In a recent LinkedIn post, I posed what I believe is one of the most important questions facing the risk management and internal audit professions today. If risk is defined in ISO 31000 as "the effect of uncertainty on objectives," why don't both professions begin with an organization's Mission Critical Objectives? It seems like an obvious place to start. Yet in most organizations, it isn't.
Australian financial institutions may soon find themselves under stricter governance expectations, but with fewer forms to file. The Australian Prudential Regulation Authority released the latest draft of its overhauled governance standard, moving into the final stage of a review that has occupied the regulator for more than a year and generated extensive debate across banking, insurance and superannuation.
In a recent LinkedIn post, I argued that the biggest barrier to effective governance is not technology, cost, standards, or even board interest. It is management's reluctance to provide boards with reliable information on uncertainty and performance linked to Mission Critical Objectives (MCOs), combined with boards' reluctance to insist on receiving that information. The reaction to that post reinforced my belief that this issue sits at the center of one of the most important, and least discussed, governance challenges facing organizations today.
BP recently announced that Albert Manifold was out as Chair and Director after the board raised what it called “serious concerns” related to governance standards, oversight, and conduct. The board’s decision, BP said, was unanimous.
The European Securities and Markets Authority (ESMA) published its annual review of corporate reporting enforcement activity across the European Economic Area, offering a snapshot of how national regulators supervised financial, sustainability, and digital reporting throughout 2025, which was a year that marked a turning point for ESG disclosures in Europe.
There is a definition of risk that most organizations readily cite but far fewer truly operationalize. It comes from ISO 31000 and is echoed in frameworks developed by COSO. Risk, in its simplest and most useful form, is the effect of uncertainty on objectives.
Corporate governance has not failed because of a lack of rules. It has failed because it has lost sight of its purpose. That is the central argument of my new book, Mission Critical Governance: Focusing Management and Boards on What Matters Most, a work shaped by decades of experience and a growing recognition that modern governance systems are not delivering what boards, investors, and society now expect.