Corporate Boards May Be Blind to Risks

Unique Survey Finds Critical Gap Between What Boards Think Is Going On and What's Really Happening

News provided by

Oct 15, 2019, 10:00 ET

LAKE MARY, Fla., Oct. 15, 2019 /PRNewswire/ -- Boards are significantly overconfident when it comes to addressing the thorniest issues facing organizations today. Board members have greater confidence in their organizations' ability to manage key risks than members of management actually do, according to a breakthrough survey of board members, executive management, and chief audit executives released by The Institute of Internal Auditors (IIA).

The reason for the skewed sense of security on risks ranging from data protection and new technology to culture and sustainability: Boards may receive information from management that's incomplete or misleading, then compound the problem by failing to ask critical questions.

OnRisk 2020: A Guide to Understanding, Aligning, and Optimizing Risk offers a comprehensive view of organizational risk from those who manage it. Through quantitative and qualitative surveys, this first-of-its-kind report lays out how each group perceives and communicates key risks and provides important benchmarking to help organizations align and enhance their risk management strategies and execution.

Among the report's key findings:

There is a critical misalignment between how executive management views an organization's capability to manage risks and what is communicated to boards, leading to board members believing risks are better managed than they are.
A perception of "acceptable misalignment" on risk – some respondents believe some misalignment is to be expected – is prevalent.
Some industries are lagging in adopting a systematic approach to risk management. These include health care and retail/wholesale, as well as the public/municipal sector.
Among 11 key risks reviewed in the report, cybersecurity and data management and new technology are especially susceptible to critical knowledge deficits.
Data management/collection and new technology, data ethics, and sustainability risks are expected to grow in relevance in the next five years.

"Acceptable misalignment on risk is a risk itself that's shortsighted and simply unacceptable," said IIA President and CEO Richard F. Chambers, CIA, QIAL, CGAP, CCSA, CRMA. "The burden is on management to provide the board with an accurate picture of risks that may negatively impact the organization as well as those that present opportunities. But board members also must seek out informed and objective assurance on the information they receive, and internal audit is uniquely positioned to provide that truly independent and enterprise-wide perspective."

The inaugural OnRisk report is a significant step in collecting stakeholder perspectives on risk and risk management in support of good governance and organizational success. The combination of quantitative and qualitative research provides a robust look at 11 top risks facing organizations and allows for both objective data analysis and subjective insights based on responses from risk management leaders. The qualitative survey is based on 90 in-depth interviews with professionals in North American boardrooms, C-suites, and internal audit functions. The quantitative survey involved more than 600 internal audit leaders, primarily chief audit executives.

"It is vital for organizations to not only develop strategies to address risks, but to have an added layer of assurance that examines the effectiveness of the risk strategy and its components," Chambers said. "No single report provided a holistic view of risk based on the perspectives of the three key players in risk management — until now."

Click here for a full copy of the report.

About The Institute of Internal Auditors
The Institute of Internal Auditors (IIA) is the internal audit profession's most widely recognized advocate, educator, and provider of standards, guidance, and certifications. Established in 1941, The IIA today has more than 200,000 members from more than 170 countries and territories. The IIA's global headquarters are located in Lake Mary, Fla., U.S.A. For more information, visit www.theiia.org or www.globaliia.org.

SOURCE The Institute of Internal Auditors