Organisations are operating in a risk environment that has become more volatile, interconnected and difficult to predict, a report by the AICPA and North Carolina State University’s Enterprise Risk Management revealed.
The 2026 State of Risk Oversight: An Overview of Enterprise Risk Management Practices draws on responses from 331 executives.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
Nearly 69% of respondents said that the number and complexity of risks facing their organisations had risen over the past five years.
The survey found that 74% of executives had encountered a significant operational surprise during the last five-year period.
Geopolitical uncertainty was also affecting business models or strategic programmes for 72% of respondents.
Despite these pressures, only 30% characterised their organisation’s risk oversight arrangements as mature or robust.
Just 29% said risk appetite had been formally defined as part of strategic planning, while 22% reported that their risk-management approach explicitly required leaders to consider risks five to ten years ahead.
The report noted that boards, audit committees, regulators and other stakeholders are placing greater demands on executives to take a more active role in risk oversight.
In response, more organisations are appointing chief risk officers, creating management-level risk committees and clarifying board-level responsibilities.
However, informal conversations continue to play a larger role than data-led reporting in many organisations’ strategic risk decisions.
The findings indicate a widening gap between growing exposure to risk and organisations’ ability to turn risk intelligence into stronger business decisions.
Although governance and oversight structures have expanded, the report found that risk management remains centred on operational and compliance issues rather than developing strategic threats.
AICPA and CIMA Business Engagement & Growth executive vice-president Tom Hood said: “The business environment is changing faster than most organisations can adapt.
“Leaders today are navigating geopolitical uncertainty, technological disruption, cyber threats, talent challenges and economic volatility simultaneously.
“The organisations that will thrive are those that move beyond viewing risk management as a compliance exercise and instead use risk insights to inform strategy, strengthen resilience and create long-term value.”
