Risk response often doesn’t match the threat or the opportunity

Risk is rising in business environments, but response to risk isn’t rising in kind, according to a long-running annual report produced by the AICPA and the Enterprise Risk Management (ERM) Initiative at North Carolina State University.

Nearly 7 in 10 (69%) of the 331 senior executives and board-level leaders surveyed for the 17th edition of The State of Risk Oversight said the volume and complexity of risks have increased over the past five years, up from 61% in last year’s survey, and 74% reported experiencing a significant operational surprise over the same time period.

However, just 30% rated their organization’s overall risk oversight as mature or robust, down from 32% the prior year.

“The business environment is changing faster than most organizations can adapt,” Tom Hood, CPA/CITP, CGMA, executive vice president–Business Growth and Engagement at the Association of International Certified Professional Accountants, said in a news release. “Leaders today are navigating geopolitical uncertainty, technological disruption, cyber threats, talent challenges, and economic volatility simultaneously. The organizations that will thrive are those that move beyond viewing risk management as a compliance exercise and instead use risk insights to inform strategy, strengthen resilience, and create long-term value.”

While 43% said they consider existing risk exposures when evaluating possible new strategic initiatives, only 11% said their organization’s risk management process provides a unique strategic or competitive advantage.

“One of the most important findings from this year’s study is that awareness of risk is high, but strategic integration remains limited,” Mark Beasley, CPA, Ph.D., director of the ERM Initiative, said in the news release. “Organizations are clearly recognizing that risks are becoming more interconnected and disruptive. The next step is ensuring risk management is embedded in strategic planning, resource allocation, and boardroom discussions. Those that accomplish that shift will be better positioned to anticipate disruption, respond with agility, and build sustainable competitive advantage.”

The report highlighted increasing expectations from boards, audit committees, regulators, and other stakeholders for greater executive engagement in risk oversight. The report posed 10 questions that can spur leaders to critically evaluate and enhance their organization’s approach to risk oversight.

— To comment on this article or to suggest an idea for another article, contact Bryan Strickland at Bryan.Strickland@aicpa-cima.com.