DURHAM, N.C., September 9, 2026 — Organizations are facing a more volatile, interconnected, and unpredictable risk environment than ever before, yet most continue to struggle to fully integrate risk management into strategic decision-making, according to the latest The 2026 State of Risk Oversight: An Overview of Enterprise Risk Management Practices report released today by the American Institute of CPAs (AICPA) and the Enterprise Risk Management (ERM) Initiative at NC State University.
Now in its 17th year, the study surveyed 331 senior executives and board-level leaders and found that 69% believe the volume and complexity of risks facing their organizations have increased significantly over the past five years. At the same time, only 11% say their organization's risk management process provides a unique strategic or competitive advantage.
The findings point to a growing disconnect between rising risk levels and organizations' ability to transform risk intelligence into better business decisions. While many organizations have expanded governance structures and oversight practices, risk management remains focused largely on operational and compliance concerns rather than emerging strategic threats, according to the report.
"The business environment is changing faster than most organizations can adapt," said Tom Hood, EVP, Business Engagement & Growth at AICPA & CIMA. "Leader’s today are navigating geopolitical uncertainty, technological disruption, cyber threats, talent challenges, and economic volatility simultaneously. The organizations that will thrive are those that move beyond viewing risk management as a compliance exercise and instead use risk insights to inform strategy, strengthen resilience, and create long-term value."
Among the report's key findings:
69% of executives say the volume and complexity of risks have increased over the past five years.
74% report experiencing a significant operational surprise within the last five years.
72% say geopolitical uncertainty is affecting their organization's business model or strategic initiatives.
Only 30% describe their organization's risk oversight processes as mature or robust.
Just 29% have formally articulated risk appetite in the context of strategic planning.
Only 22% say their risk management processes explicitly engage leadership in thinking about risks five to ten years into the future.
The report also highlights increasing expectations from boards, audit committees, regulators, and other stakeholders for greater executive engagement in risk oversight. More organizations are appointing chief risk officers, establishing management-level risk committees, and formalizing board oversight responsibilities. However, many organizations still rely on informal discussions rather than robust, data-driven risk reporting to support strategic decision-making.
"One of the most important findings from this year's study is that awareness of risk is high, but strategic integration remains limited," said Mark Beasley, director of the ERM Initiative at NC State University and Alan T. Dickson Distinguished Professor of Accounting. "Organizations are clearly recognizing that risks are becoming more interconnected and disruptive. The next step is ensuring risk management is embedded in strategic planning, resource allocation, and boardroom discussions. Those that accomplish that shift will be better positioned to anticipate disruption, respond with agility, and build sustainable competitive advantage."
The study suggests that while organizations have made steady progress over the past 17 years in developing governance structures and risk management processes, significant opportunities remain to enhance risk maturity, improve communication of risk information, and better leverage risk insights to guide strategic decision-making.
About the Report
The 2026 State of Risk Oversight: An Overview of Enterprise Risk Management Practices report is based on survey responses from 331 executives representing organizations across a wide range of industries, including publicly traded companies, financial services organizations, not-for-profit entities, and large organizations with more than $1 billion in annual revenue. The survey was conducted during the second quarter of 2026 by NC State University's ERM Initiative in collaboration with the AICPA.
About North Carolina State University ERM Initiative
The Enterprise Risk Management (ERM) Initiative in the Poole College of Management at North Carolina State University provides thought leadership about ERM practices and their integration with strategy and corporate governance. Faculty in the ERM Initiative frequently work with boards of directors and senior management teams helping them link ERM to strategy and governance, host executive workshops and educational training sessions, and issue research and thought papers on practical approaches to implementing more effective risk oversight techniques (www.erm.ncsu.edu).
About American Institute of CPAs (AICPA)
The American Institute of CPAs (AICPA) is the world’s largest member association representing the CPA profession, with a history of serving the public interest since 1887. AICPA members represent many areas of practice, including business and industry, public practice, government, education, and consulting. A founding member of the Association of International Certified Professional Accountants, the AICPA sets ethical standards for the profession, attestation standards, and U.S. auditing standards for private companies, not-for-profit organizations, and federal, state, and local governments. It develops and grades the Uniform CPA Examination, offers specialized credentials, partners across the profession to build future talent, and drives continuing education to advance the vitality, relevance, and quality of the profession.
Media Contacts:
Bill Ferguson
AICPA and CIMA
919.402.4610
bill.ferguson@aicpa-cima.com
Suzanne Stanard
NC State University
919. 264-4998
sjstanar@ncsu.edu
# # #