A recent study conducted by the AICPA, in collaboration with North Carolina State University’s Enterprise Risk Management (ERM) Initiative, has revealed that a mere 11% of senior finance executives perceive their organization’s risk management processes as “mostly” or “extensively” serving as a strategic tool that offers a competitive edge. 

In contrast, 64% of respondents believe that these processes provide little to no advantage. 

The report highlights that 61% of finance leaders acknowledge a significant shift in the volume and complexity of risks over the past five years. 

Despite this awareness, only 35% of organizations report having comprehensive ERM practices in place, and just 32% assess their overall risk oversight as “mature” or “robust.” These figures show minimal change compared to the previous year. 

The evolving risk landscape includes various factors such as economic uncertainties, inflation, geopolitical issues affecting trade and supply chains, advancements in technology and AI, as well as cyber and privacy threats. 

These elements are contributing to substantial disruptions that can affect an organisation’s business model and strategic planning. 

The findings are part of the 2025 State of Risk Oversight: An Overview of Enterprise Risk Management Practices report. 

The report is based on a survey of 273 US organizations, specifically targeting CFOs and senior finance leaders, conducted in Spring 2025. 

To improve risk management approaches, executives and boards must first identify cultural factors that may impede progress. 

The report identifies competing priorities and insufficient resources (both at 41%) as the primary barriers, along with a perceived lack of value in risk management efforts (29%). 

Additional insights from the report indicate that nearly half (45%) of organizations have appointed a chief risk officer or a senior risk executive equivalent. 

However, the frequency with which management communicates risk exposure to the board of directors varies, with 57% reporting top risks to the board. Only 27% of executives believe that their ERM process would aid in identifying and managing a significant risk event that could affect their organization’s reputation and brand.