Atlas Devices, Inc. is a publicly traded U.S. technology company that designs and manufactures wearable medical devices. Over the past five years, Atlas has expanded rapidly through acquisitions and now operates across multiple jurisdictions.

The board of directors meets quarterly. Risk oversight is assigned to the audit committee, which receives a short “risk update” slide deck once per year prepared by the CFO. The presentation lists several operational risks but does not rank them, connect them to strategy, or include emerging risks such as cybersecurity, data privacy, or regulatory enforcement exposure.

Atlas does not have a formal enterprise risk management (ERM) program. Senior leadership has discussed ERM in the past but decided it would be “too bureaucratic” and that existing internal controls and insurance coverage were sufficient.

Two years ago, Atlas experienced a significant data breach involving patient health information. Management disclosed the breach but characterized it as immaterial and did not update the board’s risk materials. No changes were made to risk reporting or governance structure following the incident.

Last year, Atlas entered into a major government investigation related to data privacy and device safety practices. The investigation resulted in substantial fines, remediation costs, and a sharp decline in stock price. Shareholders have now brought a derivative action against the board alleging failure of oversight.