While many companies are still struggling with the bureaucracy of ESG reporting and data protection, a far more dangerous threat is growing in the background: the failure of early risk detection. In their expert article, Prof. Dr. Josef Scherer and Dr. Sascha Seehaus emphasize that governance, resilience, and transformation are no longer "nice-to-have" topics – but have become legally binding cardinal duties for executive bodies and managers.
The article provides alarming insights: thousands of companies lack functioning early warning systems, even though Section 1 of the StaRUG explicitly mandates them by law. Even more alarming: those who negligently ignore worst-case scenarios or delegate GRC responsibilities without ensuring their effectiveness are not only "sailing blindly into crisis" – they are also risking the loss of D&O insurance coverage. Through current case examples – from BayWa and Wirecard to Helma AG – the article shows how control and audit mechanisms are failing in practice. Auditors come under criticism, as do supervisory boards, whose statutory duties are increasingly subject to legal sanctions.
The authors argue that only an intelligent, risk-based governance system – one that takes into account cyber risks, AI risks, and aggregated threats – can ensure long-term organizational resilience. The article also discusses new legal developments, international standards such as ISO 37000, and the growing role of AI in decision-making – along with concrete recommendations for leadership and oversight practice.
The article was originally published in German in the journal "Zeitschrift für das gesamte Insolvenz- und Sanierungsrecht" (ZInsO):
Scherer, J./Seehaus, S. (2025): Duty of Governance with Early Risk Detection, Resilience, and Transformation as a Cardinal Obligation of Executive Bodies and Managers, in: ZInsO (Journal for All Aspects of Insolvency and Restructuring Law), 28th volume, issue 31/2025, July 31, 2025, pp. 1515–1538.
Note: We thank the editorial team of ZInsO for granting permission to publish the article on the RiskNET portal!
