Is Risk Management’s Strategic Value Getting Lost?

North Carolina State University’s ERM Initiative and the AICPA recently published the 17th edition of The State of Risk Oversight: An Overview of Enterprise Risk Management Practices. Its findings reveal a striking gap between awareness of risk and the use of risk management in strategy.

Among the 331 executives and board-level leaders surveyed, 69% said the volume and complexity of risks had increased over the past five years. However, only 30% described their risk oversight as mature or robust. And just 22% said their risk management process substantially engages management in thinking about risks five to ten years ahead. Why isn't ERM receiving more attention in a volatile, uncertain, complex and ambiguous age?

The finding that troubles me most is that only 11% said their organization’s risk management process substantially provides a unique competitive advantage. Yet at the same time 72% reported that geopolitical uncertainty affects their business model or strategic initiatives to at least some degree. Moreover, 74% reported experiencing a significant operational surprise during the same period. Is the ERM risk identification and analysis disconnected with the work risk owners are doing to mitigate and fund risk? Isn't identifying material risks to strategy and underlying operational objectives that improve strategic decision making a competitive advantage?

The survey raises a question for senior leaders and risk professionals: Are we failing to communicate risk management’s strategic value? Or are too few organizations designing their ERM programs to deliver strategic value?

Read the NC State ERM Initiative and AICPA 2026 study. I welcome your thoughts at zuckerm@temple.edu.