Scott Mitchell

Could CROs/CAEs be liable that don’t report to board on MISSION CRITICAL OBJECTIVES/RISKS? I asked Chat GPT. Legal advice recommended. TL: In companies that have Chief Risk Officers and/or Chief Internal Auditors do these officers have a legal responsibility in the US to report on risk status linked to MISSION CRITICAL OBJECTIVES to the board? ChatGPT: In the U.S., Chief Risk Officers (CROs) and Chief Internal Auditors (CIAs) typically have professional and organizational responsibilities to report on risk, but their legal responsibilities to report specifically on "mission-critical objectives" to the board depend on several factors, including regulatory frameworks, industry standards, and corporate governance practices. Legal Responsibilities Chief Risk Officers (CROs): Legal Requirement? Generally, CROs are not explicitly required by law to report directly on "mission-critical objectives" unless it is stipulated in regulatory requirements or the company's governance framework. Regulatory Environment: …. Sarbanes-Oxley Act (SOX): …. Chief Internal Auditors (CIAs): Legal Requirement? Internal auditors are not legally required to report specifically on "mission-critical objectives" unless their scope is defined by regulations, the board's audit committee, or internal policies. Professional Standards: The Institute of Internal Auditors (IIA) Standards require auditors to assess and report on key risks, including mission-critical ones, as part of their audit charter. The charter is typically approved by the board or the audit committee. Fiduciary and Organizational Responsibilities Corporate Governance Frameworks: In most companies, the board of directors holds ultimate responsibility for overseeing risks related to mission-critical objectives. CROs and CIAs are accountable to the board or a specific committee (e.g., risk or audit committee) to ensure they are informed. Whistleblower Protections: ….. . Summary Answer: CROs and CAEs are not generally legally liable for reporting on MISSION CRITICAL RISKS unless required by law/regulation, or contract. This exception was confirmed in OCC case against Wells Fargo CRO and two CAEs. OCC Judge McNeil found CRO/two CAEs civilly liable and in breach of fiduciary duty to the bank. He recommended civil fines for CRO $10M and two CAEs $7.0M and$1.5M There are three separate 400+ page public judgments. Fines/sanctions are being appealed. Although these are arduous judgments, all CROs/CAEs should take time to read them. CRO and CAE professional negligence liability could change rapidly if boards start defining what they need from CEOs/CROs/CAEs to ensure they meet escalating director fiduciary duty of care to oversee MISSION CRITICAL OBJECTIVES/RISKS. Shareholders/regulators/broader stakeholders have to hope they do. NEGLIGENCE BECOMES FRAUD when CROs/CAEs are aware of MISSION CRITICAL RISKS and withhold reporting to a board who have asked CRO/CAE for reports on MCOs/risk status.

10

1 Comment

Understanding the board’s role in governing AI is critical! Taking advantage of the opportunities in a responsible way while managing the risk is a topic for all boards! #board #boardsofdirectors #boardgovernance #boarddirectors #nacd #accenturesecurity

11

I love the content that NACD (National Association of Corporate Directors) provides to their certified directors for CE. Cyber is likely the most significant shared #risk that all organizations have, from multinational to non-profit to smaller regional business. Until you’ve experienced how powerful these bad actors are you may see other risks as greater. Sessions like this one help directors and senior executives ask better questions. See you there! #board #director #ceo #cyber #esop #it #fiduciary

14

1 Comment

AI Oversight by Boards and Committees Yesterday, I shared top 10 insights from working on #AI oversight by #Boards and their #Committees during the #Audit Committee update at our #PodiumClub. 1.   AI oversight by Boards and Committees will continue to evolve and needs to be fit for purpose. 2.   Boards need to decide if they want to establish a #TechnologyCommittee or use existing Committees for AI oversight. 3.   Boards are building their AI literacy and need to ensure that management is doing the same so they have a common starting point and language. 4.   Boards need to reflect on whether they need to acquire #AIskills or broader #technologyskills to enhance their composition. 5.   Board and Committees need line of sight to what stage of #maturity the organization is in related to #GenAI so they know what level of oversight they need to exercise. 6.   Boards need to monitor evolving AI #regulations and their impacts. 7. Boards need to understand the #investments in AI (tech, people and processes) and the #ROI in hard dollar terms to determine its value proposition. 8. Boards need to look at the proportionality of investments between #tech, #people and #processes. Often, there tends to be underinvestment in people which results in barriers to AI #adoption. 9.   Boards are overseeing #risk-based approaches to AI and #riskappetite for AI is not a one size fits all approach. 10.   Boards need to undertake #governance reviews of AI within their organizations to know what is in place and what's needed to be future ready. Big thank you to Carla Cappuccitti for a seamless delivery of the session and to Jacklyn Mercer for inviting me to the session. Anna Marks Duncan L. Sinclair Fatima Laher, ICD.D Jonathan Goodman Chris Lynch Preeti Shivpuri Jas Jaaj Peter Sozou Mario El-Khoury Nino Montemarano Azer Hann

44

2 Comments

🔸Do you know the difference between reducible and irreducible risk?🔸 Organizations that do not address risk that's reducible will never have enough margin to cushion for the effects of risk that's irreducible. Saying it another way, the more a company invests in buying down reducible risk the more margin they will have to use for the things that really matter. https://lnkd.in/g29W8C_v #leancompliance #lean #compliance

2

🔸 [WEBINAR] Elevate Compliance by Staying Ahead of Risk 🔸 August 25th, 12 Noon, EDT In this webinar you will learn how to confront and defeat the dragon of uncertainty as we explore three questions: 1. What is Uncertainty and Risk? 2. How do we contend with the Root Cause of Risk? 3. How do we Improve the Probability of Compliance Success? Are you ready to confront your dragons? If you are register today! https://lnkd.in/g4fHKU5Y #leancompliance #lean #compliance

1

An analysis of cybersecurity disclosures made by Fortune 100 companies shows that as the speed and complexity of cyber attacks increase, boards are enhancing their cyber expertise and engaging with cyber risk professionals. Read more in this new report. #BoardMatters

6

Sharing the next article in our AI regulatory compliance services series focused on implementing the Measure function of the NIST AI Risk Management Framework. Implementing the NIST Artificial Intelligence Risk Management Framework – Measure The National Institute of Standards and Technology (NIST) published its Artificial Intelligence Risk Management Framework (NIST AI 100-1) in January 2023. The NIST AI Framework consists of 19 categories and 72 subcategories within the following four core functions: Govern Map Measure Manage In prior articles, we focused on considerations when assessing and implementing the Govern and Map functions within the NIST AI Risk Management Framework. In this article, we focus on the implementation of the Measure function of the NIST AI Risk Management Framework. The Measure function includes five categories and 22 subcategory controls as listed in Table 1 below. Click the link below to read the full article...

40

The new IIA standards will elevate the role of IA, emphasizing strategic alignment and advanced tech skills. This is a significant shift for organizations aiming to enhance governance and operational efficiency. Weaver’s recent article offers a comprehensive understanding of what these updates will mean for your team and your organization. https://lnkd.in/gf6PGC5F

8

Check out the 15th edition of the State of Risk Oversight: An Overview of Enterprise Risk Management Practices. The study presents a number of findings that are very common from our experience... 1️⃣ ERM maturity lags behind the fast-paced risk landscape. 2️⃣ Disconnect between risk management and strategic planning. 3️⃣ Growing demand for stronger ERM from boards and external stakeholders. #RiskManagement #ERM #BusinessContinuity #Governance #StrategicPlanning #BusinessResilience

16

[Webinar] Elevate Compliance By Staying Ahead of Risk - Free master class on contending with uncertainty and risk across all compliance domains. Still time to join us today (Apr 25) 12:00 noon EDT. https://lnkd.in/g4fHKU5Y #leancompliance #lean #compliance

1

Join me at #AuditAndBeyond by @AuditBoard as I share insights on the power of a connected risk approach that aligns the three lines, attributes of connected risk thinkers, and the imperative to leverage technology. Register today to secure advance pricing!  https://lnkd.in/ekbEBvcK

36

Bracing for a potentially highly active 2024 #hurricane season, KPMG’s Taylor Blunt explores key preparedness considerations for #emergencymanagement leaders in a new blog post. Join the discussion and share your insights! https://bit.ly/4c1J2tc

14

🌐🔒 Cybersecurity & Patent Data: The Strategic Nexus for the Next Decade 🔍 💡 In a hyper-connected era, patent data is a cornerstone of global innovation ecosystems and a critical asset at risk of cyber threats. 🚀💾 To safeguard this intellectual powerhouse, strategists must align cybersecurity frameworks with forward-looking IP management systems. Let’s explore key dimensions and trends shaping the next decade: 🔑 Data Confidentiality Meets Quantum Computing: As quantum computing 💻⚛️ advances, encryption standards face obsolescence. For instance, organizations like the European Patent Office are already researching quantum-resistant algorithms to future-proof their systems. 🌍 Global Cyber Governance & Collaboration: Harmonized international protocols 🌐🤝, such as the World Intellectual Property Organization – WIPO Digital Access Service, highlight the need for unified cybersecurity strategies to safeguard cross-border patent filings. ⚡ AI-Powered Threat Intelligence: Tools like Darktrace leverage AI 🤖 for predictive analytics 📊, enabling firms to detect and neutralize cyber risks proactively. These solutions are transforming IP management into a dynamic, data-secure domain. 🛡️ Decentralized Security Models: Blockchain technologies ⛓️ are being piloted by companies like IBM to provide tamper-proof mechanisms for patent ownership tracking and licensing. 📚 Cyber Literacy & Upskilling: Tech leaders like Microsoft are integrating cybersecurity awareness training into their operational frameworks, reducing human error and creating a culture of resilience. 🔍 Patent Data Commercialization vs. Cybersecurity: Platforms such as Google Patents exemplify the delicate balance between open innovation 💡💰 and the safeguarding of proprietary data. 🌌 Tackling Emerging Threats: The increasing use of IoT-connected devices 📡 in industries like Biotech patents amplifies vulnerabilities. Proactive strategies to secure these systems will be key. Proactive Question for IP Leaders: How can we leverage emerging technologies like AI and blockchain to create a cyber-resilient patent ecosystem that protects data and drives innovation globally? 🌍✨ #Cybersecurity #PatentData #GlobalIP #InnovationProtection #AI #Blockchain #QuantumComputing #IntellectualProperty #FutureOfIP

13

10 Comments