Timely Insights to Enhance your ERM Strategy
I recently had the opportunity to review the results of the 2025 "The State of Risk Oversight - An Overview of Enterprise Risk Management Practices," written by the NC State ERM Initiative in collaboration with the AICPA.
This report contains a trove of valuable information for institutions looking to establish or enhance the maturity of their ERM program. I also learned that despite the fact that boards and fiduciaries want to advance risk management discussions, there are still barriers to ERM's growth and success as identified in the survey responses.
Although the survey was not focused on higher education risk, the survey respondents included leaders from organizations from the non-profit and government sectors which can reflect similar views of risk management. The respondents also included large organizations, financial service entities, and other publicly traded companies.
The report focused on the following key areas:
Integrated Enterprise-Level Risks with Strategic Decision Making
Communicating Risk Information for Key Decision-Maker Consideration
Investing in Leadership to Support Effective Risk Oversight
Strengthening Risk Management Fundamentals
Continuing the Journey Towards Enhanced Risk Management
The following insights are what I found most valuable about why ERM still has challenges in both adoption and maturity.
Most organizations do not view their risk management processes as providing a strategic advantage and struggle with integrating risk management into their strategic decision-making processes. Only 11% of all respondents and not-for-profits responded that risk management could be a strategic tool to provide a competitive advantage.
Most organizations recognize that risks are becoming more complex, but the escalation and communication of risks to senior executives is only happening on an ad-hoc basis. 62% of non-profit organizations and 61% of all respondents agreed with this statement.
Most boards of directors have delegated responsibility for overseeing risk management processes to a sub-committee, which tends to be the audit committee.
Only 14% of non-profits have a CRO that reports to the Board of Directors or the Committee of the Board.
When it comes to risk appetite, only 35% of the full sample of respondents have articulated their risk appetite; non-profits shared the same view.
Only 29% of non-profits have a formal policy statement regarding their ERM approach.
Few organizations have KRIs that can be used to monitor shifts over time.
Most ERM approaches are more qualitative than quantitative in nature.
Most of the risk focus is on IT, legal compliance, and operational risk.
Most ERM processes are not designed to identify long-term risks.
When it comes to scenario planning, only 12% of non-profits use scenario planning to anticipate future risk.
Competing priorities, insufficient resources, and lack of perceived value are key barriers to an effective ERM program. In fact, over 40% of non-profits listed these three risks as the top three barriers. The full sample size mirrored the response, but only 29% saw a lack of perceived value.
And lastly, when asked "Which external parties are asking for increases in senior executive and involvement in risk oversight?” - The Board of Directors was the top contender at 38% but the Audit Committee was next 41%.
Bottom line:
Institutional leaders must support a risk management culture and empower risk managers and CRO's with the tools they need to turn risk insights into strategic opportunities. ERM should not be viewed as a compliance burden, but rather positioned as a strategic capability to enhance decision-making and support competitive advantage.
Institutional leaders can start by building the foundational elements (risk appetite, formal policies, and regular reporting vs ad-hoc reporting) and work towards empowering decision-makers with more sophisticated tools, such as quantitative modeling and scenario planning.
We can't wait to share our Fall 2025 edition with you, featuring curated industry experts who will address how your institution can overcome these challenges and turn risks into opportunities.
