Government rarely moves first on anything, which is what makes the current change at FedRAMP worth attention. The Federal Risk and Authorization Management Program is the seal that lets cloud providers sell to federal agencies, and for years it has been synonymous with a particular way of proving security: a very large stack of documents, assessed once, and revisited on an annual cadence.
Every risk discipline carries a habit that outlives its usefulness. In third-party risk management, that habit is the self-attested questionnaire. It is the artifact the whole practice is organized around. A relationship begins, a security questionnaire goes out, the vendor returns a few hundred answers, an analyst reviews them, and the file is closed until next year's cycle. The ritual is so established that it is easy to forget it was built for a smaller, slower, more stable world than the one we operate in now
Risk is an ever-present feature of enterprise operations. Whether it manifests as operational disruption, regulatory change, strategic misalignment, or the volatility of emerging threats, risk is embedded in the daily conduct of business. Yet it is not the presence of risk that should concern us most, but the way in which it is understood, managed, and integrated into the lifeblood of planning and decision-making.
In 2025, the balance between risk and reward became materially more consequential. Advances in AI, rising expectations for operational resilience, and intensifying regulatory scrutiny reshaped executive agendas and exposed the limits of reactive risk management. Some organizations adapted quickly, using governance, risk, compliance, ethics, and learning to move faster with confidence. Others struggled to keep pace.
This report examines employee perceptions of corporate compliance programs across four countries: the United States, Canada, Germany, and France. Based on survey responses from more than 800 employees across multiple industries, the findings offer a cross-national view of how compliance programs are understood, implemented, and supported, including the growing role of AI.
SAI360’s latest white paper uses the January 31, 2025 Barclays outage as a clear reminder that digital service failures can rapidly escalate into financial disruption and lasting reputational harm
NAVEX partnered with The Harris Poll to survey nearly 1,000 risk and compliance professionals globally about their R&C programs. The survey was conducted between April-May 2025, representing professionals from various industries and organization sizes globally