[00:00:00] Speaker A: Hi everyone. In this episode, we'll find out what thousands of SEC filings reveal about the gap between what companies say about ethics and what they can prove. I'm your host, Bill Coffin. Welcome to the Ethicast.
The 2026 proxy season tested boards of directors on several fronts at once.
Legal challenges, political scrutiny, a fragmented voting landscape, and an SEC that is handing responsibility for governance back to boards and management.
Against that backdrop, investors no longer want to know only whether a company says it governs ethics, risk and AI responsibly. They want to know whether it can show it. To find out, Boards of the Future, a US Based nonprofit advancing ethical leadership and integrity at the highest levels of Corporate Power, analyzed 4,766 SEC filings from S&P 500 companies and from the honorees of two major reputation rankings, including Ethisphere's 2026 World's Most Ethical Companies.
The result is the recently released report 2026 Proxy Season Review Ethics, AI Ethics and Risk Disclosures, which shows a steady gap between what companies claim and what they disclose. As proof, 94% of companies claim AI as a risk, but only 40% have assigned a board committee to oversee it.
92% run an enterprise risk management program. Yet just 22% state a risk appetite, and those are concentrated in heavily regulated sectors like financial services.
And while nearly every company calls ethics foundational to its culture, only 1 in 10 reports culture or ethics measurements to its board.
With us today to discuss this report's findings is Boards of the Future Executive Director Vera Charapanova. Vera is also the Chair of the Global Forum for Governance, Risk and Performance at the association of Certified Chartered Accountants, a member of the International Council at Compliance and Business Ethics association of Kazakhstan, and she serves on the steering committee of ComplianceNet. A prolific author and speaker on all aspects of ethics, risk, compliance and governance, her insights have been featured in the Financial Times, Wall Street Journal, Law360 and more. Vera, welcome back to the Ethicast. We're so excited that you could join us once again.
[00:02:21] Speaker B: Hello Bill. Hello everyone. Thank you so much for the second invitation. I'm happy to be back and looking forward to share the key insights from our very recent report.
[00:02:32] Speaker A: Your data suggests that a lot of risk governance exists because a regulator demands it rather than the board. Why is it better to govern risk by your own appetite than by regulatory pressure? And what does a company in a lightly regulated sector lose by waiting to be told what to do?
[00:02:49] Speaker B: That's a great question. To kick this thing off.
Yes, we have found that Much of risk management infrastructure, such as a dedicated risk committee on the board, an articulated risk appetite and a chief risk officer come with regulatory requirements. And their prevalence drops abruptly in sectors where no comparable regulatory regime exists at the aggregate level. As you Already mentioned, only 22% of S&P 500 in our analysis articulated a risk appetite in their disclosures, while 72% of financial institutions did that.
If we slice and dice these three disclosures by industry, surprisingly, tech comes last.
Just hear this. In FS, in financial sector, 89% disclose having a dedicated risk committee on the board. Well, in tech, only 18 and only 8% articulate a risk appetite, which I suppose is quite telling with all this, you know, risk of the extinction of humanity and that kind of story existing in media these days.
So in the US the Dodd Frank act requires large publicly traded financial firms to establish a board level risk committee. And we're hearing rumors that Dodd Frank is next on the chopping black in line with socks and some other big regulatory things. Whatever happens, as you rightly pointed out in your question, it is always better to manage risk by your own defined risk appetite. Why?
Because in the absence of a clearly defined risk appetite, decision making will ultimately be reduced to personal judgment in the moment, which can depend dangerously on inference and subject to bias.
And that leads us to a culture of inconsistent behaviors within the organization, which in turn leads to mistakes and more fragility. And more fragility. I would argue this is the least thing that we want right now when the world is already very fragile. At least it looks like this to me.
So boards really need to consider in full honesty whether they have sufficient time and expertise on their board. And we typically see risk oversight responsibility dumped in the kitchen sink of the board. And I, I use this language maybe a little bit too explicit, but also, you know, conveying the idea for the audit committees. The kitchen sink of the board, they really are kitchen sinks of the board.
So they need to consider in full honesty whether it's enough and whether it's leading to effectiveness in one of the central board governance tasks. And there is much to learn from the financial services industry, I would definitely say so instead of just keeping it there as a special beast, as a special animal. So the risk belongs to only to that industry.
I would rather pull the lessons from there to the broader community.
[00:06:00] Speaker A: That 94 point gap between naming AI as a risk and describing how it's governed is pretty grim.
But the companies that have committed to principles seem to have built the structure to back them up.
What separates that group from everyone else. And what can a company that's still at the warn investors stage learn from them? I mean, your report asks who inside the company can decline an AI use case and does the board know that person's name?
[00:06:24] Speaker B: Why?
[00:06:24] Speaker A: Is that the right place to start?
[00:06:26] Speaker B: You're completely right. Companies that did make substantive responsible AI disclosures generally provided more detailed information on who oversees AI and how. Out of 16016 companies asserting responsible AI principles in their disclosures, only seven did not pair them with some board level oversight language.
So what they did, they named the committee on the board who is charged with the AI governance oversight. They provided some language on the frequency how often they hear updates and insights from management on AI and AI governance. They also named a buddy inside of the company charged with AI governance. And we even found two chief responsible AI officers working in two companies out of 500 cohort, which, which is really low, I would say. I would love to see more people coming to work for this position. They also included the language on who provides the updates to the board from management, whether it's cto, CIO or CISO or chief responsibility officer.
In those two lucky companies, they disclose having a periodic risk assessment or impact assessment in the AI risk space. And they also signaled that they thought about the third party or vendor AI governance. So they included some words about that. So the question of who inside the company can decline an AI use case and does the board know that person's name is a great place to start because it tests several things all at once. First it tests the accountability and the decision rights. Is there a real person who can say no? Or is there a blurred responsibility and some kind of a working group, task force, steering committee or whatever you might call it?
And everything falls in between of legal risk, compliance and business and it can that person really say no? If this is very commercially attractive, is there enough independence? Is there enough guts, so to say? And what happens when that person says no?
How will the situation escalate?
Where will this thing go? Will it go to the CEO? Will it go to the executive team? Or will it go to the board?
So if the board cannot answer this question, it probably understands very little about how AI governance really operates inside of the organization. And by extension, I would say that means there are limited opportunities for the board to exercise an effective AI governance oversight.
[00:09:15] Speaker A: There's a real case for making ethics everyone's job. And the data shows boards are doing exactly that by spreading oversight across committees.
But when ethics and compliance sits with the audit committee alongside a dozen other responsibilities. It seems that it gets described a little less clearly. So how should organizations balance shared ownership against having one clear home for ENC at the board level and inside the company? Like when does something that's shared become something that's diluted?
[00:09:43] Speaker B: Yeah, that's a great question.
Let me explain why I feel uncomfortable here. So we touched upon that already how audit committee became a kitchen sink of the board.
And I argue all the time that we can't stretch them to death and still expect zero impact on the quality of what they do. Right.
So what we found in the report, the ENC oversight responsibility is often distributed among several board committees. 25% said this is audit committee. 24% said it's a non audit committee. And here companies from highly regulated industries like healthcare, for example, even named a dedicated compliance committee. 29% said both. 18% at the same time said they charge their responsibility to the full board. All of this can be perfectly fine, but the problem is that we don't have clarity in those disclosures. To give you the idea of how it looks when we say that we found a disclosure saying the audit committee is charged with ENC oversight, it it looks like a long list of bullet points with one of them saying ENC oversight.
So. And the same goes for the non audit committee. So when we see both types of committees having a generic ENC oversight listed as one of the responsibilities, that doesn't give any comfort or clarity at all. On the contrary, it gives me discomfort because it looks like they don't have defined roles and responsibilities which may be creating problems with issues falling through the cracks.
That's why I'm saying it's perfectly normal to have certain roles and responsibilities distributed across the committees and the full board. That it should be clearly articulated. Something like full board is charged with looking at the intersection of strategy and strategic initiatives and ethical risk.
Audit committee is charged with looking at the internal audit reports which include the evaluation of the effectiveness of ethics and compliance program.
Risk committee looks into the ethical risk and risk appetite and risk tolerances and how these two things are compatible or not. Compensation committee makes sure ethical considerations are included in the KPIs of the CEO and senior executives and is involved into the assessment of those KPIs. Non gov committee ensures directors on the board have ethical acumen and ensures that the skill matrices for board directors include ethics as a competence, an area of expertise that should be on the board. So you see what I mean? It's absolutely fine that there is some specialty and that specialty creates the need to spread the ethics and compliance oversight across several subsets of the board. But we need to have clarity to be able to say, yes, we know that they are on this thing because they know who does what.
[00:12:51] Speaker A: If you could get boards to start reporting one piece of evidence that their culture and ethics program actually works, what would it be and why? And with disclosure rules getting looser, what reason does a company have to volunteer it?
[00:13:05] Speaker B: Well, there are two big and very important parts in this question. The first one, I would say it's hard for me to choose one. But if I'm really constrained and if I really have only one to choose, that would probably be something around whistleblowers, that would probably be something around substantiated cases and the thing that followed the action that followed. Because I think it gives the investors and the outsiders something much closer to evidence of whether the system or ethics and compliance program actually has teeth.
Preferably a case when the individual named in the report had some senior ranking. Because it even gives you more idea of how much of teeth that program actually has.
On the second part of the question, my argument here is less virtue based and more economic based or governance based.
I tend to think that a less prescriptive disclosure regime arguably makes good voluntary disclosure more valuable. So there's a lot more opportunity to stand out. If a company really wants to stand out, when everyone is no longer forced to complete the same checklist, they have more opportunity to tell investors what actually matters for them.
And it's much closer to how I see the risk management in itself. I tend to say all the time that risk management is something like risk finger.
Every company has something like a risk fingerprint. You know, this is us, this is our universe, and these are our risks and these are our touch points. With these risks, we, because we are unique in our business model, customer base leadership at this point of time, and so on and so forth. So the risk fingerprint, and this is how we work with this unique thing. So I feel that voluntary disclosures make more space exactly for that.
And there is a huge opportunity to seize.
Being very specific and actually Chairman Atkins himself pointed that out many, many times that instead of having generic boilerplate, he would rather see a more company specific disclosure. This is exactly the opportunity here that I see for the volunteers who were there and who would really see that opportunity to seize.
[00:15:35] Speaker A: Vera, thank you so much for sharing your insights with us today. Also, thanks for the work that you're doing to put ethics and compliance on the radar of directors and decision makers everywhere.
[00:15:44] Speaker B: Thank you. Thank you. I take this accolade willingly and thank you so much for having me.
I hope it was helpful and useful for the listeners.
[00:15:55] Speaker A: To get your free copy of 2026 Proxy Season Review Ethics, AI Ethics and Risk Disclosures, visit newboards.org you can also connect with Vera directly on LinkedIn. We'll have the links for both of those in this episode's show notes and for additional free resources on board governance and ethics, visit the Ethisphere resource
[email protected] resources thanks for joining us. We hope you've enjoyed the show. For new episodes each week, be sure to subscribe to us on YouTube, Apple Podcasts and Spotify. And if you haven't already, please follow at the sphere on LinkedIn to learn more about how we help organizations measure and improve their ethics and compliance programs. Together we can make the world a better place by advancing business integrity.
That's all for now, but until next time, remember, strong ethics is good business.
