Turning risk intelligence into strategic advantage

Sponsored by AICPA Member Insurance Programs

Mark Beasley, CPA, Ph.D., director of the ERM Initiative at North Carolina State University, joined the Journal of Accountancy podcast to discuss the results of an annual survey and report published in collaboration with the AICPA and CIMA.

The main news from the survey, now in its 17th year: Risks continue to grow in magnitude and complexity, but organizations’ risk management response isn’t always keeping pace.

Organizations have awareness of risks, but many struggle to connect enterprise risk management (ERM) with strategy and decision-making. This episode explores what’s holding risk management back, why scenario planning matters, and how better risk intelligence can become a strategic advantage.

Resource link: The State of Risk Oversight report

What you’ll learn from this episode:

• The job roles of survey respondents, whose answers form the basis of the annual report.
• Why many organizations still struggle to connect ERM to strategy and decision-making.
• How geopolitical uncertainty, AI, and the accelerating pace of change are complicating the risk environment.
• The “surprise factor” to Beasley related to the survey results.
• His opinion on what keeps organizations from adopting more robust approaches such as scenario planning.
• How risk intelligence can help leaders anticipate emerging threats and create strategic advantage.

Play the episode below or read the edited transcript:

— To comment on this episode or to suggest an idea for another episode, contact Neil Amato at Neil.Amato@aicpa-cima.com.

Transcript

Neil Amato: Welcome back to the Journal of Accountancy podcast. Today’s episode focuses on the state of enterprise risk management and an annual survey the AICPA has done with North Carolina State University and the university’s ERM initiative. You’ll hear the conversation with a risk expert right after this sponsor message.

[Sponsor message]

Amato: Our guest for this episode is Mark Beasley, a CPA who is also a professor at North Carolina State University, where he heads up the Enterprise Risk Management Initiative. Mark, we’re glad to have you back on the show. You’re a repeat guest.

We’re going to have you talk about an annual survey that N.C. State and the ERM Initiative have done with the AICPA, the results of which are out now. Again, thanks and glad to have you back on the podcast.

Mark Beasley: I’m glad to be back. Thank you.

Amato: We will get into some of the survey’s takeaways and lessons in just a bit. I thought we’d first start with this, just a little scene-setter. Can you briefly explain the roles of the respondents whose answers are compiled in the survey report, which is called The State of Risk Oversight.

Beasley: Yeah, we’re very fortunate to get feedback and survey participation from executives that are in a number of roles within the organization, but definitely with a large representation, about a third of them, would be in what I would say the CFO/treasury roles in organizations. And then about 20-something percent in the actual chief risk officer role. The rest would be spread across a multitude of different sort of executive-level positions.

We had about 331 participants, and they’re from different industries, mostly U.S., I think 90% roughly. And then different sizes of organization. But just to give a sense for size, about a third had over a billion in revenue. So, small to quite large represented in that.

Amato: That’s a good scene-setter. Thank you for that. What would you say in 2026 is the state of enterprise risk management?

Beasley: One of my takeaways is the executives are definitely recognizing that the environment in which they’re operating is loaded with risk. Overwhelmingly, they’re basically signaling that the volume and complexity of risk continues to increase as they think back over the last few years, that it just seems to them to be a much more challenging environment. And, more realistically, they’re indicating that they’ve actually had to deal with a number of significant operational surprises. One of those triggers, I think that came out in this year’s study is just the geopolitical uncertainty being one of the root causes to just the nature of risk that they’re facing and some of the surprises they’ve had to pivot as things unfold pretty quickly.

So if I were to summarize, I think the awareness of risk is very strong. They sense that it’s a risky environment. I think in today’s environment, there’s less need to try to convince someone that spending time to think about risk management is not a good idea. I think we’ve moved from risk management not being a concept they think that much about to saying, oh, we need to be thinking about it. So I think we’re seeing that awareness that it’s not about do we need to be doing risk management, but more how do we go about it? And they’ve done things to actually put some infrastructure in place. They’ve got risk committees at the management level. They’ve got processes to annually get an idea about the risk on the horizon and to rank order those. And they’re tracking the risks through developing some kind of inventory.

But I think one of the takeaways I have is despite that investment and building out some process to recognize that we need to be doing risk management, there’s still room for improvement that they’re signaling to us that while we’re doing it, we still need to find a way to better connect it to strategy and our decision-making. And I think in some cases, the risk management still has a compliance control feel to it. with less sort of integration into, well, risks are just the other side of my strategy planning because I’m designing strategies because, there are risks out there, and we want to be successful. And so I think that might be some of the key takeaways from what I’m seeing this year.

Amato: And this is, correct me if I’m wrong, is it the 17th annual survey that N.C. State has done with the AICPA?

Beasley: It is. This is the 17th one, which we’re super excited about that partnership over the years.

Amato: So, over those years, yes, the understanding of risk management and the acknowledgement of, hey, this is a risky environment in terms of business, it’s grown. I mean, businesses are flooded with risks today, and they say it’s important. and they are putting in some structure as you mentioned. But is it still kind of ad hoc? Scenario planning is maybe not always put into place? I don’t know. Does that surprise you any that it hasn’t become more structured?

Beasley: To be honest, yes, it does. I do think we’ve seen some improvement and more awareness of risk and the realities of that. And I think things like geopolitical, let me also throw in AI, just that alone is causing people to pause and just the uncertainty and the fast pace of change. I think people feel like things are just moving faster than I can keep up with in some sense. So I think there’s an appreciation for that.

But there’s still a surprise factor for me to think, why aren’t we seeing even greater maturity in risk management approaches in organizations in light of that? I’m in some ways surprised that there’s not a greater embrace in thinking about risk. And I think there are a variety of potential explanations. You know, there’s a reluctance to engage in that kind of scenario planning that I think can provide tremendous value because it’s forcing people to think about the what ifs and come up with strategies before they occur. But the reality of that fast pace that I was talking about, geopolitical change, AI is coming at us faster than we can keep up with, they’re just like, I just need to figure out what I got to do today. Maybe tomorrow I’ll think about it. But thinking about three and five years from now, we don’t have time.

And we see this come through in the data. One of the things we ask is, what are some of the barriers for your organization in making progress in this? And there’s an overwhelming sort of sense of we don’t have time for risk management because we’ve got more important competing priorities. suggesting that I need to be selling widgets, so I don’t have time to think about risk management. So that means they’re not realizing, well, if you thought about risk management, might help you sell more widgets. So, and the other piece is resource constraints. They think it costs a lot of money. And in reality, it probably doesn’t. But that scenario planning piece is more thinking longer out. And they’re like, “I don’t know if we have time for this, and is there value?” That is part of that reluctance. And maybe it leads to some uncomfortable conversations that they just don’t want to have to deal with, to be honest there, too.

Amato: I’m not a chief risk officer, I’m not a CPA, but I definitely feel that I just want to get through this day, this week, and it feels like that’s more common, I think, in a lot of realms. Let’s talk some about the expectations of others around these people making these risk decisions. The survey’s executive summary says boards, audit committees, regulators, and investors “are placing greater demands on senior management for transparency and active engagement in risk management.” Is that pressure in any way leading to changes in approaches to risk?

Beasley: I think it has. I think the fact that the board is turning to a C-suite and saying, we need to understand more how we’re managing risk. We need risk insights and information. And then the board is actually doing things to help it manage it. For example, dedicating, or delegating maybe is the better word, responsibilities for overseeing risk oversight to a committee. Often that’s the audit committee, which I think ties into a lot of our listener audiences because this audience, they’re very engaged often with the audit committee side of things.

Some entities in the regulated industries like banking and insurance, utilities have risk committees. So boards are putting more structure in there. And I do think if we go back over the 17 years of doing this, it’s those kinds of continued sort of pushing from a board or a regulator perspective and other stakeholders that has led to where we do see more of this sort of infrastructure that’s been built in companies to manage risk. So more have adopted some approach to risk management that’s more formalized than ad hoc, although there’s still a lot of ad hoc out there.

Particularly your larger entities and maybe some of your regulated industries have put a more formal cadence into their risk management process where we’re going to talk to our C-suite, we’re going to do either interviews or workshops or surveys to understand what our risks are, what are we doing about them, prioritize those, get the top list and report that to the C-suite, report our top 10 risks to the board on an annual cadence. That process, I think, has improved and that’s partly in response to this growing expectation.

But I think where we’re seeing still room for improvement is, OK, this is all great process and I’m getting good information, here are our top 10 risks. Where I think there’s room for real improvement is how do I use that insight to make a good strategic decision on, OK, here are our top 10 risks and how do I have good conversations with my board and C-suite about what does this mean for us, and how does this affect our strategy planning? How does it affect things like our budget process? What we’re facing ought to inform me on a capital allocation decision. And it’s that part of the puzzle where I think they’re struggling to do that.

Amato: Yeah, that merging with strategy is important and you’d like to see it a little bit more. So we’ve just hit some of the highlights. Obviously, readers of the survey, which will be covered on journalofaccountancy.com, can dig into it more. So what else would you like to share as a closing thought about The State of Risk Oversight report?

Beasley: A couple of things I would guess I would hit on is respondents are telling us that they definitely want to be rethinking their processes, particularly as it relates to business continuity and crisis management. And I think that comes back to three-quarters of them signal that they’d had somewhat to an extensive operational surprise in the last five years.

The reality is they’re experiencing risk events. They’re linking it more to business continuity and getting operations up and running. I guess my message I’d like to get everybody to be thinking about when they think about how their organizations are approaching risk management is, are we narrowing the gap between the realities of risk we’re seeing and feeling and our approach to really proactively anticipating risk?

And the ultimate goal is, I’m not doing risk management for just being good at risk management, but I’m really trying to get intelligence. And if I can be smarter from a risk intelligence perspective, I can use that for my strategic advantage. If I know the intelligence better than my competitor, I can take advantage of that. And so as they try to narrow the gap, one area that I would encourage people to think about is what kinds of risk dominate the conversation? Is it compliance? Is it an operational issue? Maybe it’s an IT issue, which are important. To what extent though are the conversations surrounding risk along strategic risks, emerging risks and things happening external from us, like geopolitical as well as AI, that I can’t control, but I’m going to be impacted by them if I don’t think about them.

And so really to try to make sure enough attention is zooming in on this idea of what is emerging. What is unknown to me right now that if it happened, I would hate to say, we didn’t think about that. That unknown but knowable thing, I want to move to knowable. And that’s the kind of thing I would just encourage people to think about. What is currently unknown that with a little bit of work, I could know. And that would move the dial, I think, a lot.

Amato: I like the theme of risk management is not “an individual contest,” because if you thought of it as a business competitive advantage, oh, it’s like a team sport. We’re competing against someone and competing for a prize, not just trying to keep our heads above water. It’s more offense than defense.

Beasley: Exactly.

Mark, thank you very much. We really appreciate your time and your insights today on the Journal of Accountancy podcast.

Beasley: Thank you for the opportunity to be with you.