A recent study conducted by the American Institute of CPAs (AICPA), in collaboration with North Carolina State University’s Enterprise Risk Management (ERM) Initiative, has revealed that a mere 11% of senior finance executives perceive their organisation’s risk management processes as “mostly” or “extensively” serving as a strategic tool that offers a competitive edge.

In contrast, 64% of respondents believe that these processes provide little to no advantage.

The report highlights that 61% of finance leaders acknowledge a significant shift in the volume and complexity of risks over the past five years.

Despite this awareness, only 35% of organisations report having comprehensive ERM practices in place, and just 32% assess their overall risk oversight as “mature” or “robust.” These figures show minimal change compared to the previous year.

The evolving risk landscape includes various factors such as economic uncertainties, inflation, geopolitical issues affecting trade and supply chains, advancements in technology and AI, as well as cyber and privacy threats.

These elements are contributing to substantial disruptions that can affect an organisation’s business model and strategic planning.

The findings are part of the 2025 State of Risk Oversight: An Overview of Enterprise Risk Management Practices report, which stems from a 16-year partnership between the AICPA and North Carolina State University’s ERM Initiative.

The report is based on a survey of 273 US organisations, specifically targeting CFOs and senior finance leaders, conducted in Spring 2025.

To improve risk management approaches, executives and boards must first identify cultural factors that may impede progress.

The report identifies competing priorities and insufficient resources (both at 41%) as the primary barriers, along with a perceived lack of value in risk management efforts (29%).

Additional insights from the report indicate that nearly half (45%) of organisations have appointed a chief risk officer or a senior risk executive equivalent.

However, the frequency with which management communicates risk exposure to the board of directors varies, with 57% reporting top risks to the board. Only 27% of executives believe that their ERM process would aid in identifying and managing a significant risk event that could affect their organisation’s reputation and brand.

AICPA and CIMA Business Growth and Engagement executive vice-president Tom Hood said: “In today’s business landscape, defined by uncertainty, disruption, innovation, and constant change, organisations must move beyond reactive risk management and embrace a proactive, enterprise-wide approach.

“The pace of change demands resilience not just as a concept, but as a capability embedded throughout the organisation.”