Four regulatory fronts simultaneously, DORA, the revised Data Protection Act, FINMA’s focus on the entire supply chain, and the CSRD are impacting an industry that otherwise calculates risk with precision but all too often puts off addressing its own compliance efforts. Guest author Thomas Schubert explains why siloed thinking between Legal, IT, and Risk Management actually becomes a risk driver, and how “test once, comply many” and continuous control monitoring can turn a cost burden into a competitive advantage. After all, culture follows structure, not the other way around.
The storm isn’t passing. It’s intensifying.
For decades, insurers have been calculating storm damage with precision: wind speed, probability of occurrence, and extent of damage. All of this is captured in models and factored into premiums. Yet when it comes to its own regulatory storm, the industry surprisingly often looks out the window and hopes it will pass someone else by.
For insurers and brokers, governance, risk, and compliance have long served as a safeguard against fines. It was a cost center managed by specialists whom no one invited into the boardroom unless something had gone wrong.
Not because GRC has suddenly become more attractive, but because the external forces affecting the industry have multiplied in just a few years. Anyone who still operates reactively today is no longer managing risk, risk is managing them.
It’s time to set out on the journey toward freedom from silos!
The proof from the market: Four fronts at once
The regulatory burden facing insurers and brokers today is unprecedented.
As of January 2025, DORA also applies to insurance companies with EU ties and to ICT service providers serving the European financial market. The regulation requires comprehensive third-party management, regular resilience tests, and incident reporting that must be implemented within four hours. For a broker with a dozen IT service providers in the background, this is no longer a mere formality.
The revised Data Protection Act has brought personal liability into the boardroom. In cases of intentional violations of the obligations to provide information or disclose data, the executive board and the board of directors are personally liable for fines of up to 250,000 Swiss francs.
This is no longer an abstract business risk. It’s a name on a fine notice.
FINMA has shifted its focus: away from merely verifying outsourcing arrangements, toward the entire supply chain, including subcontractors, and, more recently, toward insider threats as well.
And where the CSRD applies, it requires insurers to conduct a two-part materiality analysis: how their own business impacts the environment, and how climate risks impact their own business. For an industry that has always priced exactly these kinds of risks, this is a paradoxical twist. We know the model. We’ve just never applied it to ourselves.
Four fronts. All at once. None of them will go away if you ignore them.
The GRC Risk: When the Effort Outpaces the Culture
The reflex: new regulations, new team, new checklist. The result is silos that block each other instead of complementing one another. The compliance officer knows the DORA deadlines by heart but has never spoken to the CISO, who manages the actual third-party ICT landscape. Risk management models scenarios that no one on the executive team has ever seen because they disappear into a report that no one reads.
This is “foil therapy” in its most common form: documentation that reassures but accomplishes nothing. And it’s “conformity sleep”, the deceptive feeling of being compliant, perhaps because a certificate hangs on the wall, while the actual processes have long since ceased to align with it. The gears no longer mesh with one another.
The greater danger lies in the corporate culture itself. “The fish stinks from the head down” (Erasmus of Rotterdam).
Anyone who has experienced GRC as an obstacle for years will continue to treat it as such, even if leadership officially calls for a cultural shift. Employees do not report incidents because they fear consequences rather than expecting support.
Executives rubber-stamp reports without asking critical questions because it’s faster that way. That’s what a lack of accountability looks like: no one in the system asking tough questions before the regulatory authority does.
Anyone who thinks this is solely a problem for large insurers is mistaken. Brokers with ten or twenty employees bear the same liability, often without the resources to mitigate it. This is precisely where regulatory panic arises when requirements grow faster than our understanding of them.
The Practical Solution: From Waiting It Out to Taking Control
The answer isn’t more staff. It’s better coordination.
An insurer that treats DORA, DSG, FINMA requirements, and CSRD as separate projects doubles or triples its effort for the same underlying question: Is our company resilient, transparent, and demonstrably secure?
Those who, instead, assign a single control to multiple requirements following the “test once, comply many” principle demonstrably reduce their audit effort by 30 to 70 percent.
“Continuous Control Monitoring” replaces a snapshot with ongoing monitoring. Instead of “sprucing things up” three days before an audit or quarterly report, the system shows at any time whether the controls are actually effective, not just whether they are documented. The “ICS” transforms from a compliance-verification system into an early-warning system. Deviations become visible before they escalate into violations, not after.
Organize the “CMS” in a more structured way. Consolidation, not more audits. This is based on the principle of “test once, comply many.” A single audit demonstrates compliance with multiple regulatory requirements within the management system and covers several regulatory requirements.
“Compliance by Design” integrates compliance directly into projects. It shifts the focus from retroactive error correction to preventive protection. This avoids the risk of errors as well as costly, retroactive adjustments to processes and IT systems.
For brokers who work with numerous third-party providers, this means that cyber hygiene, financial stability, and sanctions list checks occur in real time, not just once a year via a questionnaire.
This is what breaking down silos looks like in practice: The legal department reviews the contract clause with the IT service provider. The IT department monitors response times in the event of an emergency. Risk management looks at the third-party matrix. Only when all three perspectives converge does fragmented coverage become a regulatory lever that builds trust, wins bids, and lowers the cost of capital.
And most importantly: Culture follows structure, not the other way around.
A company that views GRC as an early warning system rather than a retrospective review automatically changes the behavior of its employees. Those who know that reporting a risk is rewarded rather than punished will report it sooner. That’s precisely where it’s decided whether an organization sees the storm coming or only realizes it was there after the roof has already been blown off.
The conclusion: Yes, they do exist!
Insurers and brokers sell security in the face of uncertainty. It’s time for them to apply this principle to themselves before the regulatory authority, the customer, or their own board of directors demands it.
Do you want to finally turn compliance from a cost driver into a competitive advantage?
TURNING REGULATION INTO VALUE!
Thomas Schubert
Mr. #DeedsCountMore
See also: From Saving to Withdrawals: The Digital Evolutionof Retirement Planning
Search:
Sponsors:
