Case studies are a great way to learn about risk and control frameworks. They show what happens when governance is weak, controls break down, accountability is absent, and warning signs go unrecognised. Although each case is different, they tend to share similar root causes. They are a useful tool for risk professionals to learn practical lessons on how to improve control frameworks, strengthen oversight, and respond to warning signs.
For risk and compliance folks, these are more than just stories from the past. They are a clear reminder of why clear frameworks, good governance, and an ethical culture matter day to day.
Enron: a failure of controls and governance
Enron remains a classic example of corporate failure in governance and controls. The company's collapse was a textbook case of weak internal controls (in place but not properly applied), a complete lack of board oversight, poor information flow, and an inability to respond to problems when they arose.
A key lesson from Enron is that controls on paper are not enough. They had structures, committees, and reports, but that didn't create discipline or transparency. In practice, they hid risks, painted a false picture of performance, and avoided scrutiny. To make controls work, you need to test them or walk through them. A risk professional, for instance, could pick a fairly recent transaction and walk it through the approval process to check that the appropriate controls were in place, rather than relying on a checklist or a policy document.
Lehman Brothers: liquidity and systemic risk
Lehman Brothers is another example of a very different kind of failure, one driven by excessive debt, poor cash management, inadequate stress testing, and a complete lack of oversight.
The key lesson from Lehman is that risk frameworks have to show not just the current risk, but how that risk might change under stress. A business can appear sound in normal times and yet collapse rapidly if funding dries up or market confidence is lost.
Common lessons across failures
Even though Enron and Lehman were very different, there are some common lessons:
- Control frameworks have to be live and operating, not just documented.
- Board and senior management oversight must be active and informed.
- Risk reporting must be timely, accurate and complete.
- Culture can override the controls if the incentives are misaligned.
- Organisations must take escalation very seriously when the red flags are there.
These lessons apply to every sector, not only large financial firms. In healthcare, for instance, poor controls over patient data or medication management can lead to serious safety incidents or information breaches. The consequences can be severe for both reputation and operations. Any organisation that lacks strong controls, puts off fixing problems, or tolerates bad behaviour will fail.
What reform usually looks like
Big control failures invariably lead to change. Following Enron, there was real attention on internal controls, corporate governance, audit independence and financial reporting. After Lehman, the focus shifted to capital, liquidity, stress testing, systemic risk, and better supervision.
The wider picture is that failures tend to expose problems we didn't see before. The reforms are intended to plug the gaps that the crisis has revealed.
Practical takeaway for professionals
The real value of a case study is in enabling people to think differently about how they go about designing and checking controls. The real value is in the framework it provides. A good framework will ask the right questions.
- Are controls actually working?
- Does management get reliable information?
- Are risks increasing any faster than our governance can keep up?
- Would the organisation be able to survive stress (not just the day-to-day running of the business)?
These questions are about taking lessons from failure and turning them into better habits and greater discipline every day. A sensible next step is to review a recent incident in your own organisation, or pick a key control and review it this week. A simple walkthrough or review can expose gaps and put those lessons into action straight away.
Closing perspective
Case studies such as Enron and Lehman Brothers demonstrate that risk and control failures don't just happen overnight. They tend to result from a slow build-up through poor oversight, poor challenge, a lack of transparency, and a culture that happily allows risk to rise to an unacceptable level. For anyone in risk, compliance, audit, or governance, the takeaway is simple: a framework is only as good as it is in reality; it's only as good as it's actually tested, and it's only as good as the leaders are in supporting it.