{"id":5996,"date":"2026-10-26T08:13:25","date_gmt":"2026-10-26T08:13:25","guid":{"rendered":"https:\/\/www.odbms.org\/blog\/?p=5996"},"modified":"2026-10-26T08:28:05","modified_gmt":"2026-10-26T08:28:05","slug":"from-silos-to-assurance-klaus-moosmayer-on-how-boards-can-govern-ai","status":"publish","type":"post","link":"https:\/\/www.odbms.org\/blog\/2026\/10\/from-silos-to-assurance-klaus-moosmayer-on-how-boards-can-govern-ai\/","title":{"rendered":"From Silos to Assurance: Klaus Moosmayer on How Boards Can Govern AI.<\/strong>"},"content":{"rendered":"\n
\n

“Without an integrated assurance system across Governance, Risk Management and Compliance, we will face Babylonian confusion and finger-pointing when something goes wrong.”<\/p>\n\n\n\n

Dr. Klaus Moosmayer, Member of the Supervisory Board, Deutsche Bank AG<\/p>\n<\/blockquote>\n\n\n\n

Q1.<\/strong> Your article (*) says boards receive detailed but fragmented reports from siloed risk, compliance, and crisis functions, and that responsible AI adds to the challenge.<\/strong><\/p>\n\n\n\n

AI touches data privacy, cybersecurity, quality, human rights, third-party risk, and model risk at the same time. Is AI the case that finally makes the siloed approach untenable, or does it only expose problems that were already there? What does a board see differently when it looks at AI through an integrated assurance lens?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>AI exposes long-standing deficiencies in organizations\u2019 siloed approach to assurance. Over recent decades, we have witnessed an explosion in regulation. We started with anti-corruption and antitrust as classical compliance risks, but today boards must also address human rights, export controls, data privacy, cybersecurity, ESG, social-media compliance, AI compliance, quality compliance, and industry-specific standards – for example in banking and pharma – to name just a few. In addition, we have supranational laws, such as those of the EU, and national laws, which in many cases are not identical. Stakeholders also expect companies to adhere to international standards set by institutions such as the UN and OECD, or to adopt ISO compliance standards. Most companies have adopted a \u201cpatching\u201d approach, simply adding one corporate assurance silo next to another, without horizontal alignment on an adequate governance, risk management, and compliance (GRC) system across the company. Such a siloed approach creates assurance gaps and inefficiencies. This is particularly visible in third-party risk management, where each corporate silo insists on its own risk assessments and due-diligence approach. The result can be unacceptable onboarding timelines for suppliers and, as a consequence, circumvention of compliance rules by the business. If this siloed approach is applied to AI, boards and management will not be able to oversee the technology and its implementation responsibly. They will receive different answers on risks and opportunities from IT, the business, legal, risk management, and compliance. Only if these – and other – functions collaborate can the company achieve a reasonable level of assurance without losing speed.<\/p>\n\n\n\n

Q2.<\/strong> You define integrated assurance as one taxonomy and clear accountability across four dimensions: governance, risk management, compliance, and internal controls. Please take those four for AI, one at a time. Who is accountable for a specific AI system? What counts as an AI risk in the enterprise risk taxonomy? Which controls must exist before a system goes live?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>Accountability follows a logical sequence: policy owner, process owner, and system owner. These roles are often not held by the same function, but the responsibilities must be clear. The policy owner for AI is management, with oversight from the board. There must be clarity on how AI is developed – or externally procured – and implemented, following a proper risk assessment and subsequent monitoring and controls in place. Then there is the process owner: the corporate function or business unit that is end-to-end responsible for a business process, for example the procurement organization. The system supporting that process – for example, agentic AI in procurement – may be owned by the process owner or by another unit, such as IT. In a functioning integrated assurance system, the process and system owners must follow the governance process established by the policy owner. That process should mandate a risk assessment of the agentic AI solution for procurement, involving the relevant assurance function – in this case, the third-party risk management team. Depending on the outcome of the risk assessment, the intensity of the monitoring and control framework must be aligned between the process and system owners and the respective assurance functions, here the internal control team and internal audit. As these parties need to work together quickly, a joint taxonomy is indispensable. Is a \u201ccontrol\u201d a self-assessment by the procurement organization or an independent review by internal audit or an external service provider? This crucial question depends on a shared understanding of the risk level of the AI agent that the procurement organization intends to use. Without an integrated assurance system across GRC, we will face Babylonian confusion and finger-pointing when something goes wrong.<\/p>\n\n\n\n

Q3.<\/strong> You describe the integrated assurance function as a “catalyst” that relies on principles-based decision-making and behavioral science rather than over-controlling and over-regulating. AI projects often need answers faster than policy cycles allow. How do you keep principles-based decision-making credible when a product team needs a decision in days? Where is the line between enabling the business and becoming a gatekeeper?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer:<\/strong> It is a matter of give and take. The business must involve the integrated assurance function from the very beginning of the development or decision-making process. This is even more important than in the past, when manual or even automated processes could still be \u201crepaired\u201d at a later stage by adding controls and monitoring. In the age of AI-driven processes, this is no longer possible. However, the assurance function also needs to develop its mindset and capabilities. It is fair to say that risk, compliance, and audit professionals have moved away from \u201cpolicing\u201d or merely \u201ccontrolling\u201d sometimes too far towards becoming \u201cbusiness partners\u201d who see themselves purely as advisers, without the duty to veto a business decision or at least escalate concerns. Neither extreme is sufficient for modern assurance professionals. I like the term \u201cbusiness steward.\u201d It describes someone who is close to the business but assumes responsibility for steering business decisions in a way that ensures they are based on an effective and efficient GRC system. For this to work in an integrated assurance system, specific expertise in the various assurance areas remains necessary. But overall, what is needed is the mindset of an enterprise connector and thoughtful influencer. To be clear, a business steward must also have the stamina to escalate when the business is not listening or is engaging in activities outside the company\u2019s risk appetite – or outside the law. By the way, this concept opens very promising career opportunities for assurance professionals, who often become stuck in corporate expert silos. A true business steward can work in risk and crisis management, compliance, or internal audit; subject-matter expertise can always be added if the right mindset is there.<\/p>\n\n\n\n

THE ROLE AND MINDSET OF BUSINESS STEWARDS WITHIN AN INTEGRATED ASSURANCE MODEL \u2014 Risk & Compliance<\/a><\/p>\n\n\n\n

Q4.<\/strong> In the three-lines model, the first line builds and uses AI, integrated assurance is the second line, and internal audit is the independent third line. AI strains this. The teams that build models hold most of the expertise, auditors may lack it, and systems change after deployment through updates and retraining. What does a workable division of roles look like? <\/strong><\/p>\n\n\n\n

Klaus Moosmayer:<\/strong> I see AI rather as an opportunity for integrated assurance within the three-lines model. The biggest enemy of an integrated approach to GRC is siloed thinking within organizations. Corporate silos protect their policies, budgets – and data. They make it difficult for management and boards to obtain a comprehensive picture of the overall strategic and operational risk situation facing the company. AI does not dilute the responsibilities and accountabilities of business leaders as the first line, risk and compliance functions as the second line, and internal audit as the third line. Rather, AI enables the exchange and analysis of data across the three lines.<\/p>\n\n\n\n

Take third-party risk management as an example. Management owns the responsibility for the third party and holds the relevant information. The risk and compliance functions support the risk-assessment and due-diligence process and store the respective information. Internal audit – or an external provider- conducts independent assurance on the third party and needs the information held by the first and second lines to do its job. Finally, management and the board want a complete picture of the business and risk profile of the third party – at least where it is a critical supplier or service provider. By applying AI-based GRC solutions, we can, for the first time, bring together all relevant information for the purpose required.<\/p>\n\n\n\n

Q5. Many directors do not have a technical AI background. What should a board ask management for, and what would show it is getting real assurance rather than comfort?<\/strong><\/p>\n\n\n\n

You also suggest boards may merge their audit, risk, and sustainability committees into an “audit and assurance committee.” Where should AI oversight sit: in audit, in risk, in a technology committee, or in a dedicated structure? Does the answer change in a heavily supervised industry such as banking?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>Board members themselves need a certain level of AI literacy. That said, not every board member needs to be a \u201ctechie.\u201d Many boards have established technology committees to bundle the expertise needed for their interaction with management. But boards also need members who fully embrace risk-management skills and are not shy about asking fundamental questions. The strength of a board lies in the combined knowledge and experience of all its directors. AI oversight is a classic example of a topic for which assigning responsibility to a single board committee may not be fit for purpose. <\/p>\n\n\n\n

The traditional mandate of an audit committee focuses primarily on financial reporting, audit, and financial controls. If we want the audit committee to address a broader range of assurance topics, we need different member profiles and simply more agenda time and this is already a challenge given the heavy workload audit committees face. In a recent publication, I advocated for more board risk committees, including outside the financial industry, where they are common or even mandatory. However, AI oversight is by nature a cross-functional topic that does not fit neatly into one committee. My advice would therefore be not to confine AI oversight to the technology, audit, or risk committee alone, but to hold more joint sessions of these committees on governance and risk-management questions. And to be clear: the full board cannot excuse itself. It must be engaged through the committees and continuously strengthen its own AI expertise through internal and external training and insights.<\/p>\n\n\n\n

THE BOARD RISK COMMITTEE: GOOD GOVERNANCE FOR VOLATILE TIMES \u2014 Risk & Compliance<\/a><\/p>\n\n\n\n

Q6.<\/strong> You expect pushback on integrated assurance, including from legal departments worried about creating non-privileged information that could be exposed in discovery. With AI, honest documentation of risks, test results, and known limitations is what good governance requires. It is also what a plaintiff or regulator might later read. How do you balance candid internal assessment against legal exposure, and what has worked in practice with legal counsel?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>As a lawyer myself, I understand the concern about disseminating confidential information without clear rules. I also fully embrace that legal risk management is important. However, it is not sufficient for a holistic assessment of the enterprise and reputational risks an organization will inevitably face. Here, too, integrated assurance can help. First, take the lawyers seriously and involve them in assessing AI risks and designing the company\u2019s AI governance. The operating models of legal departments and law firms are themselves undergoing massive transformation through AI, and lawyers often have a much better understanding of the technology than the business may assume. Second, when assessing legal risks – for example, litigation risks where legal privilege is important – do not take the issue \u201caway\u201d from the lawyers. Instead, ask them to involve AI-savvy risk professionals to support the assessment of the associated financial and reputational risks. Such collaboration improves the quality and transparency of the legal risk-management process and is highly valuable for management and boards.<\/p>\n\n\n\n

Q7.<\/strong> AI rules are arriving in different forms: the EU AI Act, sector-specific supervisory expectations, and technical standards. Should a company anchor its AI governance on the strictest applicable regime, on its own principles and risk appetite, or on something else? How do you stop compliance with one regime from becoming a substitute for governing AI well?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>The law is the law. Where it applies – for example, the EU AI Act – you must ensure that your AI governance system complies with it. However, the AI Act itself requires a risk-based approach and is not static. Therefore, my advice is to develop principles through an integrated assurance approach. Bring together business, IT, legal, compliance, behavioural science, HR, audit, and other functions to discuss and propose basic principles for the responsible use of AI, tailored to the specific company and its stakeholders. If these principles are well communicated and kept up to date, they will help in dilemma situations and grey areas where the law is unspecific or silent. This is, of course, no guarantee that everything will go well. But it requires employees and leaders to test a specific challenge against something the company has agreed upon and, ideally, that has become part of its culture and values. To make this work in practice, it is important to provide platforms where these discussions can take place in a structured way. Access to external experts for independent advice should also be part of the toolkit. Another option is formally to establish an AI ethics board with independent external members. This offers opportunities but also carries risks. On the opportunity side, the company can draw on recognised external experts who become familiar with the company over time and bring fresh perspectives. On the risk side, disagreements may arise between the company and its external ethics advisers – and, as has happened at major technology companies, such disagreements can lead to publicly announced resignations and reputational damage. In any case, external expertise is never a substitute for a robust internal AI governance framework based on aligned principles and reflecting applicable law.<\/p>\n\n\n\n

The 4 principles of responsible AI in medicine | World Economic Forum<\/a><\/p>\n\n\n\n

Q8.<\/strong> Most companies will rely on AI built by a small number of outside providers, along with the data, models, and infrastructure behind them. Your article lists supply chain due diligence among the new pressures on boards. How should integrated assurance reach AI the company does not build? What should a board do about dependence on suppliers whose systems it cannot fully inspect? Please answer in general terms, from your experience on boards.<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>Cybersecurity has been a crucial element of effective third-party risk management for years and is mandated by law in some industries. Companies therefore have some experience in screening highly complex technical third-party offerings.<\/p>\n\n\n\n

For AI suppliers, however, we need to distinguish. The due diligence required for an \u201coff-the-shelf\u201d solution from a recognised provider differs from that required for a niche company providing a business-case-specific AI solution. The latter is a real test of whether integrated assurance works. Does the third-party risk management system trigger the involvement of all relevant functions beyond business and IT – for example, specialists in human rights or HR? Boards do not conduct the due diligence themselves. But they must act as stewards of a sound process and challenge management where the system does not allow for a proper risk assessment and the involvement of the experts needed to reach a final decision.<\/p>\n\n\n\n

Q9.<\/strong> How do you know an AI governance framework works? You stress a joint taxonomy and root-cause analysis with internal audit. Beyond “no incident,” which indicators should a board track, and what would convince you that the framework has become a paper exercise?  <\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>The board\u2019s responsibility does not end with enacting a policy on the responsible use of AI. AI governance must move beyond static policy-setting to continuous monitoring. How many high-risk AI applications are in use? How is the risk level of medium-risk applications developing over time? How are shifts in the behaviour of AI agents assessed and addressed? Buzzwords frequently used by management – such as \u201cwe have a human in the loop to monitor this risk\u201d- need to be scrutinized. If the company uses internal audit to provide independent assurance, the audit team must be capable of doing so and may need support from external experts. The board itself must also be professionally equipped to challenge management and continuously monitor developments outside its own company, again using external expertise where necessary.<\/p>\n\n\n\n

Q10.<\/strong> You have held the compliance and ethics seat at Siemens and at Novartis, and now you oversee from a supervisory board. Is there a moment from those years, a decision where you were not sure you had the balance right between control and trust, that you still think about? What did it change in how you work?<\/strong><\/p>\n\n\n\n

Klaus Moosmayer: <\/strong>I often compare a compliance crisis with a highway accident. If you suffer such an accident, you need intensive care on the spot. In compliance terms, this means investigations, sanctions, tight policies, monitoring, and controls. Afterwards comes the often very long period of recovery and rehabilitation. In compliance terms, this is when you need to rebuild trust by focusing on listening, creating psychological safety, and improving the organisation\u2019s culture – without abandoning an efficient and effective GRC system.<\/p>\n\n\n\n

If you do not get this transition right, you will either create compliance fatigue in the organisation or provoke a relapse into darker times. In my experience, managing this transition in a balanced way is the most challenging task for a leader, and I remember many occasions when I was in doubt: Do we still need all these policies and training programmes, or can we relax? Is this new allegation of misconduct a signal of another systemic failure, and have we eased controls too early? Or is it an isolated case?<\/p>\n\n\n\n

What I have learned is that data helps to put things into context – and I do not mean only \u201chard\u201d data from GRC systems and audits. It is crucial to compare system outputs with employee engagement and ethical-culture surveys to detect signals of inconsistency.<\/p>\n\n\n\n

For example, a \u201cgreen\u201d traffic light from internal controls and no reported complaints may contrast sharply with a weak speak-up culture and fear of retaliation. Modern technologies and AI can help make these signals and outliers visible, but human judgement is required to interpret them and act.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Resources<\/strong><\/p>\n\n\n\n

(*) HOW BOARDS CAN BENEFIT FROM AN INTEGRATED ASSURANCE MODEL AND FUNCTION IN CORPORATIONS \u2014 Risk & Compliance<\/a><\/p>\n\n\n\n

……………………………………………………………………<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Dr. Klaus Moosmayer<\/strong><\/p>\n\n\n\n

Klaus Moosmayer is Member of the Supervisory Board of Deutsche Bank AG and serves on the Audit, Risk and Compensation Control Committees. Prior to his appointment in 2025, he was the Chief Ethics, Risk, and Compliance Officer and member of the Executive Committee of Novartis AG. Before joining Novartis in 2018, Klaus Moosmayer was the Chief Compliance Officer of Siemens AG. He began his career after studying law and completing his law doctorate (PhD) at the University of Freiburg i.Br., working as an attorney and criminal defence lawyer.<\/p>\n\n\n\n

Klaus Moosmayer has held leadership and board roles on international platforms of OECD, G20\/B20 and SwissHoldings for many years. At the World Economic Forum (WEF) he co-leads the Global Future Council on Good Governance. He is a member of the Advisory Council of the Corporate Governance Institute at the Frankfurt School of Finance and Management. Recently, Klaus was appointed as member of the newly established Governance, Risk, and Compliance Committee of the Institute of Internal Auditors. <\/p>\n\n\n\n

Klaus Moosmayer has extensively published on ethics, governance, risk management, and compliance and regularly speaks on these topics at international conferences. He is a guest lecturer at the International Anti-Corruption Academy in Laxenburg, Austria and at the Board Centre of the University of St. Gallen, Switzerland.<\/p>\n\n\n\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026…………..<\/p>\n\n\n\n

Follow us on X<\/strong><\/a><\/p>\n\n\n\n

Follow us on LinkedIn<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

“Without an integrated assurance system across Governance, Risk Management and Compliance, we will face Babylonian confusion and finger-pointing when something goes wrong.” Dr. Klaus Moosmayer, Member of the Supervisory Board, Deutsche Bank AG Q1. Your article (*) says boards receive detailed but fragmented reports from siloed risk, compliance, and crisis functions, and that responsible AI adds […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[990,1912,1744,1915,1248,1913,1743,1914,973,1730,1271,1911],"_links":{"self":[{"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/posts\/5996"}],"collection":[{"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/comments?post=5996"}],"version-history":[{"count":9,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/posts\/5996\/revisions"}],"predecessor-version":[{"id":6006,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/posts\/5996\/revisions\/6006"}],"wp:attachment":[{"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/media?parent=5996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/categories?post=5996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.odbms.org\/blog\/wp-json\/wp\/v2\/tags?post=5996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}