ESMA’s 2025 Common Supervisory Action identifies structural weaknesses in compliance and internal audit functions. This article explains the findings, their impact on governance and what investment firms should do to strengthen their control framework.