A new report from the American Institute of CPAs (AICPA) and North Carolina State University’s Enterprise Risk Management (ERM) Initiative reveals that only 11% of senior finance leaders view their organization’s risk management process as ‘mostly’ or ‘extensively’ a strategic tool that delivers competitive advantage, with 64% indicating it provides no or minimal advantage.
Meanwhile, 61% of finance leaders acknowledge that the volume and complexity of risks have changed ‘mostly’ or ‘extensively’ over the past five years. Despite this shift, just 35% report having comprehensive ERM processes in place, and only 32% rate their organization’s overall risk oversight as ‘mature’ or ‘robust’. These figures remain largely unchanged from the previous year.
New and rapidly changing risk events, including concerns about the US economy and inflation, geopolitical developments impacting trade and supply chains, disruptive technologies and AI, cyber and privacy threats, and a host of other risk triggers, are continuing to drive significant disruptions that impact an organization’s business model and strategic planning. Despite these unfolding realities, most organizations do not have robust enterprise risk management practices in place.
The 2025 State of Risk Oversight: An Overview of Enterprise Risk Management Practices report represents a 16-year partnership between the AICPA and North Carolina State University’s ERM Initiative. It includes insights from a survey of 273 US organizations, conducted in spring 2025, and reflects the views of CFOs and senior finance leaders. The survey measured executives’ assessments of the level of maturity in their organization’s proactive management of risks through adoption of ERM processes.
Additional key findings from the report include:
- Almost half (45%) of organizations report having a Chief Risk Officer or senior risk executive equivalent.
- The frequency at which management shares risk exposure with the board of directors varies, with 57% reporting top risks to the board.
- Only 27% of executives note that their ERM process would assist in identifying and managing a significant risk event that would impact their organization’s reputation and brand.
