Boards are spending more time talking about risk, according to new research conducted by Corporate Board Member and EY Center for Board Matters among more than 150 public company directors.
Sixty percent say their boards have increased the time devoted to risk on the full board agenda over the past two years. And more than 70 percent characterize reporting on timely risk indicators, strategic implications, reassessment triggers and forward-looking risks as either robust or having only non-material gaps.
All of that sounds encouraging. But EY Center for Board Matters sees a tension in the numbers.
“Many boards have strengthened the inputs to risk oversight, but there may be a need for a stronger connection between risk and strategy,” said Lee Henderson, EY Center for Board Matters leader. “The opportunity now is to use risk insights to challenge assumptions, test scenarios and recognize when changing conditions may require a different course of action.”
According to the survey, just 39 percent of directors say their boards have more closely integrated risk discussions with strategy, and only 22 percent report increasing their use of scenario planning. Yet scenario planning and stress testing tops the list of capabilities directors say need strengthening, followed by understanding interconnected risks and integrating risk with strategy.
The findings suggest the bigger gap may not be in the information management is providing but in what boards do with it.
EY’s analysis points to the need for more room on the board agenda to challenge assumptions, examine alternative scenarios and debate the trade-offs embedded in strategic decisions. Rather than waiting until management has a fully developed answer, boards can encourage executives to surface emerging problems while there is still time for directors to influence the response.
“The most effective boards create an environment where emerging issues are discussed early, alternative scenarios are explored and risk insights help shape strategic decisions.”, said Henderson. That also means bringing risk leaders more directly into strategy discussions.
The survey found a sizable gap in how directors view the risk function itself: 46 percent rate its performance on controls and compliance at the highest level, compared with only 25 percent for identifying emerging risks and 24 percent for informing strategic decisions.
Defining Risk Appetite
Another opportunity EY highlights is risk appetite.
Only 43 percent of directors say their organization’s risk appetite is formally articulated and documented. Yet 58 percent say their board continuously reassesses risk appetite as conditions evolve.
That raises a practical question: What exactly is being reassessed when the baseline itself has not been formally defined?
EY’s point is not documentation for documentation’s sake. The value comes from forcing management and the board to define the risks the company is prepared to take in pursuit of strategy—and then test those boundaries against real decisions involving growth, capital and investment.
In other words, making risk appetite part of annual strategy discussions rather than treating it as a standalone governance exercise, and then revisiting it as business conditions change.
The Risks Outside Your Walls
Third-party risk offers perhaps the clearest example of why that matters.
Four in five directors say they are fully or mostly confident that their risk oversight approach addresses today’s environment. Yet 42 percent say a failure by a critical external provider would significantly or severely disrupt their company.
The reporting directors receive also skews toward events and compliance rather than emerging dependencies. Seventy-five percent regularly receive reports on third-party incidents and 60 percent on regulatory or compliance exposure. Only 27 percent receive regular reporting on concentration or dependency risk, and 26 percent on due diligence and onboarding assessments.
EY recommends pushing management toward a more forward-looking view: Which vendors or partners does the strategy depend on? Where are dependencies building? What trade-offs are being made between efficiency and resilience?
Ultimately, better oversight requires boards to establish not only what they are watching but what would cause them to change course. Nearly two-thirds say clear thresholds or triggers for strategic reassessment are critical to effective risk discussions. The next step is connecting those triggers to the assumptions underpinning strategy, establishing clear escalation paths and modeling scenarios beyond the most likely outcome.
That may be the larger message in the findings. Boards have already made risk a bigger part of the agenda. The next question is whether that additional attention allows them to see disruption sooner—and make different decisions because of it.
