MILWAUKEE – November 13, 2026 -- Advisers at Wipfli have set out four enterprise risk priorities for the next 90 days, starting with a check of the five performance reports leaders rely on most. The recommendations come from a Wipfli leadership panel that treats AI adoption, cybersecurity and data risk as one enterprise risk problem rather than separate silos.
The first priority is data: confirm the sources behind those five reports and agree on metric definitions. The second is cybersecurity. Panelists named four baseline controls: multifactor authentication, advanced endpoint detection, employee training and tested backups. Organizations that already have them should validate them through penetration testing and social engineering exercises. The third is a review of critical business processes, to find what could block major initiatives. The fourth is aligning risk tolerance and planning with business objectives.
Panel ties AI governance to a defined business outcome
Employees using AI tools outside approval processes can enter confidential or personally identifiable information without knowing how it will be handled, panelists said. They described the result as a security, privacy and compliance exposure. Their remedy is approved tools and clear acceptable use policies.
Matt Sabo, director of Wipfli's AI Center of Excellence, said teams should define the business outcome and how success will be measured before building an AI solution. Panelists advised measuring outcomes rather than adoption alone. Tom Loring, a Wipfli partner specializing in IT auditing and information security, said leaders should weigh the risk of delay against their strategic goals. He added that risk tolerance should then guide pilots or phased rollouts while foundational safeguards stay in place.
Jeff Olejnik, partner and cybersecurity leader, said AI should also be part of the defense so organizations can respond at machine speed rather than human speed. He urged companies to build and rehearse incident response plans before a crisis.
Wipfli partner says governance should speed decisions, not add layers
"The goal is not more governance for its own sake," said Carrie Connell, partner in Wipfli's risk advisory practice. She said organizations need clarity on who takes part in decisions, which information matters, who has authority to act and when issues escalate. For major initiatives, the panel called for technology, risk, compliance and business operations to share objectives and decision rights.
Wipfli did not provide survey data or incident figures showing how many organizations lack these controls, and it did not give the panel date.