At first glance, this seems surprising. AI brings legal, reputational, customer, and data risks unlike anything most organizations have dealt with before. Surely shareholders should want greater visibility into how those risks are being governed.

Perhaps. But the answer may not be a public AI policy. Technology companies move quickly. AI capabilities evolve monthly. A detailed public policy risks becoming obsolete almost as soon as it is published, while also creating commitments that regulators, litigants, and activists can later hold the company against.

The governance challenge is therefore bigger than whether an AI policy exists. It is how shareholders gain assurance that AI is being governed without requiring the company to disclose the playbook.

Banks do not publish their fraud policies. They do not disclose their cyber controls or model risk standards. Yet shareholders still derive confidence because governance is built around recognized frameworks, board oversight, independent challenge, and periodic assurance.

AI may evolve the same way. Rather than demanding visibility into the policy itself, shareholders may eventually demand visibility into the governance architecture.

- Is there board oversight?

- Is there an enterprise AI governance framework?

- Is it aligned to recognized standards such as ISO/IEC 42001 or the NIST AI Risk Management Framework?

-Is it independently reviewed? Are high-risk AI use cases subject to enhanced governance?

That may prove to be the middle ground.

Governance does not always require transparency into every control. Sometimes it requires confidence that the controls exist, operate within a recognized framework, and are subject to meaningful oversight.

The future debate may not be whether companies should have an AI policy. It may instead be how shareholders can be assured that a defensible AI governance framework exists without needing visibility into the company’s operating documents.

Ancient wisdom tells us not to cry over spilled milk.

But with tokenization and atomic settlement, #GRC leaders may need to redesign controls so the milk cannot be spilled in the first place.

Traditional governance often relies on detective controls, reconciliations, approvals, and post-event intervention. There is usually time to identify an error, escalate it, remediate it, and reverse the damage.

Tokenized assets change that equation. The benefits of programmability, atomic settlement, and immutability act as a double-edged sword. They dramatically shrink the window for governance intervention to correct a bad decision.

This shifts the focus of GRC from governing transactions to governing architecture.

If #tokenization becomes widespread, governance will need to spend less time asking whether a transaction was processed correctly and more time asking whether the logic behind the transaction was correct. A bad process may create one bad transaction. A flaw in code or business logic can create thousands of perfectly executed ones.

That changes what good governance looks like. Reviews of system design and automation may become as important as operational audits. Scenario testing may become more valuable than post-event reconciliation. Change management and user training may carry greater weight because the cost of a single design flaw can multiply at machine speed. The greatest control may no longer be the one that catches an error after execution, but the one that prevents the system from executing it at all.

As financial infrastructure evolves, governance may need to move from reacting to spilled milk to engineering a kitchen where the glass cannot be knocked over.

Up for a challenge, Federal Deposit Insurance Corporation (FDIC) GRC leaders?

#stablecoins

Supermicro is facing scrutiny after allegations that its cofounder orchestrated a $2.5 billion export control evasion scheme involving AI servers containing Nvidia chips. If true, the allegations describe a sophisticated operation involving front companies, fake servers, and deliberate efforts to conceal the true end users.

But in 2024, Supermicro commissioned an independent investigation after concerns were raised during an audit process. The review reportedly examined export control matters and found no evidence of circumvention.

This is an uncomfortable situation for governance.

Are investigations enough without understanding the residual risk created by their boundaries? Data quality, methodology, scope, assumptions, and blind spots all play a significant role.

Governance needs to ask:

1. Was the scope broad enough?

2. Were the right transactions examined?

3. Were investigators looking for ordinary compliance failures, or testing whether determined insiders could deliberately route around controls?

4. What assumptions sat behind the conclusion?

Supermicro is an excellent example of the gap between, “We had that investigated and it came back clean,” and, “We did not account for what the investigation could not see.”

Whether this ultimately proves to be an investigation failure remains to be seen. But it is unquestionably a governance challenge. Because once governance has already declared the house inspected and safe, a second failure becomes a credibility problem.

Several airlines have recently lost operating licenses or entered bankruptcy. These include Estonia-based SmartLynx Airlines, Austria's Mali Air, Swedish charter carrier H-Bird, Houston-based charter carrier Starflite Aviation and Malta-based LEAF.

But the sharper governance question sits before that endpoint. What happens when an airline is visibly under strain, liquidity is tightening, commercial pressure is rising, but operations continue and everyone is expected to behave as though business remains normal?

This is the gray deterioration zone.

This is where the best GRC intentions can begin to drift. Escalation controls may become fuzzy. Operational shortcuts become easier to rationalize. Sales teams may push harder for revenue while vendor payment delays begin affecting resilience. Bad news may be softened to avoid panic among customers, lenders, or partners. Staff can sense the strain, leading to fatigue, lowered morale, and weakened execution discipline. A downward spiral can begin where near misses continue to be interpreted as isolated rather than symptomatic.

The written risk appetite may remain unchanged. The actual risk behaviour may already have crossed into dangerous territory.

This is where GRC’s role changes. The objective is no longer simply preventing failure through standard oversight. It becomes identifying when normal governance assumptions are no longer valid, and whether enhanced controls, crisis governance, or explicit operational restrictions need to take over.

The most dangerous period is often not after collapse. It is the stretch where deterioration is visible, but governance continues pretending it is business as usual.

Mercor was one of AI’s fast-rising stars, a $10 billion startup built around supplying human contractors to train AI systems for major clients including Meta, promising scale, speed, and the infrastructure to power the AI economy.

But the dream run hit a wall abruptly with five lawsuits in a week. Contractors alleged exposure of sensitive personal data, including Social Security numbers and interview recordings, and Meta reportedly paused its contract.

Increasingly in the AI age, companies are being built on borrowed trust. A vendor claims they are secure, a third-party auditor confirms compliance, an open-source tool is widely used, and eventually everyone assumes someone, somewhere, performed the proper checks. Until one day the cracks give way.

At a time when everyone wants to be the fastest, trust is being outsourced faster than responsible verification can happen.

The governance model of trust by association is becoming increasingly dangerous. In this case, the assumptions stacked up neatly: Delve certified them, the industry uses LiteLLM, open source means many eyes. All of these were surface-level comfort mechanisms, not actual assurance.

This incident should raise governance’s antennae. Vendors’ compliance certificates will not stop plaintiff lawyers. Checkbox governance will not create credibility. Open-source and vendor dependencies may be far more porous than expected.

Apart from stronger stress tests before new lending and recalibrating risk appetite, my recommendation for #governance leaders in private lending, is a sharper focus on tracking the health of borrowers and their probability of default.

The dashboard (example attached) should contain early warning indicators such as missed or delayed payments, worsening cash flow, increasing leverage, covenant pressure, sector stress, and refinancing dependency.

Greater sensitivity should be built into escalation thresholds, with a clear matrix where amber triggers closer monitoring and red triggers intervention, preparing for collections.

Jamie's warning signals the end of overt optimism and the beginning of Saturnian monitoring. It is no longer just about who moves fastest to win, but who survives long enough to have the chance to win.

Private lending expanded quickly in recent years in Canada, with less experienced or even unlicensed brokers operating complex deals where layered lending through multiple parties occurred and thorough risk assessment was required but often sidelined, exposing buyers to a high risk of errors, misrepresentation, and even outright fraud.

FSRA has announced that it is doubling down on enforcing the rules to encourage better practices, starting with higher penalties and a clear mandate to clean things up.

Governance in affected organizations such as mortgage brokerages, private lenders, and mortgage administrators must focus on ensuring that only licensed brokers handle deals, especially in private lending, that defined escalation pathways exist with proper review of high-risk structures to bring discipline to complex deal governance, and that strong controls are in place to curb document fraud through robust verification of borrower information and supporting documentation, while closing the loop through training and accountability so brokers are equipped to handle complexity and understand the consequences of their conduct.

Staying within regulations is a core function of GRC, and adherence is always more effective than enforcement catching up after the fact.

This isn’t a traditional bank that leans conservative. This is an objective-oriented bank, an arm’s-length vehicle for the government to boost the defence industry in Canada.

#Governance’s primary function will be to de-risk decision influence entering the credit process while ensuring policy objectives are actually delivered. Credit won’t be purely market-driven, but it cannot become maverick either. Governance also has to translate policy intent into clear credit criteria, structures, and limits.

Government involvement brings the risk of conflicts of interest and use for political gain. The tightrope is clear. Governance has to set rules to audit and control that influence while still deploying government capital.

GRC functions will need to define eligibility upfront and avoid ad hoc deal approvals. Decisions to approve or reject must be documented and auditable. If policy is the reason for any concession, that must be explicitly recorded. Override authority should be clearly defined, including who can exercise it and under what conditions.

Independent oversight becomes a core pillar to hold the line on standards.

Even with strong governance, execution risk remains. Projects may not scale, suppliers may fail to deliver, and policy intent may not translate into outcomes. Governance must ensure that policy-backed lending still results in real capacity.

When the state funds risk, GRC’s job is not just to manage it. The job is to manage that capital for state objectives without letting influence override discipline.

The company is facing increased scrutiny and pushback on its military targeting system Maven. This is not a software issue. This is a governance issue in a blue-sky environment “where no man has gone before.”

There is increased risk from embedding external models, such as Claude, and from deep integration into military systems, making the product harder to audit, replace, or fully control.

GRC leadership has to move beyond traditional controls to shared responsibility for how the system influences outcomes. Military decisions often happen under compressed timelines, so governance cannot rely on last-minute judgment. It has to be defined in advance what scenarios are permitted, prohibited, or require multi-party sign-off.

My view is that independent oversight becomes central for Palantir Technologies and similar companies building critical AI tools for the military. It goes beyond traditional oversight and becomes a combination of gatekeeping and audit authority. The body decides whether the system can be deployed at all and in which contexts, sets who is allowed to use it and under what authority, and ensures transparency into how decisions are formed. It maintains continuous access to inputs & outputs with decision logs, with power to pause or restrict usage when thresholds are breached.

Many AI systems are being handed influence over decisions that can take lives, not just shape them. Governance has to build in kryptonite before Superman goes rogue.

When Morgan Stanley and Goldman Sachs launch Bitcoin ETFs, the GRC world takes notice.

Bitcoin is a unique product compared to stock market traded products. Unlike stocks or commodities, it neither has a fundamental anchor for fair pricing, nor a uniformly governed market structure, with trading spread across fragmented, loosely connected exchanges. Liquidity, too, doesn’t function the same way as stock market products do.

You can buy the ETF at one price. In Bitcoin, that same price may not exist across exchanges, and large trades can move it quickly.

These challenges create significant GRC risks for Goldman Sachs Governance leadership.

Two major changes should make this product safer from governance POV:

1. Create a new wrapper that has in-built capacity to handle Bitcoin risks

2. Create expectation boundaries around what risks still remain, and communicate them effectively to buyers

The clichéd line “investments are subject to market risks” may not be enough when the flammable product catches fire and burns through the risk and controls wrapper.

Microsoft disclosed that Microsoft Azure growth could have been higher, but compute capacity was redirected toward internal needs. That’s a valid business challenge. But when this surfaced during the earnings call, the stock dropped 10%.

This points to limited visibility around the allocation framework governing this trade-off. If that framework had been clearly communicated upfront, the explanation may not have been required after the fact.

Additionally, Mustafa Suleyman accepting a “mid-class” AI model due to capacity constraints, along with a broad indication that this will ease over the year, adds to the framework visibility gap between Microsoft and its investors.

GRC needs to tighten transparency and communication, before the business consumes more slices of its own pie.

My GRC insights based on a news article by Adam L. In Barron's https://www.barrons.com/articles/microsoft-ai-openai-7ae5ffe2

Delve sells tools that help companies demonstrate they are compliant or secure. Customers rely on audit partners, automated outputs, and templates (such as board notes and questionnaires).

After allegations of weak and misleading compliance practices by an anonymous individual claiming to be a former insider, Delve’s response has been more anxiety-inducing than reassuring.

Delve claims malicious intent, including theft of internal data. At the same time, it acknowledges that some audit partners did not meet its standards, and that templates were only “starting points.”

That raises a simple question: Were customers relying on Delve’s outputs as more official or complete than they were meant to be?

Possible GRC gap: Why are re-audits, cleanups, and clarifications happening now? What governance allowed these gaps to exist in the first place?

Instead, anchor the response, Declare the existing vendor qualification framework Clarify where product boundaries were not sufficiently explicit, Accept contained imperfections, and Define a clear mechanism to contain and remediate.

Trust isn’t a template. And it definitely can’t leak.

Based on a news article by Anthony Ha in TechCrunch

Unlike stocks, bonds or crypto, these contracts have no underlying asset. A binary payout means an investor can be wiped out entirely, the same investor whose democratic access to investing is the hill that WS has built its reputation on.

CIRO / OCRI (Canadian Investment Regulatory Organisation) said yes to the product. But the governance question is: yes to whom, under what conditions, monitored how, and escalated when?​​​​​​​​​​​​​​​​

This cannot be viewed through the same lens as a conventional product approval. GRC leadership needs to create: 1) an entirely new risk taxonomy, 2) define brand new controls on who qualifies for access, and 3) rethink customer risk communication entirely.

This is a regulatory, reputational and moral nightmare bundled in a pretty, profitable gift box 🧞‍♀️. Look beyond it. Set tight thresholds.

Otherwise, the burning gorge is right below.​​​​​​​​​​​​​​​​

My thoughts on a Money.ca news article by Romana King

This is via bond yield fluctuations driven by geopolitical uncertainty, passed directly into fixed-rate lending.

Office of the Superintendent of Financial Institutions Canada (OSFI) Guideline B-12 recommends dynamic interest rate risk models for exactly this scenario. But are board-level risk appetite statements are keeping pace?

Most risk statements are reviewed annually whereas the markets moved in days.

If your lending risk statement still reads as a point estimate anchored to stable conditions, this is your immediate signal to revisit it.