Every board says risk matters. The harder question is whether the organisation’s risk oversight actually changes what happens next. The newest evidence is not flattering. The 17th annual State of Risk Oversight report, produced by the AICPA and the Enterprise Risk Management Initiative at North Carolina State University and based on 331 organisations surveyed in the second quarter of 2026, describes a world in which risk complexity keeps rising and oversight maturity does not keep pace.
This article reads those findings as an enterprise risk management (ERM) practitioner would: what the numbers say, why operational surprises persist even in organisations that have a risk register and a risk committee, and what a practical, evidence-based fix looks like, including where AI agents help and where people must stay accountable. It builds on our earlier look at why audit committees rank ERM first but lag on AI oversight.
Crest.Digital’s Agentic GRC connects risk registers, control tests and operational data so that indicators, exceptions and owners are visible between committee meetings.
Explore Agentic GRCWhat the 2026 State of Risk Oversight Report Found
The headline numbers, as reported by Accounting Weekly and published by the AICPA & CIMA, are worth reading together rather than one at a time. About 69% of organisations say the volume and complexity of risks is rising, up from 61% the year before. Yet only 30% rate their risk oversight as mature or robust, down from 32%, and just 3% call it robust. Meanwhile 74% report a significant operational surprise in the past five years.
The structural picture is similarly mixed. Only 37% of organisations overall have a complete formal ERM process in place (63% of large organisations and 67% of listed companies). Around half now have a chief risk officer, and 61% have a management-level risk committee. But only 29% have a written risk appetite statement, 29% factor risk into capital allocation, and roughly a quarter have key risk indicators they would call robust. Just 11% say risk management gives them a real strategic or competitive advantage.
One caution on reading the data. The sample is predominantly US-based (about 88%), includes a substantial share of public-sector and not-for-profit bodies, and respondents are mostly CFOs, CROs and heads of internal audit. It is a credible benchmark for senior risk leaders, not a census of global enterprises, and the figures above reach us through a secondary summary of the report. Read the full report before quoting a specific percentage in a board paper.
Why Operational Surprises Persist Despite a Risk Function
If most organisations have a risk register, a committee and a CRO, why do three in four still get surprised? Our experience across audit, TPRM and controls programmes points to four recurring causes.
1. Risks are identified, but not connected to controls. A register entry that reads “supplier concentration” or “IT outage” is only useful if someone can say which controls address it, who tests them and what the last result was. The COSO frameworks treat risk assessment and monitoring as linked components for exactly this reason.
2. Risk identification is inward-looking. The report notes that 71% of organisations focus their risk identification on IT systems and 63% on legal and compliance, but only 46% on emerging strategic, market or industry risk and just 22% on risks five to ten years out. Operational surprises often come from exactly the places a register does not look: a supplier, a regulator, a technology dependency or a market shift.
3. Indicators are lagging, not leading. With robust key risk indicators in only about a quarter of organisations, many risk owners learn about a problem when a loss, an audit finding or a customer complaint arrives. Nobody was watching the early signals because nobody defined them.
4. Resources and priorities are the stated barriers. Insufficient resources (45%) and competing priorities (44%) are the top barriers to better oversight; only 8% cite legal or regulatory obstacles. That is a design hint. If people are the constraint, the answer is to automate collection and routine testing so that scarce experts spend their time on judgement.
The Escalation Problem: When Risk Moves by Conversation
The single most revealing statistic may be that 56% of organisations escalate risk mainly through ad hoc discussion at management meetings. That is how risk travels when there is no defined trigger, no threshold and no record. It works when a risk is obvious and a senior person happens to be in the room. It fails when a signal is weak, owned by someone junior, or spread across functions that rarely meet.
Ad hoc escalation has three consequences that auditors and regulators notice. There is no consistent threshold, so two similar issues get different treatment. There is no evidence trail, so the board cannot see what was known and when. And there is no closure discipline, which is why the same findings return, a pattern we examine in our guide to audit issue remediation and follow-up agents. Boards and committees do not need more risk narrative. They need the executive layer of risk and audit intelligence: a small number of live indicators, exceptions and overdue actions.
Supplier failure, cyber incidents at a vendor and sanctions exposure rarely appear on an internal register in time. Crest.Digital’s vendor intelligence platform brings continuous third-party signals into the enterprise risk picture across the industries we cover.
A Six-Step Plan to Move Oversight From Conversation to Evidence
We deploy continuous assurance as a configurable pod rather than a bespoke build: reusable connectors, orchestration, workflow, an evidence repository and an audit trail, with client-specific work focused on data mapping, risk and control logic, approvals and dashboards. The sequence follows the same delivery model we use for continuous controls monitoring.
Discover Which Risks Actually Matter and Who Owns Them
Start from the risks that have hurt you or nearly did. For each, name an accountable owner, the processes and systems involved, and the controls that are supposed to reduce it. Retire register entries nobody can describe in an operational sentence.
Design Leading Indicators, Thresholds and Escalation Rules
For the top risks, define two or three leading indicators each, with amber and red thresholds, and say who is told when they cross. Write the rule down so escalation no longer depends on who attended the meeting.
Connect Registers, Controls and Operational Data
Link the risk register to control tests, incident logs, third-party data and system feeds. A single traceable chain from risk to control to evidence is what turns a register from a document into an instrument.
Deploy Monitoring on the Highest-Exposure Risks First
Release a short list of indicators and control tests on live data, with exceptions routed to owners and tracked to closure. Resist covering the whole register on day one.
Validate Signals Against Real Events
Back-test the indicators against recent incidents. Did they move before the event? Tune thresholds, remove noise, and agree with internal audit which outputs the organisation can rely on.
Transfer or Manage, Then Report to the Board
Hand the solution to your team or run it as a managed service. Give the board and audit committee a concise, current view of indicators, exceptions and overdue actions, and review the risk appetite against what the data shows.
Step five is the one that builds credibility. A risk indicator that would not have flagged last year’s incident deserves scepticism, and one that did deserves investment. The Institute of Internal Auditors positions internal audit as an independent check on whether risk management is effective, and that check is far stronger when it can examine continuous evidence rather than a once-a-year narrative. We cover the evidence side in continuous evidence versus continuous monitoring, and the AI-specific dimension in why the AI inventory starts with the vendor inventory.
Where Agentic AI Helps, and Where People Stay Accountable
The report’s top barriers are resources and competing priorities, which is precisely where agentic AI earns its place. Agents can scan regulatory, market and news sources for emerging risk signals, refresh indicators from operational systems, assemble the evidence behind a control test, draft an exception note with context, and chase owners for responses. A risk team that spends its week compiling a pack can spend it challenging what the pack says.
The boundary is clear. Agents collect, correlate, test and recommend. People set risk appetite, accept or treat risk, and decide what to escalate. Every agent step needs a log of the data used, the rule applied and the reviewer so the work can be re-performed, which is the argument in why AI agents need audit trails. Where AI itself is a risk being overseen, the same discipline applies: an AI policy only becomes a control once someone tests it, as we discuss in an AI policy is not an internal control until someone tests it.
Your Turn: How Does Risk Reach Your Board Today?
- By conversation: Risks surface in management meetings, indicators are sparse, and the register is refreshed quarterly or annually.
- By report: A periodic pack summarises top risks and some indicators, but evidence is assembled manually and thresholds are informal.
- By evidence: Leading indicators and control tests run on live data, breaches trigger defined escalation, and the board sees current exceptions and overdue actions.
Which of the three describes your organisation? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
Risk oversight maturity describes how well an organisation’s board and management identify, assess, monitor, escalate and respond to risk in a consistent, documented way. Immature oversight relies on individual judgement and ad hoc conversation; mature oversight has defined risk appetite, leading indicators, escalation thresholds, clear ownership, integration with strategy and capital decisions, and evidence that the process works. Surveys such as the AICPA and NC State State of Risk Oversight report use self-assessment scales to benchmark this across organisations.
Usually because the programme records risks without wiring them to action. Common causes are risks not linked to specific controls and tests, inward-looking risk identification that misses supplier, market and emerging risks, lagging rather than leading indicators, and escalation that depends on conversation rather than thresholds. Resource constraints make this worse. The 2026 State of Risk Oversight survey found that 74% of organisations had a significant operational surprise in the past five years and that 56% rely mainly on ad hoc management discussion to escalate risk.
Key risk indicators (KRIs) are measurable signals that a risk is rising before it becomes a loss, such as overdue control tests, supplier financial deterioration, privileged-access exceptions or rising incident near-misses. Each priority risk usually needs two or three, each with an owner, amber and red thresholds and a defined escalation action. Quality matters more than volume: a small set that has been back-tested against real incidents is more useful than dozens that nobody acts on.
AI agents can monitor external sources for emerging risk signals, refresh indicators from operational systems, collect and validate control evidence, draft exception summaries with context and follow up with owners. This addresses the resource and priority constraints that surveys keep reporting. Agents should not decide risk appetite or accept risk; people retain those decisions, and each agent action should be logged with data, rule and reviewer so internal audit can re-perform it. This is the human-in-the-loop model behind Crest.Digital’s agentic approach.
Start by asking three questions: which risks have hurt or nearly hurt us in the last five years, what indicator would have warned us, and who would have been told. Then ask management to show a current view of the top risks with their indicators, control test results and overdue actions rather than a narrative pack. Pairing that view with an independent check from internal audit gives the committee a basis for challenging whether the risk appetite and the controls actually line up.