From deciding which risks deserve the most attention to strengthening board oversight, ERM leaders are navigating increasingly complex questions. Here are five issues shaping the conversation as organizations look toward 2027.

Enterprise risk management continues to evolve as organizations confront an increasingly interconnected risk environment. But for ERM leaders, the challenge is not simply identifying more risks. It is helping executives make sense of uncertainty, determine what matters most and connect risk insights to the decisions that shape strategy and performance.

Those challenges will be at the center of the NC State ERM Initiative’s Fall 2026 ERM Roundtable Summit on November 12, where risk leaders from Delta Air Lines, Cook Children’s Health Care System – Ft. Worth, and Northwestern Mutual will join experts from Protiviti and PwC to share perspectives from their organizations and research.

Ahead of those conversations, here are five questions ERM leaders may want to consider.

1. How does ERM evolve as the organization and its risks change?

An ERM program that worked several years ago may not be the ERM program an organization needs today.

Changes in strategy, leadership, technology, operations and the external environment can all alter the risk landscape. Effective ERM programs must evolve along with those changes — while continuing to provide executives with a clear view of the risks most relevant to strategic success.

Effective and value-adding ERM programs strive to balance the benefits of an organized cadence that engages executives in a structured approach to ERM with the need for agility; the process must also be nimble enough to respond to sudden changes in internal and external conditions. A healthy mix of an annual cadence of identifying risks to strategies, prioritizing the most critical risks, pinpointing appropriate responses and monitoring risks for changing conditions along with regular discussions about emerging trends, shifting assumptions, blind spots, and watchlists of changing conditions help ensure the process is providing rich risk intelligence for decision-making. 

Delta Air Lines provides an interesting example.

Eric Mai and Shawn Figueroa will share how Delta’s ERM program has evolved to address a number of emerging issues, particularly geopolitical shifts that impact global travel around the world.

When we previously spoke with Eric Mai, Director of Enterprise Risk Management at Delta Air Lines, he described how Delta began rebuilding its ERM program in 2019 and how governance and executive communication played an important role as the organization navigated the disruption created by the COVID-19 pandemic.

Several years later, the natural question is: What has continued to evolve?

At the Fall ERM Roundtable Summit, Mai and Shawn Figueroa, Senior Manager of Enterprise Risk Management, will provide an updated look at ERM inside one of the world’s largest global airlines.

For ERM leaders in any industry, Delta’s experience raises an important question: Are we regularly reconsidering whether our ERM approach still fits the organization we are becoming?

2. How do we determine which risks truly deserve leadership attention?

Most organizations have no shortage of risks they could discuss. The harder task is deciding which ones warrant the greatest attention from management and the board.

Traditional approaches often ask leaders to assess risks according to evaluation scales of dimensions such as likelihood and impact. But ERM teams continue to experiment with techniques designed to create clearer differentiation among risks, surface differing perspectives and generate better conversations about priorities.

NC State research has found that organizations use a variety of approaches to risk prioritization, with qualitative techniques continuing to play an important role. Our ERM Resource Center also explores alternatives such as forced ranking, which asks leaders to make explicit choices about which risks matter most rather than simply assigning scores to every risk.

That challenge takes on added complexity in environments where many different risks can have significant consequences.

At Cook Children’s Health Care System – Ft. Worth, Erana Hughes, Director of Enterprise Risk Management, is addressing that challenge directly. At the Fall ERM Roundtable Summit, she will share techniques the organization uses to prioritize risks within a complex pediatric healthcare system.

The larger question for ERM leaders is worth considering: Does our risk assessment process simply produce a ranked list — or does it help leadership make meaningful choices about where attention and resources should go?

3. How can executives focus on both near-term and long-term risks and opportunities?

Risk prioritization is also changing because the external environment keeps changing.  Changes often impact organizations in the short-term, but other developments may be brewing gradually before becoming significant and strategy-changing in the long term.  Robust ERM programs find value in having executives not only focus on specific risk issues that might emerge in the next few years but also having them focus on broader, slower-moving, but significant developments that may not seem relevant now, but could be significant and costly if ignored until they emerge.

Engaging the organization’s top leadership in discussions about near-term and long-term developing trends can help keep their focus on the impact of both as they make strategic decisions important for their organization’s future.  Some long-term risks may require significant investments now to ensure the organization is positioned to proactively address long-term challenges as they emerge.

Our soon-to-be-released 2027 Executive Perspectives on Top Risks and Opportunities report will feature insights from executives around the world about how they view the risks and opportunities landscape as they look out over the next 2–3 years and as they consider conditions a decade later. This annual report provides valuable benchmarking data about executive perspectives on developing trends and related strategic priorities linked to AI that have both short-term and long-term implications.  At the Fall ERM Roundtable Summit, Jim DeLoach, Managing Director at Protiviti, will share highlights from the 2027 findings and explore the near- and longer-term risks occupying executives’ attention.

4. What does it really mean to integrate ERM into the organization?

ERM creates the greatest value when risk thinking does not operate as a standalone exercise.

That means connecting ERM to strategy and decision-making, but it can also mean coordinating ERM with operational risk, compliance, internal audit, resiliency and other risk and assurance activities across the enterprise.

That coordination is not always easy. Different functions have different responsibilities, reporting relationships and objectives. The goal is not necessarily to centralize those activities, but to identify where greater alignment can improve visibility, reduce unnecessary duplication and help leaders see risk more holistically.

We explored that challenge in an earlier ERM Resource Center conversation examining how organizations can better coordinate ERM with other risk and assurance functions while maintaining appropriate independence.

At the Fall ERM Roundtable Summit, Julie Krupski, Senior Director, Enterprise Risk Management & Integration at Northwestern Mutual, will provide an inside look at ERM at one of the nation’s largest providers of life insurance, wealth management and financial planning services.

Her session raises a useful question for any ERM team: Where are the opportunities to better connect risk information, processes and conversations across our organization?

5. How should board oversight evolve as risks become more complex?

The role of the board is evolving alongside the risk environment.

In March 2026, the Committee of Sponsoring Organizations of the Treadway Commission — COSO — released Corporate Governance: Guiding Principles for Board Oversight, developed in collaboration with PwC. The guidance provides 12 principles designed to help boards evaluate governance and oversight in an environment characterized by rapid change, increasing complexity and heightened stakeholder expectations.

For ERM leaders, the guidance raises important questions about the connection between governance and risk management.

How does the board obtain the risk information it needs to oversee strategy? How should technology and data factor into governance conversations? And how effectively are risk management and internal control connected with the board’s broader oversight responsibilities?

At the Fall ERM Roundtable Summit, members of the PwC project team will provide an overview of COSO’s new guidance and its implications for corporate governance and board oversight.

From Identifying Risks to Improving Risk Conversations

The five topics are different, but they point toward a common theme.

The real value of ERM does not come from creating longer inventories of risks. It comes from helping leaders ask better questions:

• What has changed?
• What matters most?
• What might be coming next?
• How do we connect the right people and information?
• And, what does effective oversight require?

Those are questions every organization must answer for itself.

On November 12, 2026, the Fall ERM Roundtable Summit will bring together ERM practitioners and thought leaders to explore how organizations are answering them in practice.

About the Author

Mark S. Beasley, CPA, Ph.D. is the Alan T. Dickson Distinguished Professor of Accounting and Director of the ERM Initiative at NC State University. An internationally recognized expert in enterprise risk management (ERM), corporate governance, and financial reporting, he has spent decades helping organizations strengthen risk oversight and integrate ERM into strategic decision-making.

Dr. Beasley previously served more than seven years on the Board of Directors of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and has contributed to numerous national and international initiatives focused on risk governance, including the United Nations Internal Control Advisory Group. He regularly advises boards of directors and executive leadership teams, speaks at conferences around the world, and has authored more than 100 articles, research monographs, books, and thought leadership publications on enterprise risk management and governance. He earned his Ph.D. from Michigan State University.