AICPA: “The State of Risk Oversight 2026”
I finished this report with mixed feelings. On one hand, it gives a useful picture of how Risk Management and ERM are organized. On the other, I still keep coming back to a question that such maturity models rarely answer: Does a “more mature” risk management system actually help an organization perform better and achieve its objectives?
Photo: pvproductions na Magnific
Having a formal policy, a risk committee, a defined methodology, a risk appetite statement and a standardized template may indicate process maturity. But process maturity is not automatically business value.
The report gives several reasons to be cautious.
🔹 30% of respondents describe their risk oversight as mature or robust.
🔹 37% have a complete formal ERM process.
🔹11% believe risk management “mostly” or “extensively” provides a unique strategic advantage.
🔹 30% say risk information is formally discussed when the board discusses strategy.
🔹 29% say risk exposures are considered in capital allocation decisions.
🔹 22% say they are mostly or extensively thinking about risks 5–10 years out.
A few other things caught my attention.
1️⃣ Year-to-year volatility
Several charts show sharp jumps or drops in a single year, followed by a return toward previous levels. That appears in maturity, board engagement, KRIs, scenario planning and other measures. I would love to know what caused those swings.
2️⃣ Resistance to ERM is quite telling
➡️ 33% cite lack of perceived value as a barrier.
➡️ 28% say ERM adds bureaucracy.
➡️ 44% point to competing priorities.
➡️ 45% point to insufficient resources. That should make us uncomfortable.
If risk management is supposed to help leadership make better decisions, but managers see it as bureaucracy with unclear value, maybe the problem is not only “lack of awareness”. Maybe the design of ERM itself sometimes needs fixing.
3️⃣ Strategic value still looks weak.
The report itself says most organizations do not view risk management as providing strategic advantage.
4️⃣ Everyone manages ICT, Compliance and Financial Risk
IT risk is formally considered by 71% of respondents, legal/compliance by 63%, financial risk by 57%.
5️⃣ Boards are becoming more engaged
62% have delegated formal risk oversight to a board committee, 81% explicitly describe that responsibility in the committee charter, and 61% set aside a specific board meeting for top-risk discussion. That is good news.
My main question remains the same: How do we actually measure whether risk management helps the organization make better decisions, avoid unnecessary losses, exploit opportunities and achieve objectives? Until we answer that, I would be careful with equating “more formalized” with “more effective”. A mature-looking ERM system can still be beautifully documented… and strategically irrelevant.
Author: Sebastian Burgemejster
Comments