Report Reveals Risk Management Processes in U.S. Organizations Continue to be Outpaced by Growing Risks

Media Contacts:
Suzanne Stanard
NC State University
919.264.4998
sjstanar@ncsu.edu

Bill Ferguson
AICPA & CIMA
919.402.4610
bill.ferguson@aicpa-cima.com

NEW YORK (July 11, 2023) – A new report issued today by the Association of International Certified Professional Accountants representing AICPA & CIMA and North Carolina State University’s Enterprise Risk Management (ERM) Initiative found that 65% of senior finance leaders agree that the volume and complexity of corporate risks have changed “mostly” or “extensively” over the last five years. Despite this, only a third (34%) say their organizations have complete enterprise risk management (ERM) processes in place, and just over a quarter (29%) rate their organization’s overall risk management oversight as “mature” or “robust.” These findings are unchanged from a year ago.

Rapidly changing events, including concerns about the economy and inflation, geopolitical developments impacting trade and supply chains, disruptive technologies and AI, cyber and privacy threats, and a host of other risk triggers are continuing to drive significant disruptions that impact an organization’s business model. Despite these unfolding realities, most organizations continue to not have robust ERM practices in place.

The 2023 State of Risk Oversight: An Overview of Enterprise Risk Management Practices includes insights from a survey of 454 U.S. CFOs and senior finance leaders conducted in winter 2023. The survey measured finance-related executives’ assessments of the level of maturity in their organization’s proactive management of these risks through adoption of ERM processes.

“Our study finds that organizations of all types and sizes continue to overlook an important reality that risks can emerge rapidly, triggering a cascade of events that quickly derail the organization’s strategic goals,” says Mark Beasley, Alan T. Dickson Distinguished Professor and Director of the ERM Initiative at NC State. “Organizations that invest in robust risk oversight processes that explicitly link risk insights to strategies increase their nimbleness and agility, which can provide huge strategic advantage if done so better than their competitors.”

The report did find indication, however, that adoption of ERM processes in the U.S. is on the rise. Over the last 13 years, the percentage of organizations that claim to have complete ERM processes in place has increased 25 points, from 9% to 34%, but that still suggests most entities do not. This finding, also unchanged from last year’s report, again highlights the emphasis that more ERM focus is needed. Given the ongoing experience in navigating the multitude of risks experienced over recent years, more organizations will likely want to further enhance their focus on efforts to strengthen their entity’s approach to managing the interconnected nature of risks to their business models.

Additional key findings from the report include:

• Most executives do not believe their organization’s risk management processes provide strategic advantage (64% state no or minimal advantage), with less than half (40%) positioning risk management significantly to pinpoint emerging strategic risks.
• The frequency at which management shares risk exposure with the boards of directors varies with 43% reporting top risks to the board on an annual basis, followed by reporting on a quarterly basis (41%). Only 16% of organizations report top risk exposures to the board at every board meeting.

“We can safely predict that disruption is the norm and will continue to create new and exacerbate ongoing risk triggers. It’s the preparedness and the speed of response that determines how businesses manage these situations that matters most to stakeholders. A solid risk management plan allows organizations to continue delivering critical products and services in the face of an unplanned incident or crisis,” says Ash Noah, CPA, CGMA, Vice President and Managing Director Learning Education and Development at the Association of International Certified Professional Accountants. “That reality of disruptions and this research reinforces the need for enterprise risk management to be amplified in the list of priorities for CFOs. Value in the business is beyond the balance sheet these days and along with providing protection for the business, embracing ERM supports the creation and preservation of value and the long-term viability of the business.”

The report also includes several calls for action to help executives and boards identify actions they can take to enhance the strategic value of their risk oversight. These questions are just a sampling of the kinds of issues senior executives and boards of directors should consider as they evaluate the robustness of their entity’s approach to managing a rapidly evolving portfolio of risks:

• ­What are management’s perceptions about the current approach to risk management?
• Is there consensus about the most significant enterprise risks?
• How is the output from risk management used in strategic planning?
• Does management have access to robust key risk indicators?
• Is our entity sufficiently prepared to manage a significant risk event?

The full report can be found on both the AICPA and NC State websites.

NC State’s ERM Initiative has a breadth of tools and resources to help executives through its searchable ERM Library and offers a number of executive learning opportunities and events.

Methodology

The 2023 State of Risk Oversight: An Overview of Enterprise Risk Management Practices includes data collected during the winter of 2023 through an online survey sent to members of the AICPA’s Business and Industry group who serve in chief financial officer or equivalent senior executive positions. In total, 454 fully completed surveys were submitted.

About AICPA & CIMA, together as the Association of International Certified Professional Accountants

AICPA® & CIMA®, together as the Association of International Certified Professional Accountants (the Association), advance the global accounting and finance profession through our work on behalf of 698,000 AICPA and CIMA members, candidates and engaged professionals in 188 countries and territories. Together, we are the worldwide leader on public and management accounting issues through advocacy, support for the CPA license, the CGMA designation and specialized credentials, professional education and thought leadership. We build trust by empowering our members and engaged professionals with the knowledge and opportunities to be leaders in broadening prosperity for a more inclusive, sustainable, and resilient future.

About North Carolina State University’s Enterprise Risk Management (ERM) Initiative

The Enterprise Risk Management (ERM) Initiative in the Poole College of Management at North Carolina State University provides thought leadership about ERM practices and their integration with strategy and corporate governance. Faculty in the ERM Initiative frequently work with boards of directors and senior management teams helping them link ERM to strategy and governance, host executive workshops and educational training sessions, and issue research and thought papers on practical approaches to implementing more effective risk oversight techniques.