Executives call risk management an advantage at one-sixth the rate they report rising risk

Put the two headline figures on one base and the gap becomes a head count. 69% of 331 is about 228 executives ^[14], 11% is about 36 ^[15], and the ratio is roughly 6.3 to 1 ^[16] (the percentages are rounded, so the counts are approximate). Part of that ratio is the question. According to the AICPA's account, the 11% were asked whether their risk process provides a unique strategic or competitive advantage ^[4], and a function that keeps losses out of the accounts without being distinctive to the firm could fairly answer no. We think the wording explains some of the gap, though not all of it.

Take the 30% who call their oversight mature or robust ^[7]. If every one of the 11% sits inside that 30%, then at least 19% of respondents, or rather roughly 63 executives, rate their process mature and still do not call it an advantage ^[19][20]. The roundup does not say how the two groups overlap, so 19 points is a floor.

The planning figures run the other way. Only 29% have formally articulated a risk appetite in the context of strategic planning ^[8], so 71% have not ^[17]. Only 22% say their process explicitly engages leadership on risks five to ten years out ^[9], which leaves 78% who did not say so ^[18]. Both remainders are larger than the 69% who say risk has grown more complex ^[3]. The report credits steady progress over 17 years in governance structures and processes ^[13].

We would be wrong if the 29% with a formal appetite reported an advantage at the same 11% rate as everyone else, because then appetite-setting is not what separates organizations that get value from the function. The roundup does not include that breakdown, prior-year figures, spending, or results by sector or company size, and it is a summary of AICPA announcements, not the report. The counter-thesis is that risk work done well goes unnoticed, in which case the 11% understates the function and the 29% and 22% become the fairer tests.