Boards are devoting more time to risk oversight, but new survey data suggests that added attention is not always accompanied by changes in how risk connects to strategy, reporting or management engagement.
That’s the picture from Corporate Board Member’s Q2 survey of nearly 150 U.S. public company directors, conducted with EY Center for Board Matters.
Sixty percent of directors polled say their board has increased the time devoted to risk oversight on the full board agenda over the past two years. Smaller shares report related changes: 39 percent say risk discussions have become more closely integrated with strategy, 32 percent say reporting on emerging risks has improved, and 22 percent have increased the use of scenario planning.
Lee Henderson, leader of EY Americas Center for Board Matters and a partner in this research, says it’s clear boards are leaning in on risk oversight, but time alone doesn’t translate into impact. “The opportunity is to use that time to shape strategic choices by connecting risk insights to the assumptions, trade-offs and inflection points embedded in the strategy,” he said.
Bert Alfonso, who serves as audit chair at Eastman Chemical and as a member of the board of Kraft Heinz, says a “rise in the competitive environment, geopolitical environment and increasing speed of technology disruption” has elevated risk management on the board agenda in recent years.
Like Henderson, Alfonso says it’s ‘extremely important’ for boards to support those conversations with a clear translation from management of the strategic implications and trade-offs of this heightened risk.
Most directors are satisfied with the quality of reporting and metrics they receive from management regarding risk factors and how that risk impacts strategy: more than 70 percent rate the reporting they receive as robust, or as having only non-material gaps.
Still, strong marks for reporting sit alongside more modest movement in practices that can help boards apply risk information: 32 percent say emerging-risk reporting has improved, 29 percent say their board has increased engagement with management below the C-Suite on risk topics and 22 percent say they have increased the use of scenario planning.
‘Out of Our Control’
Roughly 80 percent of directors say they are fully or mostly confident their board’s approach adequately addresses today’s risk environment. At the same time, 42 percent say their company would be significantly or severely disrupted if a critical vendor failed—and only about one-quarter say their board regularly receives reporting on concentration or dependency risk, such as overreliance on key vendors.
A similar share say they regularly receive reporting on due diligence or onboarding assessments for third-party relationships.
Several directors surveyed pointed to technology—primarily AI developments—as the bigger risks today, alongside “black swan events or things out of our control,” said one director echoing others.
Third party risk can be perceived as an external risk, but it doesn’t have to be, says Henderson. “Boards are aware of how critical third parties are to performance, but our findings raise questions about whether visibility into where risk is concentrated has kept pace,” he said, adding this can cloud the board’s view into where dependencies are building, and risks could cascade across the business.
At Lucid Diagnostics, director Jacque Sokolov says the board has created a separate committee to strengthen risk oversight—a committee which he currently chairs. “The Board Quality, Compliance and Technology Committee backstops the Audit Committee in most non-financial risk matters,” he said.
Risk Appetite: Understood but Often Undocumented
Fewer than half of directors (43 percent) say their company’s risk appetite is formally articulated and documented. Another 29 percent say it is articulated but not documented, 25 percent say it is broadly understood but not documented, and 3 percent say it is not formally articulated or documented at all.
Meanwhile, 58 percent say their board reassesses the company’s risk appetite continuously or as risks evolve. The combination raises a practical question about consistency: boards are revisiting risk appetite on a rolling basis, even though most say that appetite is not formally documented.
The risk-strategy gap shows up elsewhere in other Corporate Board Member research. In the 2025 What Directors Think, 42 percent named strategy oversight as their single biggest challenge, ahead of cybersecurity for the first time in years.
More recently, a year-long study conducted with the Long-Term Stock Exchange finds boards now devoting 36 percent of meeting time to operational and financial performance, compared with 25 percent to strategy and long-term positioning. And only 19 percent use scenario planning beyond a five-year horizon.
Taken together, the data suggests boards are giving risk more time. What is less clear is whether that time is giving directors a longer view of emerging risks—or a fuller view of the exposures already in front of them.
