Corporate board members may have greater confidence in their organizations’ ability to manage key risks than management actually does—and as a result, boards are significantly overconfident when it comes to addressing the thorniest issues facing their organizations, according to eye-opening new research from The Institute of Internal Auditors (IIA).
And what’s the reason for the skewed sense of security on a variety of risks, ranging from data protection and new technology to culture and sustainability? The new IIA report asserts that boards may be receiving incomplete or misleading information from management, which is then compounded by members’ failure to ask critical questions.
The study, OnRisk 2020: A Guide to Understanding, Aligning, and Optimizing Risk, provides a comprehensive view of organizational risk from those who manage it. Through quantitative and qualitative surveys, this first-of-its-kind report lays out how each group perceives and communicates key risks—and provides important benchmarking to help organizations align and enhance their risk management strategies and execution.
Organizational risk capability—board and C-suite perceptions:
Among the report’s key findings:
A suspect gap between management’s views and management’s reporting
There is a critical misalignment between how executive management views an organization’s capability to manage risks and what is communicated to boards, leading to board members believing risks are better managed than they are.
Board members’ expectations are too low
A perception of “acceptable misalignment” on risk—some respondents believe some misalignment is to be expected—is prevalent.
Poor approach to risk management
Some industries are lagging in adopting a systematic approach to risk management. These include healthcare and retail/wholesale, as well as the public/municipal sector.
Some risks are subject to greater reporting gaps
Among 11 key risks reviewed in the report, cybersecurity and data management and new technology are especially susceptible to critical knowledge deficits.
Some risks are expected to be greater threats
Data management/collection and new technology, data ethics, and sustainability risks are expected to grow in relevance in the next five years.
“Acceptable misalignment on risk is a risk itself that’s shortsighted and simply unacceptable,” said Richard F. Chambers, CIA, QIAL, CGAP, CCSA, CRMA, IIA President and CEO, in a news release. “The burden is on management to provide the board with an accurate picture of risks that may negatively impact the organization as well as those that present opportunities. But board members also must seek out informed and objective assurance on the information they receive, and internal audit is uniquely positioned to provide that truly independent and enterprise-wide perspective.”
The inaugural OnRisk report is a significant step in collecting stakeholder perspectives on risk and risk management in support of good governance and organizational success. The combination of quantitative and qualitative research provides a robust look at 11 top risks facing organizations and allows for both objective data analysis and subjective insights based on responses from risk management leaders.
Organizational capability for 11 risks plotted on the Risk Stages model:
Risk stages are Recognize (r), Explore (e), Develop (d), Maintain (m).
“It is vital for organizations to not only develop strategies to address risks, but to have an added layer of assurance that examines the effectiveness of the risk strategy and its components,” Chambers said. “No single report provided a holistic view of risk based on the perspectives of the three key players in risk management—until now.”
The qualitative survey is based on 90 in-depth interviews with professionals in North American boardrooms, C-suites, and internal audit functions. The quantitative survey involved more than 600 internal audit leaders, primarily chief audit executives.