Call us now:
Well worth a read from Stanford University. Examining the effects of regulatory compliance and fines on Corporate Governance and on changing management behaviour, and ‘how companies may find it more profitable to misbehave and suffer penalties rather than follow the rules’.
A paper one should consider when examining the role of cyber regulation and corporate governance. As nation-states look to regulate cybersecurity risk management. It examines the balancing act governments and corporates play when it comes to regulatory compliance and fines. Set fines too low and they become a cost of business, set them too high and companies go out of business.
The paper offers alternative strategies. Such as the voluntary reporting of bad behaviour. Or detecting corporate misconduct early through ex-ante rather than ex post oversight of corporates. Methods adopted against significant banks that undergo SREP audits by regulators under Basel II. Or EU NIS 2, cyber regulation, which defines Ex-Ante or Ex-Post oversight of Essential and Important Entities. Giving EU member states the leverage to evaluate the cyber compliance of covered entities upfront, rather than waiting for a compliance failure. Addressing the ‘Russian Roulette’ syndrome, of it won’t happen to me.
As in the case of an ex-ante, you never know when it will happen, you can spin the wheel and hope. If you fail an assessment, you don’t have to be fined; you can be given time to fix the issues. As is the case with the SEC final rule, all market participants will know you failed and take their own action. Actions that could include pushing for management to be sacked, higher insurance premiums, shorting stock, or changing suppliers (CMMC).
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Georgios Alevras
Veritas GRC
#cybersecurity #corporategovernance
https://lnkd.in/ePQzzmSa
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7369710922245877760