raise expectations for security and compliance teams

. Yet many organisations still treat compliance as the finish line. That approach can create blind spots that place operations and long term resilience at risk.

At a recent RANT roundtable, security leaders debated whether compliance is overshadowing risk management, and how organisations can strike a better balance that supports business objectives.

Compliance is a baseline, not the destination

 Too often, organisations focus on passing audits rather than addressing real threats that could disrupt operations.

 Another noted that audits can become a tick box exercise when external teams do not fully understand how the business operates. This exposes a broader tension. Are risk decisions being made in line with business objectives, or are frameworks driving the agenda on their own?

The consensus was clear. Compliance sets minimum standards. 

 and aligns decisions with what matters most to the organisation.

The reality of tooling: clarity before complexity

Many teams still rely on spreadsheets to track risks and evidence compliance. For small environments this can be workable. Scale introduces fragility. 

“All it takes is for someone to delete the Excel,” 

one attendee observed. Others highlighted a disconnect between vendor promises and practical needs. “The dream is sold as one tool,” said a participant, while another added, “Policies can map and do assessments and have action plans, yet we still end up in Excel.”

 are designed to break that cycle by helping teams prioritise risks, document activity and maintain a reliable source of truth — without a heavy IT lift or months-long deployments. With a simple three-step workflow (identify, assess, mitigate), board-ready reporting and all-in-one collaboration, teams can move from spreadsheets to a foundational ERM programme in days, not months.

But tooling alone is never the full story. The roundtable discussion underlined that success starts with clarity of purpose: knowing whether you’re solving for visibility, accountability or alignment with business objectives. Overambitious rollouts that promise instant “full maturity” still tend to disappoint, whereas right-sized implementations that focus on quick, measurable wins create momentum and adoption.

 Decide exactly what you want the tool to achieve, whether that is clearer visibility, stronger accountability or better alignment with business objectives. Then build momentum through gradual, measurable wins.

Uncover the gaps in your risk management strategy and get a tailored recommendation with our 10-question quiz.

Risks don’t wait. Are you ready?

Risk and compliance priorities differ by sector. Some organisations emphasise continuity and operational resilience. Others focus on enabling faster delivery and supporting rapid scaling. The roundtable chair noted that a CISO’s priorities often reflect the organisation’s tolerance for disruption and the pace of its growth strategy.

Participants also highlighted challenges working with auditors who lack full context on the organisation’s business model. When audit expectations diverge from operational realities, security teams can be pulled away from addressing high impact risks. Bridging that gap requires better internal alignment and a shared understanding of what the organisation values most.

Technology alone cannot close the gap between compliance and effective risk management. 

“The business has got to want to be engaged,” one attendee said. Another noted that leaders do not want to be told, “You are doing it wrong.” They want clarity on trade-offs, not roadblocks.

The discussion also surfaced a language problem. Different teams often use different terminology to describe issues, risks and controls. Without a shared vocabulary, assessments do not translate into clear decisions.

When risk is framed in business terms, engagement improves. Leaders want to understand the commercial impact of inaction. They respond to clear evidence of which risks could halt operations, delay high priority initiatives or damage customer trust, and what pragmatic steps will strengthen resilience without slowing delivery.

The roundtable surfaced a set of practical steps that any organisation can apply, regardless of size or sector.


Select a process or unit with clear impact on the business. Map risks and controls, establish a simple reporting rhythm and build from there.


Decide what success looks like. Visibility of risks, better alignment to objectives, faster evidence collection or clearer accountability. Choose tools that serve those outcomes.


Create shared definitions for issues, risks and controls. Align scoring so that assessments convert into clear decisions.


Expect incremental progress. Use phased implementation rather than a big bang approach. Review adoption and impact quarterly.


Focus on exposures that could disrupt operations, delay initiatives or erode trust. Avoid trying to address everything at once.


Frame risk in terms of commercial impact. Present scenarios, trade-offs and measurable improvements to secure ongoing support.


Track time saved, reductions in repeat findings, improvements in closure rates and changes in exposure levels. Sharing progress reinforces momentum.

Participants who reported success described a disciplined focus on outcomes. They resisted making platforms do everything. They agreed success measures upfront. They concentrated on creating a reliable, shared source of truth for risks, controls and evidence. They used data to prioritise action and demonstrate improvement over time.

One attendee summarised the reality well: “Risk is obvious if you have not done the basics.” The message is not to chase complexity. It is to get the fundamentals right, show progress and keep risk aligned with what the business needs most.

Compliance frameworks will continue to evolve. Resilience depends on understanding and managing the risks that matter most. Integrating compliance into a broader risk strategy allows organisations to protect operations, maintain trust and move forward with confidence.

The discussion made one thing clear. Compliance is essential, but it is not the strategy. Focus on fundamentals, build incrementally and keep risk aligned with business objectives. That is where resilience starts.

Ready to transform cyber risk oversight with integrated GRC capabilities? 

 to see how Diligent's platform delivers comprehensive cyber risk intelligence to boards.

From frameworks to fundamentals: rethinking risk in 2026 

This article originally appeared in our December 18th edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

As we close out 2025, I’ve been reflecting on what this year taught us and the word that comes to mind is “unprecedented.” Insights from the Diligent Institute’s research show how directors navigated multiple unprecedented challenges – often simultaneously – while also driving major change. The lessons we learned this year aren’t just a look back. They can be a compass pointing to the directional shifts boards will need to embrace as governance moves into a faster, more AI-enabled era.

Five governance shifts boards must prepare for in 2026

What will change: Boards will move beyond passive reporting and lean into more 

 Predictive analytics and scenario planning will become part of everyday conversations, helping directors navigate volatility before it hits.


Why? Director confidence hit historic lows in 2025. Our 

 conducted in partnership with Corporate Board Member, landed at just 4.8 out of 10, among the lowest since the pandemic. That’s a wake-up call for faster, smarter decision-making. If you’re curious whether sentiment is shifting, our Q4 results will be live by the time this issue hits your inbox. Check them out to see if optimism is making a comeback.

What will change: Dashboards won’t just summarize risks. They’ll surface them within hours, and crisis protocols will kick in during the first 72. AI-powered assurance will scan massive datasets to catch anomalies as they happen, and directors will be able to ask complex questions in plain language and get instant answers. Oversight will move from reacting after the fact to staying ahead of the curve, a fundamental change in risk management.

 7.9 out of 10. Quarterly updates aren’t enough anymore. Boards need early-warning systems and integrated intelligence to keep pace.

3) AI governance moves to the top of the agenda

What will change: Agentic AI is moving fast, from assisting to acting. Boards will need to build AI literacy, test for bias and keep humans in the loop to manage less visible risks.

Why: Two-thirds of directors used AI tools in 2025, but 

, 57% of respondents said their organizations had deployed AI in one or more areas of the business, but only 36% had audited usage.As AI deployment climbs higher on the priority list for 2026, closing this governance gap is critical.

4) Integration becomes a growth essential

What will change: M&A ambitions will stall without tech integration. Boards that prioritize scalable platforms will unlock faster, cleaner transactions and reduce risk during rapid growth periods as integration readiness becomes a board-level KPI.

 conducted in partnership with Wilson Sonsini and NetSuite, found only 4% of organizations had fully integrated GRC and financial systems.

What will change: Board agendas will shift toward forward-looking conversations powered by predictive analytics and cultural insights. Directors will widen their lens beyond financials to include culture and workforce resilience, using anonymized data to spot risks before they surface.

Why: The ability to anticipate, not just react, will define effective governance in 2026. Boards that lean on AI-driven scenario modeling and continuous feedback loops will stay aligned with fast-changing realities.

Turning 2025 board lessons into a 2026 action plan

2026 will reward boards that act, not just react. That means pairing human judgment with AI-driven foresight, embedding continuous assurance and integrating systems for scalability. Governance is moving from static to dynamic – and the boards that thrive will be ready to keep pace.

Check out the full blog on trends shaping governance in 2026.

From risk to strategy: The governance agenda for 2026 

Boardroom confidence surges in final quarter despite tepid 2026 expectations 

After three quarters at a five-year low, director confidence jumped 23 percent in December—yet the outlook for 2026 remains muted. One director's advice: 'Defend and survive.'

America's corporate directors ended 2025 on an unexpectedly optimistic note.

After languishing at a five-year low for three consecutive quarters, the Director Confidence Index—a quarterly poll conducted by Corporate Board Member and Diligent Institute among U.S. public company board members on their sentiment for business—surged 23 percent in December, climbing from 4.9 out of 10 to 6.0 and finally breaking into "Good" territory. 

A better understanding of how tariffs are impacting businesses and the economy, lower interest rates and increased CapEx spending are the most common factors directors shared to explain this rebound. 

“[There’s] an expectation that companies will be able to work through any tariff impacts without significantly raising prices,” explained one director participating in the poll.

It's a remarkable turnaround for a year that tested boardroom resolve. 

Yet even with the late rally, 2025's average confidence level landed at just 5 out of 10—well below 2024's 6.2 average and significantly short of the 6.9 that directors had predicted this time last year.

The 105 directors surveyed December 6-11 overwhelmingly point to one issue that slowed down business this year: tariffs. 

Three quarters cited it as a top contributor to lower-than-expected business conditions, well ahead of any other factor, noting that standard playbooks don’t work when the environment keeps changing.

“No matter how much you try to prepare for the unexpected, you can never truly assess all outcomes,” said one director on the board of a publicly traded tech company. “We did not see the substantial impact the ever-changing tariff environment (much of which was likely unconstitutional) would have on our customers CapEx spending plans.”

“I have never experienced what we are seeing in our industry in my 30+ years,” said one director at a Nasdaq-traded life sciences company. “Pharma/biotech has always been recession-proof and has not been impacted by which party was in power at the time.”

Despite December's surge, directors aren't banking on momentum carrying into the new year. Their forecast for business conditions by this time in 2026 sits at 6.0—essentially flat from today's level.

This is an interesting delta when compared to CEO sentiment. When polled by sister publication Chief Executive the first week of December, 

CEOs said they forecast conditions will improve by

 in 2026, to land at 6.4 out of 10 next December.

Overall, 44 percent of CEOs are optimistic that conditions will improve, vs. 32 percent of board members.

Among those directors who are optimistic, we observe a strong AI focus in their responses, far outpacing macro fears that are atop the list of concerns among directors who expect conditions to deteriorate in 2026. As for those neutral directors, the uncertainty they expect to continue in the year ahead rivals inflation as a key theme.

To navigate 2026 successfully, directors are prioritizing adaptability, deeper engagement and faster learning, recognizing that compounding risks demand boards connect dots more quickly than ever. "Work hard and smart, keep expenses tight, and survive until a rebound comes around," advised one director.

“Defend and survive,” concluded another.

The Director Confidence Index five years later

To mark our fifth year of running the Director Confidence Index, we asked respondents this quarter to reflect on how their roles had shifted since we first fielded this survey at the end of 2020. Directors say they are spending far more time on risk in a “more complex and faster‑moving” environment—cybersecurity, AI, geopolitical shocks, supply‑chain integrity and policy volatility are now routine board agenda items, not edge cases. 

Many describe a shift from “managing the present” to “understanding and planning for the future,” with scenario planning and strategic resilience now core to the role. Several also point to rising scrutiny from activists and a broader investor base, which has widened the mandate from overseeing financial performance to stewarding culture, human capital and corporate character.

Directors repeatedly flag the steep learning curve this entails. In their open‑ended comments, they emphasize the need to be more tech‑savvy on AI and cyber, more fluent in geopolitics and regulation, and more intentional about ongoing education just to remain effective in the boardroom. Committees are “very busy,” topics are broader, and some directors note a clear move away from informal business development toward disciplined governance, succession planning and risk oversight. 

While a minority insist the formal role has not changed, the weight of the written responses is unmistakable: being a director today is more time‑intensive, strategically demanding and consequential than it was in 2020, and possibly than it has ever been. 

Diligent

Blog

From frameworks to fundamentals: rethinking risk in 2026

From risk to strategy: The governance agenda for 2026

Your Data Matters