Red flags of ineffective risk management

I congratulate José David Pino for his brave attempt to call attention to ineffective risk management in his article for the IIA’s magazine, On the Frontlines: How Mature is Your Risk Management?

He correctly reports something I earlier shared in a blog post:

In the 2023 report, The State of Risk Oversight: An Overview of Enterprise Practices, published by the American Institute of Certified Public Accountants and NC State, only 29% of risk leaders surveyed say their organization’s risk management oversight processes are mature, while 35% describe them as evolving, 21% say they are in the development stage, and 15% indicate they are very immature.

It’s important to note that these answers came from more than 400 organizations, including large organizations (with revenues greater than $1 billion), publicly traded companies, financial services entities, and not-for-profit organizations.

Further analysis reveals that 17% of the respondents say they have no structured risk management processes for identifying and reporting top risk exposures to the board. An additional 18% of respondents indicate that they mostly track risks by individual silos of risks, with “minimal reporting of top risk…