Remaking risk oversight: How boards can support risk-aligned strategy

Risk oversight has traditionally been delegated by the board to the audit or risk committee, with the full board having annual or periodic risk discussions.¹ Our research shows that this is changing. A clear majority (60%) of the directors we surveyed report spending more time on risk at the full board level over the past two years.

Boards have been spending more time on risk at the full board level in the past two years (2024–2026)*

However, more time does not necessarily mean greater impact. Many directors see the integration of risk and strategy as a critical gap: 38% of our respondents explicitly cited it as an area that needed improvement. Moreover, 38% also said their boards needed to better understand interconnected and systemic risks, and 44% said they need stronger scenario planning and stress testing. These capabilities are becoming more important as risks increasingly cut across company silos and span multiple functions, creating a greater need to connect risk across more dimensions of strategy and operations. As a result, these areas – the top three where respondents saw room for improvement – are precisely those most needed to oversee strategy in an environment full of unforeseen crises and opportunities that cascade across the enterprise in unexpected ways.

Directors see the most room for improvement in areas that support risk-strategy integration*

Management reporting from the Risk function is the foundation of board and committee risk discussions. Interestingly, directors don’t view reporting shortfalls as a major challenge. Only 15% cited the quality of management reporting as a primary area for improvement, and more than 70% viewed reports in four key areas as robust or with only non-material gaps. This suggests that, where reporting is concerned, the need for improvement lies less in the information itself than in how boards engage with it. Do the board’s processes and culture create space for rigorous discussion about the strategic implications of emerging risks? Are directors challenging assumptions, exploring alternative scenarios and debating trade-offs? Are they engaging early, even before a resolution is clear, so that they can influence direction rather than react to outcomes?

Even when board members consider today’s reporting to be strong, they must examine the extent to which it truly helps them anticipate what lies ahead. The goal, as one director said, is “to be able to look through the windshield rather than the rear-view mirror.” Board leaders who are not continually raising the bar on information quality in today’s environment may be putting their boards at risk of missing critical signals. The good news is that advances in technology are rapidly expanding what is possible, and many management teams are experimenting with AI tools that can deliver forecasting and modeling at unprecedented levels. Boards are also increasingly seeking outside-in perspectives such as benchmarking and third-party reviews to challenge internal assumptions and stay up to date on fast-evolving risks. 

Closing the risk-strategy gap calls for open, cross-functional engagement

As directors have shared, strengthening risk oversight beyond information and inputs begins with making room on the agenda for emerging priorities and using meeting time for dialogue rather than listening to presentations. This creates space for board members to routinely challenge management’s assumptions and probe scenarios where compounding risks could shape strategic outcomes. Doing this well depends as much on culture as on process: The strongest boards create an environment of trust by engaging constructively rather than reactively, increasing management’s comfort with surfacing issues not discussed previously. Ongoing informal connections through pre-meeting alignment sessions, rolling agenda reviews, and regular touchpoints between risk leaders and committee chairs can help improve communication. 

Leading boards also link risk with strategy by combining and coordinating input from strategy, risk and assurance leaders. For example, a recently retired Fortune 100 risk executive shared that their company’s board would annually have the head of strategy report on top risks and mitigation plans, followed by the head of Internal Audit sharing the audit plan. This helped the board understand risks at a strategic level along with receiving assurance on how they would be mitigated. Similarly, another risk executive stressed the value of their board’s formal process to involve the Chief Risk Officer in strategy discussions. In one instance, this discussion delayed a product launch until risk mitigation capabilities were sufficiently mature. A Fortune 500 bank director also noted the value of boards “not just looking to the risk executive” but “pressing business unit leaders – the owners of the risk” to talk about how they’re managing risk and accounting for it in the strategy.

It’s not always easy to achieve this level of dialogue. For example, a difficulty our interviewees repeatedly identified is the reluctance of some management teams to raise issues before they have a fully formed response. “Executives don’t want to say anything until they have a solution,” observed one Fortune 500 risk executive, “but problems do not age well.” To help shift the culture towards earlier, more productive discussion, board members can reinforce that they want to hear about risks while the situation is still developing and that management doesn’t need to solve every problem before bringing it to them. One director described a deliberate effort by their board to send exactly that message: “bring us your unfinished work, have the courage to raise issues early, and we will be supportive.”

Finally, boards must help companies navigate the delicate balance between boldness and restraint. Enterprise resilience means not only protecting the core business but taking considered risks to pursue strategic growth, and boards play a valuable role in keeping opportunity part of the conversation. One director at a global software company emphasized their board’s value in prompting “very healthy discussion” around the opportunities that changing risks may create. At the same time, boards will periodically have reason to challenge management’s optimism around strategy. Contributing to the risk of over-optimism, decision-makers may exclude risk teams from key business and strategy discussions because they consider risk a blocking function instead of an enabling one. Boards can help combat this by making clear that they expect management to involve the Risk function in all significant decisions. 

For more insights and ideas on practices that strengthen board effectiveness, see the EY Center for Board Matters resources on Board effectiveness.

Actions boards can take to advance integration of risk into strategy

• Create time on the full board agenda, with both strategy and risk executives at the table, to discuss how risks (both alone and compounded) translate into strategic implications and trade-offs. 
• Ask how management is using AI to identify potential cascading impacts that may not be immediately visible to the executive team. 
• Engage in tabletop exercises and crisis simulations that move the board from abstract risk discussions to live experience that can road test the company’s governance and response capabilities. 
• Anticipate the optimism embedded in strategic plans and ask questions that empower the Risk function to provide an effective counterbalance. For example:
  • If we’re wrong on this, what will we wish we had challenged more directly today?
  • Where has the Risk function pushed back or expressed concern, and how has that been incorporated?

• Ask how the Risk function’s budget and capital allocation aligns to the company’s strategy and emerging risks that may affect the company.

No business operates, or grows, without taking risks. The real questions revolve around which, how much, and when to adjust. This is why it’s essential for boards to clearly define the company’s risk appetite.

Surprisingly, our survey found that risk appetites often remains implied rather than fully spelled out. Fewer than half of directors (43%) reported that their company’s risk appetite is formally articulated and documented — a percentage that drops to 30% when excluding financial services companies, where regulations mandate stricter procedures around risk appetite. 

Meanwhile, 29% of our respondents said their company’s risk appetite is articulated but not documented, and 25% said it is understood broadly but not documented. This is despite the fact that a majority of directors (58%) also said their board continuously reassesses the company's risk appetite as conditions change. It’s fair to ask how effective a reassessment can be without a clearly defined baseline.

Risk appetite is often left implied rather than explicitly stated

Notably, directors whose boards document their company’s risk appetite are more confident in risk oversight than those whose boards do not. Among respondents who said they were confident in their board’s risk oversight approach, 50% reported having a formally articulated and documented risk appetite. This compares with only 23% among less confident directors.

Several directors we spoke with, however, emphasized that documentation in itself matters less than the conversations required to develop it. The process of defining risk appetite creates a clear, shared understanding between management and the board about the calculated risks the company is willing to take in pursuit of its objectives. One director noted that setting risk appetite may initially feel “like an academic exercise,” but quickly becomes a practical discussion about strategy and decision-making: “Why are we comfortable with this level of residual risk? What decisions would – or would not – we make within these boundaries? [The process] stimulates discussion about strategic choices.” 

Based on these observations, we encourage boards to document risk appetite without allowing the process to become a check-the-box exercise. Instead, it should be a proving ground for decisions about how best to approach risk and their impacts, prompting deeper conversations that yield the clarity and consistency that our interviewees rightly viewed as critical.

Boards can strengthen these discussions by thoughtfully considering management inputs on matters such as strategic objectives, the company’s current risk profile, business conditions and stakeholder expectations. As the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) guidance highlights², risk appetite should be tested against real-world decisions and refined over time as conditions change. “I don’t want someone to just say ‘We can’t do that because of our policy,’” said one director; “I’d want us to take the time to challenge the policy.”

Actions boards can take to formally define risk appetite

• Prioritize articulating and documenting risk appetite as part of the annual strategy setting discussions.
• Incorporate risk appetite into board discussions on strategy, growth and major investments.
• Have risk leaders present not just to the audit or risk committees but also to the full board on key risks that may threaten strategy or growth.

Third-party risk in a highly interconnected world stands out as increasingly critical and, for many boards, insufficiently addressed. As companies integrate systems with external providers and build more complex ecosystems, third parties can create multiple points of failure, such as cyber incidents, operational breakdowns and critical input unavailability. Clear visibility into the most important third parties is essential for today’s resilient enterprise. 

Here, we saw a curious disconnect. Eighty percent of our surveyed directors reported that they are fully or mostly confident that their risk oversight practices effectively address today’s risk environment. Yet 42% also said that their company would be significantly or severely disrupted by a critical vendor failure. The discrepancy between overall confidence and perceived vulnerability to third-party disruptions points to a need for boards to more closely examine how these risks are understood, monitored and addressed.

One frequent challenge is limited visibility. According to our survey, much of the risk reporting that boards receive is backward-looking or compliance focused. Seventy-five percent of directors said that they get regular reporting on third-party incidents (breaches, outages, service failures, and the like), and 60% receive regular reports on regulatory/compliance exposures (such as third-party compliance issues). In contrast, fewer than half of directors regularly receive reports in more forward-looking areas such as risk exposure overviews (48%), concentration and dependency risk (27%) and due diligence and onboarding assessments (26%). These latter insights are important to helping boards understand how the company is addressing emerging threats to the business ecosystem, including evolving cyber exposures and dependencies as frontier AI reshapes cyber risk.

Third-party risk reporting is more backward-looking than forward-looking (% of all directors)*

These findings suggest that boards may wish to push management to view reporting through a more future-focused lens. Detailed reporting on past performance and compliance provides assurance, but it needs to be complemented with anticipatory insights to proactively guide enterprise resilience. 

Most of all, boards should consider whether long-standing approaches to third-party management remain effective today. Key questions to ask management include: What assumptions about third parties does our strategy rely on? How are those dependencies monitored? Are we driving to lowest-cost suppliers at the risk of losing needed redundancies? Are we knowingly making tradeoffs that raise third-party risk exposure to unacceptable levels? Do our processes enable the company to act decisively on what we are seeing? Through these discussions, boards can strengthen the company’s ability to anticipate, withstand and respond to disruption originating beyond its direct control. 

Download the full report.

Actions boards can take to help enable third-party risk preparedness and mitigation

• Identify critical assumptions about third parties that underlie the strategy, and ask management how dependencies are being monitored.
• Thoroughly understand management’s processes for identifying, onboarding and monitoring third party providers, partners, and alliances.
• Request that management reporting provide sufficient insight into early-warning signals like concentration and dependency risk.
• Expect management to report on key decisions involving third parties along with the associated risks.

Traditional risk assessment approaches built on periodic reviews and static assumptions will fall short when conditions shift quickly and unexpectedly. Risk intelligent organizations regularly track market and business indicators and hold themselves ready to act when these signals reach a certain threshold. This trigger-based approach is fundamental to keeping risk management in step with the pace of business. As one director noted, while such indicators rarely warrant wholesale shifts in strategy, they can help boards continuously assess and adjust a company’s approach within specific risk areas such as cybersecurity or commercial practices. 

The directors in our survey broadly recognize this call to action. Nearly two-thirds (63%) said that clear triggers or thresholds for strategy reassessment are critical to effective risk discussions. Further, confidence in risk oversight closely tracks the quality of management reporting on these indicators. Seventy-nine percent of directors who are confident in their board’s risk oversight say they receive robust threshold-related reporting, nearly twice as many as their less confident peers (43%). 

Predefined risk indicators can help directors and executives know when to revisit strategy, but the enterprise must first embed them in risk management. This involves a few challenges. Defining appropriate triggers is inherently difficult, especially in large, complex organizations where risks and risk thresholds may vary across business units. Additionally, poorly calibrated triggers can lead to over- or under-reaction, underscoring the need for thoughtful design and ongoing refinement. And while advances in AI and analytics are making it easier to continuously track signals, deciding what to do when those signals arise is harder. Organizations need to specify clear escalation paths, decision rights and potential actions that allow them to move quickly when thresholds are reached. 

Boards play a vital role in prompting the enterprise to overcome these hurdles. Their responsibility is to oversee that management is tracking the appropriate signals and using them to make timely adjustments, escalating issues promptly when needed and bringing the strategic implications forward.

Actions boards can take to guide a threshold-based approach to risk management

• Oversee how management articulates the assumptions underpinning strategy and what might potentially impact them.
• Create triggers based on these fundamental assumptions that can signal when strategy or elements of the strategy need to be reassessed.
• Confirm that management is taking (or enhancing) a dynamic approach to risk assessment rather than a time/process driven one so that market signals are seen as they arise. 
• Understand who is accountable for which risks and whether the path to escalation is clearly defined. 
• Oversee how management is tracking not just the ‘most likely’ scenario but others with potential for disruption. 
• Encourage management to model for a broader set of circumstances, including low probability/high impact scenarios by leveraging newer AI-enabled tools that can work at scale.

Advancing risk oversight as volatility continues

Boards are highly regarded for the wisdom and experience they bring to oversight and guidance. Yet the reality is that business risks are becoming more frequent, interconnected and difficult to predict with precision. What companies are facing today and tomorrow will look different from what many directors have experienced in the past. To effectively oversee risk in the service of enterprise resilience, boards must be willing and able to adopt dynamic approaches that may go against past practices and expectations. Future success begins with acknowledging and embracing the need for change.

Fiona Kauffman and Junko Kaji contributed to the writing of this article.

Methodology

Corporate Board Member surveyed 157 public company directors using a questionnaire developed with Ernst & Young LLP (EY); the EY Center for Board Matters analyzed the anonymized results. The respondents span a variety of industries and public companies with revenues ranging from less than $300m to over $10b. They also represent a range of years of board service, with most the largest number (48%) having served as a director between three and ten years. We supplemented the survey results with in-depth interviews with audit or risk committee chairs representing seven companies (including three Fortune 1000 companies), and with four current or recently retired Fortune 500 risk executives.

Summary 

Boards are spending more time on risk, but oversight must evolve to better connect emerging signals with strategy. Based on survey findings and director and risk executive interviews, we suggest how boards can strengthen risk-strategy integration, define and reassess risk appetite, improve visibility into third-party dependencies and use predefined thresholds to know when strategy may need to shift. These practices can help boards move beyond risk mitigation and guide management toward greater resilience, agility and long-term value creation.