Wipfli: Leaders must rethink risk management as AI, cyber and operational risks converge

Resilience starts with understanding critical services

To put that approach into practice, leaders can map a critical business service end-to-end to identify dependencies that could undermine resilience, slow decisions or impede growth. The exercise identifies who owns the service; which people, processes, technologies, vendors and data support it; where decisions escalate; and what must continue during a disruption.

That focus on keeping critical services running also requires preparation for cyber disruption. Jeff Olejnik, partner and cybersecurity leader at Wipfli, encouraged organizations to build and rehearse incident response plans before a crisis.

AI is creating new opportunities and new risks

Employees' independent use of AI tools is creating a governance challenge for organizations, panelists said. While AI can improve efficiency and support innovation, employees may use tools outside established approval processes and enter confidential or personally identifiable information without understanding how it will be handled. That disconnect can expose organizations to security, privacy and compliance risks.

Matt Sabo, director of Wipfli's AI Center of Excellence, emphasized defining the business outcome and how success will be measured before building an AI solution. "A successful AI implementation starts with a good business strategy." Panelists recommended measuring business outcomes rather than adoption alone, with approved AI tools and clear acceptable use policies providing the oversight needed to support innovation.

Waiting to modernize also carries risk, cautioned Tom Loring, a Wipfli partner specializing in IT auditing and information security. He encouraged leaders to weigh the risks of delay against their strategic goals and intended business outcomes, then use their risk tolerance to guide pilots or phased rollouts while maintaining foundational safeguards. "The strategy should drive the decisions about which risks the organization needs to manage."

AI also has a role in defending against cyberthreats, Olejnik emphasized. "AI needs to be used as part of your defense mechanism so that you can respond at machine speed and not at human speed."

Governance should enable faster decisions

Rather than adding layers of oversight, organizations should focus on improving decision-making clarity, according to the panel.

"The goal is not more governance for its own sake," Connell said. She emphasized that organizations already feeling the strain of additional oversight need clarity about who participates in decisions, what information matters, who has authority to act and when issues must be escalated. With those elements established, risk management can support faster decisions instead of adding friction.

For major initiatives, that clarity means aligning technology, risk, compliance and business operations around shared objectives, defined responsibilities and decision rights. Clear accountability connects those functions rather than leaving each to manage risk independently.

Practical steps organizations can take now

Panelists recommended four priorities for the next 90 days:

• Validate critical data: Review the five performance reports leaders rely on most, confirm data sources and agree on metric definitions.
  
  
• Strengthen cybersecurity: Put baseline controls in place — multifactor authentication, advanced endpoint detection, employee training and tested backups. If those controls already exist, validate them through penetration testing and social engineering exercises.
  
  
• Review critical business processes: Identify what could prevent major initiatives from succeeding and involve the right parts of the organization before problems arise.
  
  
• Keep strategy at the core: Align risk tolerance and planning discussions with business objectives.

The goal is resilience that protects against disruption while enabling organizations to innovate, grow and respond confidently to change.

Watch the webinar on demand

For a deeper look at identifying cross-functional risk, preparing for cyber disruption and aligning AI initiatives with business strategy, watch Wipfli's on-demand webinar, Balancing Risk, Resilience and Growth.

About Wipfli

Wipfli is a leading national advisory and accounting firm with nearly 100 years of serving ambitious middle-market organizations. We understand our clients' unique challenges and help them succeed on their terms through assurance, tax, advisory, outsourcing and technology services. With 2,900+ associates and global alliances, we combine national capabilities with local relationships. Wipfli operates under an alternative practice structure: Wipfli LLP, a licensed CPA firm, provides attest services, while Wipfli Advisory LLC, a non-CPA firm, delivers business advisory and non-attest services. Learn more at wipfli.com or contact Alicia O'Connell at [email protected]. 

Media Contact

Alicia O'Connell

[email protected]

SOURCE Wipfli