Corporate Risk Does Not Ease When Regulation Does

Every cycle of deregulation carries a familiar temptation: to treat a change in regulatory intensity as a change in the underlying level of risk. That assumption can be consequential when markets expand, profits are strong, and political leaders promise a lighter regulatory touch. Confidence can rise faster than the systems designed to test it.

Financial history offers the lesson. The Financial Crisis Inquiry Commission found that the 2008 crisis was avoidable and identified failures in financial regulation, corporate governance, and risk management among the conditions that allowed vulnerabilities to build across the financial system. The Commission found that warnings were ignored and that failures by regulators, financial institutions, and other market participants allowed risks to accumulate before the crisis erupted. 

The current environment has its own complexity. The Securities and Exchange Commission is pursuing a regulatory reform agenda aimed at reducing compliance burdens, facilitating capital formation, and establishing greater clarity around crypto assets, while retaining investor protection safeguards. At the same time, the SEC’s 2026 examination priorities continue to focus on compliance, fraud prevention, and risk monitoring. For companies, the distinction matters. Changes in regulatory policy should prompt careful reassessment of obligations and risks, rather than an assumption that internal standards can remain static. New products create new risks. Companies need to ensure their risk controls evolve with the risks presented by these new products. 

Artificial intelligence and digital assets further complicate that calculation. The SEC has identified emerging technologies, including AI, blockchain, and cybersecurity, as areas requiring attention. Its recent actions around crypto assets illustrate how quickly regulatory expectations can evolve. Corporate leaders must build organizations capable of identifying risks before those risks become enforcement matters, financial losses, or crises of confidence.

Andrew Calamari, a partner at Finn Dixon & Herling and former director of the SEC’s New York Regional Office, has spent decades observing these shifts from both sides of the regulatory divide. His experience has led him to a conclusion he believes corporate leaders should heed: governance should remain disciplined regardless of who occupies the SEC’s leadership.

Calamari argues that consequential governance failures often begin with a subtle expansion of risk appetite. Organizations can become comfortable with a strategy because its returns are attractive, its assumptions appear defensible, and external scrutiny has eased. Over time, whether a risk can be taken can displace the more important question of whether it should be taken.

“In my experience, serious corporate problems rarely begin with an intention to do something wrong,” Calamari says. “They begin when risk appetite expands faster than the controls designed to contain it. Once that happens, manageable weaknesses can compound until they become matters of material consequence.”

That observation carries particular weight when viewed through crises. Calamari points to common patterns across the market disruptions of 2001, 2008, and the present environment. He sees a recurring tendency: periods of opportunity can encourage institutions to discount warning signals precisely when those signals deserve greater attention.

The 2008 crisis offers a stark example. The Commission documented excessive borrowing, failures in risk management, and governance across the financial system. Calamari’s perspective is that the lesson for boards extends beyond any single regulatory failure. When organizations become convinced that favorable conditions will persist, their tolerance for uncertainty can expand.

“Risk management is ultimately a discipline of asking difficult questions when the answers are inconvenient,” he says. “The most important control may be the willingness of a board or executive team to challenge a profitable strategy before the market gives it a reason to do so.”

That discipline becomes more important during regulatory transition. Calamari believes companies should distinguish regulatory requirements from their internal standards. A rule may be revised, enforcement priorities may change, and supervisory resources may be redirected. The exposure created by a weak process remains.

The SEC’s current posture illustrates why that distinction matters. Its 2026 examination priorities call on firms to consider fiduciary duty, standards of conduct, and custody, while also examining emerging risks. The agency says its program promotes compliance, prevents fraud, and monitors risk. Calamari argues regulatory change should trigger reassessment, not complacency.

Calamari believes directors should understand how risk is measured, where controls can fail, and whether management receives timely information about emerging problems. They should examine incentives that reward short-term results while obscuring longer-term exposure. They should ensure that compliance functions have sufficient independence.

AI and crypto make these questions more urgent because technological change can move faster than established governance processes. New products and automated systems can create exposures that traditional controls were never designed to detect. Calamari argues that organizations should integrate compliance and risk assessment into innovation from the outset.

“Good governance cannot be a function of the regulatory cycle,” he says. “If your controls become stronger only when enforcement becomes more aggressive, you have built a system that is responding to the pendulum rather than preparing for it.”

That pendulum is central to Calamari’s view of corporate resilience. Regulatory priorities change. Administrations change. Markets change. History suggests that periods of relaxation can eventually produce renewed scrutiny when risks accumulate or failures become visible. Companies that maintain strong governance throughout the cycle are better positioned to withstand those changes.

In his view, the objective is to build institutions that remain sound when the direction changes. That requires boards willing to challenge assumptions, executives willing to recognize uncomfortable risks, and controls strong enough to function before a regulator arrives.

“The pendulum will always swing,” Calamari says. “The companies that endure are the ones that understand this before it moves.”

Some of the source material for this article may come from external sources. The article has been reviewed by a National Law Review editor. This article may be licensed for reuse.