Boards are spending more time monitoring risk, but new research data suggests that increased attention does not necessarily entail changes in how risk is tied to strategy, reporting, or management.
This is a photo from corporate directorThe second quarter survey was conducted in collaboration with the EY Center for Board Matters and surveyed approximately 150 U.S. public company directors.
60% of directors surveyed said their board has increased the amount of time it devotes to risk oversight across the board's agenda in the past two years. Small caps reported related changes, with 39% saying risk discussions were more closely integrated with strategy, 32% saying reporting on emerging risks had improved, and 22% saying increased use of scenario planning.
Lee Henderson, leader of the EY Americas Center for Board Matters and a partner on the study, says it's clear that boards are leaning toward risk oversight, but time isn't the only factor in the impact. “Use that time to connect risk insights to the assumptions, tradeoffs, and inflection points built into the strategy to shape strategic choices,” he said.
Bart Alfonso, chairman of Eastman Chemical's audit committee and member of the board of directors of Kraft Heinz, said risk management has been on the board's agenda in recent years due to “a more competitive environment, a more geopolitical environment, and an increased rate of technological innovation.”
Like Henderson, Alfonso said it is “critically important” for boards to support these conversations, with management clearly interpreting the strategic implications and trade-offs of this increased risk.
Most directors are satisfied with the quality of reports and metrics they receive from management regarding risk factors and how they impact strategy. More than 70% rated the reports they received as robust or with only minor gaps.
Still, the high ratings for reporting sit alongside more modest moves in practices that help boards apply risk information. 32% say reporting of emerging risks has improved, 29% say their boards have increased engagement with C-level management on risk topics, and 22% say their use of scenario planning has increased.
“Out of our control”
Approximately 80% of directors say they are completely or mostly confident that their board's approach adequately addresses today's risk environment. At the same time, 42% said their organization would be significantly or severely disrupted if a key vendor failed, and only about a quarter said their board of directors is regularly briefed on concentration and dependency risks, such as overreliance on key vendors.
A similar proportion of companies say they regularly receive reports on due diligence and onboarding assessments related to third-party relationships.
Several directors surveyed pointed to technology (mainly AI developments) as a bigger risk today, with one director echoing others, along with “black swan events and things that are out of our control.”
Third-party risks can be perceived as external risks, but that doesn't have to be the case, says Henderson. “Boards recognize how important third parties are to business performance, but our findings raise questions about whether visibility into where risk is concentrated is keeping pace,” he said, adding that this could cloud the board's view of where dependencies are being built, potentially cascading risks throughout the business.
Lucid Diagnostics Director Jack Sokoloff said the board has established a separate committee to strengthen risk oversight, which he currently chairs. “The board's Quality, Compliance and Technology Committee assists the audit committee with most non-financial risk issues,” he said.
Risk appetite: Understood but often undocumented
Less than half (43%) of directors say their company's risk appetite is formally articulated and documented. A further 29 percent said it was articulated but not documented, 25 percent said it was widely understood but not documented, and 3 percent said it was not formally articulated or documented.
Meanwhile, 58% said their boards reassess the company's risk appetite on an ongoing basis or as risks evolve. This combination poses practical problems regarding consistency. Boards regularly review risk appetite, even though most boards say risk appetite is not formally documented.
The gap between risk and strategy appears in other areas as well. corporate director the study. Towards 2025 What the director is thinking 42% cite strategic oversight as their top challenge, ahead of cybersecurity for the first time in years.
More recently, a year-long study with the Long Term Stock Exchange found that boards currently spend 36 percent of their meeting time on operating and financial performance, compared to 25 percent on strategy and long-term positioning. Additionally, only 19% use scenario planning beyond a five-year time horizon.
Taken together, the data suggests that boards are giving more time to risk. What is less clear is whether that time gives directors a longer-term view of new risks, or a more complete picture of the exposures already in front of them.
