2026 State of Risk Oversight: Enterprise Risk Management Trends and Key Findings
The 2026 State of Risk Oversight: An Overview of Enterprise Risk Management Practices — 17th Edition
Organizations are facing greater risk complexity, but their risk management capabilities are not always keeping pace. The 2026 State of Risk Oversight study from NC State University’s ERM Initiative and AICPA finds that 69% of executives say the volume and complexity of risks have increased over the past five years, while only 30% describe their risk oversight processes as mature or robust.
Based on responses from 331 executives and board-level leaders, the 17th annual study examines how organizations oversee enterprise risk, integrate risk management with strategy, prepare for emerging threats, and engage senior executives and boards in risk oversight.
2026 State of Risk Oversight: At a Glance
- 69% say the volume and complexity of risks have increased over the past five years.
- 74% have experienced a significant operational surprise within the past five years.
- 72% say geopolitical uncertainty is affecting their business model or strategic initiatives.
- 30% describe their risk oversight processes as mature or robust.
- 29% have formally articulated risk appetite in the context of strategic planning.
- 22% explicitly engage leadership in thinking about risks five to ten years into the future.
- 11% say risk management provides a unique strategic or competitive advantage.
Major Findings
Overall takeaway: Awareness of risk is high, but strategic integration remains limited.
In other words, organizations clearly recognize that risks are becoming more complex and disruptive, but many have not yet fully integrated risk management into strategic planning, resource allocation, long-term thinking, and board-level decision-making.
The individual findings below can help tell that larger story:
Risk Complexity Continues to Increase
There is a growing disconnect between the accelerating complexity of the risk environment and organizations’ ability to manage those risks. Executives overwhelmingly report that risks are more numerous, interconnected, and disruptive than the past, but their risk management maturities are not keeping up.
Unexpected Disruption Remains Common
Respondents reveal that they have experienced a prevalence of significant operational surprises, suggesting their level of preparedness and resilience may require more focus.
Risk Oversight Maturity Is Not Keeping Pace
Cultural resistance, competing priorities, and overreliance on traditional, but siloed, risk management processes are preventing executives from obtaining a more holistic view of how risks are interconnected and, when combined, create potential catastrophic impacts.
Risk Management Is Not Yet Fully Integrated With Strategy
Most risk management programs spend the bulk of their time and attention on compliance and operational concerns, with the least amount of explicit focus on emerging market and industry risks that may have the greatest impact on strategic success. In some ways, their processes miss the forest for the trees.
Organizations Need a Longer-Term View of Risk
The main focus is on emerging near-term risks, which arguably are most important. But, there is additional value when executives also look out over longer horizons to identify significant shifting conditions that may ultimately undermine an organization’s core business drivers.
These, and other key findings, combine to reinforce the report’s broader message: organizations recognize the changing risk environment, but there is still significant opportunity to use risk insights more effectively in strategic decision-making.
Questions for Boards and Executives
- Are changes in our risk environment being considered as part of strategic planning?
- Have we clearly articulated our risk appetite?
- Does risk reporting help leaders understand how major risks may affect strategic objectives?
- Are we considering risks that may emerge five to ten years from now?
- Are risk insights influencing strategic decisions and resource allocation?
About the 2026 State of Risk Oversight Study
The 2026 State of Risk Oversight is the 17th annual study conducted by the Enterprise Risk Management Initiative at NC State University in collaboration with AICPA. The findings are based on responses from 331 executives representing organizations across a range of industries and organizational types. The survey was conducted during the second quarter of 2026.
Authors
Mark S. Beasley s the Alan T. Dickson Distinguished Professor of Accounting and Director of the ERM Initiative at NC State University, with expertise in enterprise risk management, corporate governance, and strategic risk oversight.
Bruce C. Branson is an Alumni Distinguished Professor of Accounting and Associate Director of the ERM Initiative at NC State University, with expertise in enterprise risk management, financial reporting, and risk analysis.
PREVIOUS REPORTS
In the table below, you can download reports from previous years in both PDF and Word versions.
Other Resources
- How to Communicate Risk to the C-Suite and Board — A strong complement to the 2026 findings on board engagement and risk reporting. It focuses on delivering clear, actionable risk information that supports executive decision-making and governance.
- Evaluating Your Organization’s Approach to Risk Management — Particularly relevant to the finding that only 30% of organizations describe their risk oversight processes as mature or robust. This free ERM tool helps organizations assess their current risk management approach and identify opportunities for improvement
- Chief Risk Officers and Management-Level Risk Committees — Useful for readers interested in strengthening the governance structures behind enterprise-wide risk oversight. The resource addresses communicating risks to executives and boards and includes an ERM tool.
