Summer often provides an opportunity for a brief moment of reflection. Strategic planning discussions for the coming year are still forming, budget conversations have not yet fully accelerated, and boards are preparing for their heavier fourth-quarter agendas. For chief risk officers and other enterprise risk management leaders, this may be one of the best times of the year to step back and ask a simple but important question:

Is our approach to risk management keeping pace with the environment in which we operate?

For many organizations, the honest answer may be “not entirely.” While most organizations have invested considerable effort in strengthening risk oversight over the past decade, the nature of risk itself has changed dramatically. Risks seem to be more interconnected, more dynamic, and often more difficult to anticipate.

The challenge facing risk leaders today is not whether risk management exists within the organization, but whether it is evolving quickly enough to be relevant and valuable for strategic decision making.

Review the full review below and download the resource (PDF). Or, use the anchor links here to skip to each section:

• Does Our Risk Management Process Help Us Deal with the Realities of Uncertainty?
• Are We Managing Risks or Simply Monitoring Them?
• Have We Fallen Into the Compliance Trap?
• Do Our Processes Encourage Strategic Thinking?
• Are We Sufficiently Evaluating Preparedness?
• Is Our Approach Fit for Purpose?
• Looking Ahead
• Resource: PDF Download
• Additional Resource: Risk Committee Discussion Guide
• About the Author

Does Our Risk Management Process Help Us Deal with the Realities of Uncertainty?

Almost every executive team today would acknowledge that uncertainty has increased. Geopolitical tensions, the rapid advancements in AI and other disruptive technologies, cybersecurity threats, workforce transformation, supply chain volatility, economic uncertainty, and shifting stakeholder expectations have combined to create a risk landscape that is substantially different from the one organizations faced just a few years ago.

Many organizations continue to encounter unexpected operational disruptions, sudden regulatory shifts, technology failures, third-party breakdowns, reputation challenges, or strategic developments that emerge with little warning. The reality is that surprises have become a normal feature of the business environment rather than rare exceptions.

Yet many risk management programs still operate under assumptions developed for a more stable world. Risk identification may occur annually. Risk assessments may rely heavily on historical information. Discussions may focus primarily on known risks rather than emerging uncertainties. Reporting processes may emphasize status updates instead of forward-looking insights.

This creates a potential disconnect between the complexity of the risk environment and the organization’s preparedness to navigate it.

The purpose of enterprise risk management has never been to eliminate surprises. That goal is unrealistic. Rather, its purpose is to help leadership teams see around corners more effectively, recognize emerging vulnerabilities earlier, and improve decision making before significant disruptions occur.

The question risk leaders should ask is whether their current risk management processes are accomplishing those objectives.

Are We Managing Risks or Simply Monitoring Them?

One of the most common challenges facing organizations today is confusing risk awareness with risk readiness. Many organizations can identify their top risks. They maintain risk inventories. They conduct risk assessments. They report risks to management and boards. Those activities are important.

However, awareness alone does not necessarily improve preparedness.

For example:

• Knowing that cybersecurity is a top risk is different from understanding how a major cyber event might affect customer relationships, operational continuity, regulatory obligations, strategic initiatives, and reputation simultaneously.
• Knowing that geopolitical uncertainty exists is different from understanding how specific geopolitical developments could disrupt strategic objectives.
• Knowing that talent shortages are possible is different from assessing how workforce constraints might alter long-term growth aspirations.

The real value of risk management emerges when the conversation moves beyond identifying risks toward understanding how those risks might unfold, interact, and reshape strategic outcomes.

Risk leaders may want to consider whether current discussions focus too heavily on describing risk conditions and not enough on exploring their potential consequences.

Have We Fallen Into the Compliance Trap?

Another useful question for organizations to explore is whether their risk management activities remain disproportionately focused on compliance and operational concerns.

To be clear, compliance risks are important. Regulatory failures can be costly. Operational disruptions can significantly affect performance. Internal controls remain essential. However, organizations can sometimes devote most of their risk management energies to these areas while spending significantly less time discussing emerging strategic risks.

This imbalance is understandable. Compliance risks tend to be more measurable. Operational risks are often easier to observe. Control effectiveness can usually be evaluated through structured processes.

Strategic risks are different. Emerging competitors, disruptive technologies, changing customer expectations, demographic shifts, political instability, market transformation, or evolving business models rarely fit neatly into traditional risk assessment frameworks. As a result, organizations often become highly skilled at managing the risks they know while remaining less prepared for the risks that could fundamentally change their future.

Risk leaders may find benefit in reviewing their organization’s portfolio of risks and asking:

• Which risks receive the most management or board attention?
• Which risks have the greatest potential to alter our long-term strategy?
• Are those answers the same?

If not, there may be opportunities to broaden the organization’s risk dialogue.

Do Our Processes Encourage Strategic Thinking?

One of the most important responsibilities of modern risk leaders is creating space for strategic conversations about uncertainty. Unfortunately, operational demands make this difficult.

Most executive leadership teams spend the majority of their time dealing with immediate issues. Quarterly performance, operational challenges, customer concerns, technology investments, staffing decisions, and regulatory requirements understandably dominate management agendas. As a result, long-term risk thinking often becomes an occasional exercise rather than a regular discipline.

Yet some of the most consequential risks facing organizations may not materialize for five or ten years. Artificial intelligence, workforce demographics, climate-related impacts, changing business ecosystems, geopolitical realignment, economic restructuring, and other macro trends are already shaping future risk profiles.

Organizations that wait until those risks fully emerge may discover that their response options are limited. Risk leaders may find value in considering whether their current processes explicitly encourage management to think beyond immediate concerns and explore longer-term uncertainties.

If the organization’s discussions focus almost exclusively on the next quarter or next year, it may be overlooking developments that could substantially influence future success.

Are We Sufficiently Evaluating Preparedness?

Traditional risk assessments frequently emphasize likelihood and impact. And that makes sense given those dimensions matter. However, organizations may benefit from expanding the discussion to include additional questions:

• How quickly could this risk develop?
• How interconnected is this risk with other risks?
• How prepared are we if it occurs?
• How quickly could we respond?
• What strategic initiatives would be affected?

A risk that appears unlikely may warrant attention if preparedness is low. Similarly, a risk with moderate impact may deserve greater focus if it could trigger multiple secondary disruptions throughout the organization.

Preparedness is increasingly becoming as important as probability. In today’s environment, resilience often depends less on accurately predicting a disruption and more on the organization’s ability to adapt when disruption occurs.

Is Our Approach Fit for Purpose?

As organizations prepare for fall board meetings and fourth-quarter planning activities, this may be an ideal time for risk leaders to initiate a broader conversation. Consider engaging your risk committee, executive leadership team, or board in a conversation focused on elevating the value of your organization’s risk thinking. The appendix contains a sample discussion guide that you might consider using to guide those conversations.

The goal is not to critique existing processes. Most organizations have invested significant effort in strengthening risk oversight. The goal is to evaluate whether current approaches remain fit for purpose in a world characterized by increasing uncertainty.

Looking Ahead

Organizations that thrive in the years ahead will likely be those that balance operational vigilance with strategic foresight. They will continue to manage compliance obligations and operational risks effectively while also investing time to understand emerging disruptions that could reshape their future.

For risk leaders, a mid-year reality check provides an opportunity to pause, reflect, and assess whether the organization’s risk management approach is preparing leadership not only for the risks they know, but also for the surprises they have not yet imagined.

That conversation could become one of the most valuable agenda items of the fall.

Resource: PDF Download

Additional Resource

Risk Committee Discussion Guide

The table below outlines a discussion guide designed to help risk committees evaluate whether the organization’s risk management processes remain aligned with today’s rapidly changing risk environment. The objective is not to review individual risks. Rather, it is to assess whether the organization’s overall approach to risk oversight is sufficiently forward-looking, strategically relevant, and capable of helping leadership anticipate and respond to unexpected disruptions.

The first column displays the topic to discuss, the second column displays the purpose of that topic, and the third column provides some sample discussion questions.

Discussion Theme	Purpose	Discussion Questions
Understanding the Changing Risk Environment	Determine whether the committee has a shared view of how the organization’s risk landscape has changed.	1. How has our risk environment changed over the last three to five years? 2. Which changes are likely temporary and which represent permanent shifts? 3. Do we believe the pace of change affecting our organization is accelerating? 4. If we designed our current risk management process from scratch today, knowing what we now know about the environment, would it look the same?
Assessing Organizational Preparedness	Shift the conversation from risk identification to preparedness and resilience.	1. What significant events or disruptions have surprised our organization during the past five years? 2. Looking back, which warning signs did we miss? 3. Which disruptions would we be least prepared to handle if they occurred tomorrow? 4. What are the greatest gaps in our ability to respond quickly to emerging events?
Evaluating the Balance of Risk Attention	Consider whether risk discussions are disproportionately focused on operational and compliance issues	1. Which categories of risks receive the most management and board attention today? 2. Are emerging strategic risks receiving the same level of attention as operational and compliance risks? 3. Which risks have the greatest potential to affect future success but currently receive limited discussion? 4. Are we spending most of our time discussing today’s risks or tomorrow’s risks?
Challenging Strategic Assumptions	Explore uncertainty surrounding the organization’s strategy.	1. What assumptions embedded in our current strategic Assumptions surrounding the plan concern us most? organization’s strategy. 2. What events could cause those assumptions to become invalid? 3. Are there plausible future scenarios that would require us to significantly alter our strategy? 4. If our strategy depends on a specific future occurring, how prepared are we if a different future emerges?
Evaluating the Value of Risk Management	Determine whether risk management is influencing important decisions.	1. How often do risk insights materially influence strategic of Risk Management management is decisions? influencing important 2. How often do discussions about risks lead to changes in decisions. resource allocations? 3. Is risk information being considered before major initiatives are approved? 4. If risk management disappeared tomorrow, what decision-making capabilities would the organization lose?

About the Author

Mark S. Beasley, CPA, Ph.D. is the Alan T. Dickson Distinguished Professor of Accounting and Director of the ERM Initiative at NC State University. An internationally recognized expert in enterprise risk management (ERM), corporate governance, and financial reporting, he has spent decades helping organizations strengthen risk oversight and integrate ERM into strategic decision-making.

Dr. Beasley previously served more than seven years on the Board of Directors of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and has contributed to numerous national and international initiatives focused on risk governance, including the United Nations Internal Control Advisory Group. He regularly advises boards of directors and executive leadership teams, speaks at conferences around the world, and has authored more than 100 articles, research monographs, books, and thought leadership publications on enterprise risk management and governance. He earned his Ph.D. from Michigan State University.