How courts are assigning liability when corporate data or financial security is inadequate—and how a well-designed ERM program provides protection.