glyphosate and the Lawsuits: A Ticking Time Bomb

Glyphosate, the active ingredient in Roundup, had been one of the most widely used herbicides since its introduction in the 1970s. However, in recent years, Glyphosate has come under increased scrutiny. In 2015, the International Agency for Research on Cancer (IARC), a branch of the World Health Organization (WHO), classified Glyphosate as “probably carcinogenic.”

Starting in 2016, lawsuits began to pile up in the United States, with plaintiffs claiming that Glyphosate had caused cancer. This led to a wave of litigation, with more plaintiffs joining the legal battle over time. Despite Monsanto’s repeated defense of Glyphosate’s safety, concerns over its potential cancer-causing effects fueled the lawsuits.

Bayer, despite being aware of the risks, went ahead with the acquisition of Monsanto – perhaps under the assumption that the legal challenges would not be as severe. However, the actual impact was far greater.

3. The Impact on Bayer: Financial and Reputational Damage

Financial Strain: The legal battles surrounding Glyphosate have placed Bayer under significant financial strain. In 2020, the company announced that it would allocate more than $11 billion to settle Glyphosate-related lawsuits in the United States. However, this was only part of the financial burden. Bayer continues to face ongoing lawsuits, and the outcome of future litigation remains uncertain.

Reputational Damage: Bayer also faced severe reputational damage. The acquisition of Monsanto had already drawn significant criticism, and the continued use of Glyphosate in many markets only intensified opposition from consumer protection groups and environmental activists.

The loss of public trust and the negative media coverage severely impacted Bayer’s stock price, leading to a decline in investor confidence.

4. How Better GRC Could Have Prevented or Mitigated the Situation

An effective Governance, Risk, and Compliance (GRC) system could have helped Bayer better identify and assess the risks associated with acquiring Monsanto and the long-term financial and legal consequences. A robust GRC framework would have provided Bayer with a clearer picture of the potential challenges, allowing for better decision-making and risk management strategies.

4.1 Early Risk Assessment and Awareness

A stronger GRC system could have allowed Bayer to more accurately identify and assess the legal risks associated with Glyphosate. If Bayer had conducted a more thorough risk assessment, it might have reconsidered the acquisition or at least taken additional steps to mitigate the risks involved.

4.2 Enhanced Due Diligence

The due diligence process conducted before the acquisition could have been more focused on the ongoing legal battles. A more comprehensive GRC system would have likely flagged the legal risks and provided a more realistic picture of the potential future liabilities.

4.3 Long-Term Risk Management

A proactive approach to long-term risk management could have helped Bayer better navigate the financial strains associated with the ongoing lawsuits. Bayer could have developed a clearer strategy for mitigating the financial risks and communicating the benefits of Glyphosate and its safety more effectively.

4.4 Ethics and Regulation

A more robust GRC framework would have also encouraged Bayer to consider the ethical and regulatory implications of continuing to rely on Glyphosate. By assessing not only the legal risks but also the societal and regulatory dimensions of the issue, Bayer might have been able to better anticipate the public backlash and regulatory challenges.

5. Why Bayer Is Considering Bankruptcy for Monsanto

In light of the ongoing high number of lawsuits and the financial strain, Bayer is now considering the possibility of pushing Monsanto into bankruptcy to alleviate the burden of ongoing legal disputes. Bankruptcy could allow Bayer to manage the legal proceedings in a way that minimizes its financial obligations.

However, such a move would not only severely damage Bayer’s reputation but could also lead to further legal and regulatory challenges. The political and public backlash from filing for bankruptcy could also have long-term consequences for Bayer’s brand and market standing.

Conclusion: A Vicious Cycle of Strategy, Risk, and GRC Failures

Bayer’s acquisition of Monsanto was a risky move from the outset, with financial, legal, and reputational challenges already on the horizon. An improved GRC system could have helped Bayer better understand the risks involved and allowed the company to make more informed decisions. The situation serves as a cautionary tale for businesses considering large acquisitions or entering industries with significant regulatory and societal challenges. An effective GRC framework is essential for identifying, assessing, and managing risks to ensure long-term success.

---

FAQ on Bayer, Monsanto, and Glyphosate

1. Why did Bayer acquire Monsanto despite the legal issues surrounding Glyphosate?

Bayer acquired Monsanto to strengthen its position in the agribusiness sector and take advantage of synergies between its own products and Monsanto’s innovations. While Bayer was aware of the risks associated with Glyphosate, it believed these could be managed effectively and that the acquisition would be beneficial in the long term.

2. What is the issue with Glyphosate?

Glyphosate, a key ingredient in Roundup, was classified by the International Agency for Research on Cancer (IARC) as “probably carcinogenic.” This has led to a series of lawsuits, where plaintiffs claim that exposure to Glyphosate caused cancer, resulting in significant legal challenges for Monsanto (and later Bayer after the acquisition).

3. How much did Bayer pay for the acquisition of Monsanto?

Bayer acquired Monsanto for approximately $63 billion in 2018, marking one of the largest deals in the history of the chemical and agricultural industries.

4. What are the financial impacts of the Glyphosate lawsuits on Bayer?

The ongoing legal battles have cost Bayer billions of dollars. In 2020, Bayer set aside $11 billion to settle lawsuits in the U.S., but the financial strain continues with further litigation ongoing.

5. How could better GRC have helped Bayer avoid or mitigate the situation?

An improved GRC system could have helped Bayer better assess the risks associated with the Glyphosate litigation, conduct a more thorough due diligence process, and implement proactive long-term risk management strategies. It would also have helped Bayer consider the ethical and societal implications of continuing to rely on Glyphosate.

6. Why is Bayer considering bankruptcy for Monsanto?

Due to the overwhelming legal and financial burden from the ongoing lawsuits, Bayer is considering pushing Monsanto into bankruptcy to manage these liabilities. This move could help alleviate financial pressure, but it would have severe reputational consequences for Bayer.

7. What would bankruptcy for Monsanto mean for Bayer?

Bankruptcy would provide Bayer with some legal relief, but it would also cause significant reputational damage. It could further erode public trust in the company and lead to additional legal and regulatory challenges.

8. What can other companies learn from Bayer’s experience?

Bayer’s situation highlights the importance of thorough risk management and the need for strong Governance, Risk, and Compliance (GRC) systems. Businesses should carefully assess the long-term risks associated with large acquisitions and consider the ethical, legal, and reputational implications of their decisions. A robust GRC system is essential for protecting a company’s long-term viability and success.

The aviation industry is undergoing one of its most significant transformations: Boeing and Airbus are splitting the major U.S. supplier Spirit AeroSystems between them. This historic deal raises key questions about the strategic reasons behind the takeover and highlights the Governance, Risk, and Compliance (GRC) challenges that come with it.

Why Are Boeing and Airbus Acquiring Spirit AeroSystems?

1. Quality Issues and Production Deficiencies

In recent years, Spirit AeroSystems has faced repeated negative headlines due to severe quality issues in aircraft component manufacturing. For Boeing, defective parts in the 737 MAX series and a serious incident in early 2024 triggered the need to regain control over critical production processes. Addressing these quality concerns was a primary driver behind Boeing’s acquisition.

2. Supply Chain Stabilization

Global aviation has been struggling with fragile supply chains since the pandemic. As one of the largest suppliers, Spirit AeroSystems became a critical — but increasingly risky — link. Both Boeing and Airbus aim to reduce dependency on external suppliers and secure their production stability through this takeover.

3. Strategic Realignment and Vertical Integration

The industry trend is shifting back toward vertical integration. Boeing is investing approximately $4.7 billion to bring former divisions back in-house. Airbus is acquiring only those Spirit sites dedicated to producing components for Airbus models. Both companies are securing essential resources and expertise for future competitiveness.

GRC Challenges: Key Tasks Following the Takeover

The acquisition of Spirit AeroSystems offers operational advantages but also presents significant Governance, Risk, and Compliance (GRC) challenges.

1. Governance: Establishing Clear Structures

With the integration of Spirit facilities, Boeing and Airbus must implement new governance frameworks. Defining responsibilities, reporting lines, and control mechanisms is crucial to ensure transparency and prevent mismanagement.

2. Risk Management: Minimizing Quality and Supply Chain Risks

Spirit AeroSystems’ history demonstrates how quickly quality failures can lead to severe financial and reputational damage. A robust risk management system is essential to monitor production processes and detect supply chain risks early.

3. Compliance: Navigating Complex Regulatory Landscapes

With sites in the USA, Europe, and Morocco, Boeing and Airbus face a wide range of regulatory requirements. Labor laws, environmental regulations, export controls, and industry standards must all be addressed. A global yet locally adapted compliance framework is vital.

Conclusion: Opportunity and Responsibility

The takeover of Spirit AeroSystems by Boeing and Airbus represents a strategic move to stabilize supply chains and improve production quality. However, the GRC challenges must not be underestimated. Only with strong governance, effective risk management, and strict compliance can both companies turn this bold move into lasting success.

FAQ: Spirit AeroSystems Takeover by Boeing and Airbus

What is Spirit AeroSystems?
Spirit AeroSystems is one of the world’s largest manufacturers of aircraft components, supplying both Boeing and Airbus.

Why was Spirit AeroSystems split?
Due to ongoing quality issues and supply chain risks, Boeing and Airbus decided to split Spirit to gain greater control over critical production areas.

How much is Boeing paying for Spirit AeroSystems?
Boeing is acquiring the majority of Spirit for approximately $4.7 billion.

Which sites is Airbus taking over?
Airbus is acquiring facilities in Belfast, Prestwick, Morocco, France, and parts of the USA that exclusively supply Airbus programs.

What are the GRC challenges associated with the takeover?
The main challenges include establishing clear governance structures, minimizing quality and supply chain risks, and ensuring compliance with international regulations.

What does the takeover mean for the aviation industry?
The acquisition strengthens Boeing’s and Airbus’s market positions but could reduce competition among suppliers and put pressure on smaller vendors.

Introduction: What Does Easter Have to Do with Compliance?

At first glance, Easter and compliance seem worlds apart. One conjures images of springtime, colorful eggs, and the message of rebirth and hope, while the other is often associated with rules, regulations, and restraint. But a closer look reveals a symbolic connection: just like life, compliance too sometimes needs a fresh start.

Spring is a time of renewal – and companies, too, must regularly reflect on and update their structures, values, and processes to stay future-ready. This article explores how the message of Easter can inspire a more forward-looking approach to Governance, Risk, and Compliance (GRC) – and why it’s time to transform compliance culture at its core.

1. Outdated Compliance Structures: When Good Friday Becomes Business as Usual

Many organizations are still burdened by legacy systems, siloed data, and a compliance culture built around fear, control, and reaction, rather than responsibility, prevention, and transparency. These outdated structures have grown over the years and now weigh down companies like a cross they’re forced to carry.

Common signs of “Good Friday” compliance structures:

• Overly complex rulebooks with little practical relevance
• Ineffective communication between risk management, audit, and business units
• Low employee engagement with compliance topics
• Reactive instead of preventive mindsets

Bottom line: These structures can stifle innovation and erode trust – they are in urgent need of transformation.

2. The Turning Point: Risk as a Catalyst for Renewal

Easter doesn’t only symbolize an end – it marks a new beginning. Similarly, crises, regulatory shifts, or reputational setbacks can serve as turning points for companies. Rather than merely mitigating damage, the true opportunity lies in embracing change and rethinking the organization’s compliance DNA.

Why risk is now a strategic issue:

• Cybersecurity, ESG regulation, supply chain laws, and AI compliance make risk management a C-suite priority.
• Companies that proactively manage risks build stronger relationships with investors, customers, and employees.
• Transparent governance structures foster clarity, confidence, and accountability.

3. Rebirth of Compliance Culture: From Control to Commitment

Today’s GRC strategy is no longer about red tape – it’s about mindset and values. A modern compliance culture promotes ownership, digital efficiency, open communication, and above all: trust.

Key success factors for a “reborn” compliance culture:

• Digital tools & automation: Smart systems reduce routine work and free up capacity for strategy and foresight.
• Human-centricity: Employees don’t just follow rules – they understand and internalize them.
• Ethics & transparency: Companies act with integrity, inside and out.

Example:
A company introduces a digital whistleblower system, supported by internal values-based training. The result? More reporting activity, faster responses – and stronger trust in leadership.

---

4. Governance as the Easter Message: Compliance as Part of Corporate Purpose

Easter is a celebration of hope, forgiveness, and future possibilities. In today’s complex world of ever-growing regulations and uncertainties, a modern GRC strategy is more than a shield – it’s a reflection of a company’s ethical compass.

Governance in 2025 means:

• Long-term vision instead of short-term risk avoidance
• Accountability instead of blame
• Purpose over policy

Compliance becomes an integral part of sustainable leadership.

Conclusion: Time for a Corporate Spring

Easter reminds us every year that change is not only possible – it’s essential. In the world of governance, risk management, and compliance, this change is long overdue. Companies that dare to question outdated structures and rebuild their compliance culture from the ground up pave the way for trust, resilience, and future-readiness.

Now is the time to dust off your GRC strategy and turn it into a living culture rooted not just in rules, but in purpose.

Tariffs are among the most hotly debated instruments of trade policy. In particular, the imposition of additional tariffs by the U.S. government under Donald Trump has been making headlines in recent years, and continues to do so. The impact of these protectionist measures was—and still is—felt on multiple fronts, both by the U.S. economy and by trading partners affected by these tariffs. What concrete effects have Trump’s tariffs had on the U.S. and on other countries? What historical examples of tariffs exist, and how successful were they? And to what extent are today’s companies being called upon to adapt their Governance, Risk, and Compliance (GRC) structures to cushion against such risks? This article takes a detailed look at these questions.

Trump’s Tariffs and Their Economic Impact

Under the Trump administration, the phrase “America First” became a central slogan. In the context of trade policy, it meant protecting domestic industries and reducing the trade deficit. Accordingly, President Trump announced early on his intention to impose punitive tariffs on a range of imported goods.

Particularly high-profile were—and remain—the tariffs on steel and aluminum from various countries. China repeatedly came under the U.S. spotlight because, according to Trump, there were massive trade imbalances. These tariffs quickly led to countermeasures and retaliatory tariffs. Countries like China and EU member states struck back by introducing their own tariffs on U.S. products, such as agricultural goods and certain consumer products.

The consequences within the U.S. emerged on several levels. On the one hand, certain U.S. industries benefited from a temporary competitive advantage. Steel producers, for instance, suddenly faced less competition, leading to a greater domestic market share. On the other hand, many companies that process steel (for example in the automotive and machinery sectors) saw production costs increase, ultimately resulting in higher prices for end consumers. In addition, U.S. exporters in sectors like agriculture suffered significant losses, as retaliatory tariffs effectively “shut out” key export markets. U.S. farmers in particular complained about lost revenue because products such as soybeans and other agricultural goods became subject to higher duties in countries like China.

For trading partners—from China to the EU to Canada and Mexico—these tariffs primarily meant higher prices in the U.S. market. This shrinks their market share and puts export-sector jobs at risk. At the same time, many foreign companies are forced to focus on other markets or seek workarounds. Overall, these processes are driving a realignment of global supply chains. Multinational companies, in particular, are reassessing their sourcing and production structures to avoid being overly affected by U.S. tariffs and possible retaliatory measures.

Historical Examples of Tariffs and Their Success

While Donald Trump became particularly well-known for his aggressive tariff policy, relying on punitive tariffs is not new. A frequently cited example from economic history is the Smoot-Hawley Tariff of 1930. During the Great Depression, the U.S. government under President Herbert Hoover raised tariffs on numerous imported goods in hopes of protecting domestic agriculture and industry.

However, this strategy proved counterproductive. Several trading partners responded with countermeasures, sparking a veritable “tariff war.” The resulting exchange of tariffs reduced global trade overall and ultimately exacerbated the economic crisis of the 1930s. While the global economy today is not directly comparable to that era, it illustrates that protectionist policies may have short-term effects but often lead to a downward spiral in the long run, given that countermeasures and trade barriers also affect one’s own economy.

Another example is the “Chicken War” of the 1960s between the U.S. and the European Community. Both sides imposed tariffs on poultry and other products, resulting in a diplomatic freeze and higher prices. This conflict exhibited many of the same patterns later seen under Trump: countermeasures, trade diversion, and costly legal disputes before international bodies.

The Role of GRC in the Context of Tariffs

Companies operating in multiple countries must protect themselves from economic and political risks. When governments impose tariffs on short notice or renegotiate international trade agreements, the situation can change drastically in a very short time.

Tariffs or other protectionist measures are not just temporary disruptions; they can have far-reaching consequences for supply chains, production costs, and markets. A carefully designed Governance, Risk & Compliance (GRC) system enables companies to respond to these challenges in a targeted way. The three core areas of Governance, Risk, and Compliance operate like gears that must mesh seamlessly in order to manage crises or political upheavals successfully. Below, you’ll learn what a strong GRC framework looks like and what specific steps each area can take.

Governance: Clear Structures for Rapid Decisions

Governance refers to the leadership and organizational structures responsible for strategic decisions. A robust governance framework features transparency and clear responsibilities so that management can react quickly to trade barriers or changes in tariffs.

• Central Steering Committee: In the face of looming tariffs or other political risks, it can be helpful to establish a dedicated “trade committee” or crisis team. This body evaluates information related to tariffs, coordinates departments such as purchasing, logistics, and finance, and makes timely decisions.
• Clear Escalation Paths: If supply chains are threatened, problems must be communicated swiftly to top management. A well-designed governance model specifies to whom employees should report in various situations, ensuring that necessary strategic changes or investment decisions can be made quickly.
• Strategic Alignment: Governance also involves adjusting business strategy to changing conditions. If import costs rise, for instance, the company may decide to relocate production steps domestically or specifically target investments in new markets. Strong governance ensures that such measures are coordinated and not implemented in isolation.

Example: If a U.S. company learns that tariffs on steel imports from Canada are in the pipeline, an effective governance body would immediately convene all relevant stakeholders. This group would examine whether to diversify existing steel suppliers, renegotiate with Canadian partners, or temporarily increase inventory.

Risk Management: Identifying and Mitigating Threats

Without solid risk management, companies could be caught off guard by tariffs literally overnight. A professional process of risk analysis and control ensures that such developments are identified early and that adequate countermeasures can be prepared.

• Continuous Monitoring: Effective risk management continuously monitors relevant markets, political developments, and legal frameworks. This allows the company to anticipate the likelihood of new tariff regulations early on and develop contingency plans.
• Scenario Analysis and Stress Tests: Many companies use scenario planning to be better prepared. They run through various assumptions—for example, what would happen if a 25% tariff on steel were introduced? The results of these analyses help to prioritize response options.
• Supplier Diversification: The more flexible a company’s sourcing strategy, the less severe the risk if a particular country is subject to tariffs. Good risk managers typically maintain multiple suppliers in different regions and negotiate framework agreements to cushion short-term price increases.
• Insurance Solutions: In some industries, political risks (Political Risk Insurance) can be partly insured. Though not always possible, it demonstrates that risk management extends beyond procurement and logistics, covering financial and legal aspects as well.

Example: A global automotive supplier sources aluminum from Mexico and China. Its risk management identifies the possibility that the U.S. might impose tariffs on aluminum products. By strategically expanding European and Southeast Asian suppliers, the company reduces its dependence on those markets. Should tariffs actually be introduced, it can quickly switch to alternative suppliers.

Compliance: Lawful Conduct in All Tariff and Trade Matters

Compliance means ensuring that a company adheres to all relevant laws, regulations, and internal guidelines. Especially in the wake of punitive or retaliatory tariffs, new laws and regulations often emerge. A robust compliance management system is vital to avoid unnecessary legal pitfalls.

• Customs and Export Regulations: Once tariffs are in effect, the associated tariff rates and product classifications often change. An effective compliance system monitors these changes in real time and updates internal processes (e.g., product coding, documentation) accordingly.
• Proactive Training: Employees in purchasing, logistics, and sales need to be trained to implement new regulations correctly. Compliance training imparts the necessary knowledge of documentation requirements, customs procedures, and deadlines.
• Transparent Documentation: A seamless record of imported goods is essential. Modern compliance tools ensure that all customs documents, product certificates, and delivery records are readily available. In case of inspections or legal disputes, the company can provide evidence of all transactions.
• Ethics and Integrity: Compliance encompasses not only adherence to laws but also ethical and sustainable dealings with business partners. In an environment where tariffs create political tensions, a clear commitment to fair business practices can strengthen the trust of partners and customers.

Example: After China introduces new retaliatory tariffs, a U.S. company must adapt its export documentation to the revised regulations. The compliance team informs everyone involved about the new HS codes (Harmonized System Codes) and ensures that no incorrect information is submitted during customs clearance. This helps prevent legal conflicts and reduces financial risks from potential fines or delivery delays.

How the Three GRC Pillars Work Together for a Robust Business Strategy

The real power of a GRC system only emerges when Governance, Risk Management, and Compliance work hand in hand. Risk management, which identifies new tariff risks, will only be effective if good governance structures enable swift responses and if robust compliance management ensures a solid legal foundation.

This synergy is crucial when international conflicts arise and governments impose tariffs on short notice. Only a company that knows its decision-making pathways and obligations (Governance), has tested possible scenarios (Risk Analysis), and rigorously complies with all regulations (Compliance) can act confidently in such situations.

Concrete Example of an Integrated GRC Response:

1. Risk Management analyzes initial indications of planned tariff increases and recommends building up inventory and reducing dependence on the affected import country by seeking alternative suppliers.
2. Governance convenes a crisis team to evaluate these recommendations and decide—within a very short period—whether and how the company should invest. Relevant departments (purchasing, production, logistics) are then informed.
3. Compliance reviews the required formalities for switching suppliers and ensures that all documentation and declaration obligations are met in order to comply with legal requirements.

Such an approach significantly reduces the likelihood of unpleasant surprises, high additional costs, or even supply failures.

Conclusion: Tariffs, Protectionism, and Corporate Strategies

Trump’s tariffs have shown how quickly protectionist measures can upend global supply chains. While individual sectors in the importing country can benefit in the short term, most companies face greater uncertainty and many consumers end up paying higher prices. Historical examples such as the Smoot-Hawley Tariff or the “Chicken War” show that import tariffs usually trigger countermeasures and put global trade under pressure.

In a networked world, we can expect tariffs to continue to be used as a means of exerting pressure. Companies would therefore do well to align their Governance, Risk, and Compliance processes in such a way that they can respond swiftly and flexibly. A mature GRC framework enables early risk detection, supports lawful conduct, and ensures transparent corporate leadership. In doing so, companies lay the foundation to remain successful even in turbulent trade environments.