Fewer than half of 1,100 leaders have the integrated risk model two-thirds call a priority

Every figure here is Grant Thornton's, as reported by cpapracticeadvisor.com. The two partners quoted lead service lines at the firm: Tony Buffomante is national managing partner of Cyber & Risk services at Grant Thornton Advisors LLC, and Tom Puthiyamadam is national managing partner of Advisory Services there ^[15]. A survey that finds a shortfall in the field those practices work in can still be right, but it is one source. Buffomante said, "Many organizations have visibility into individual risks but lack a clear view of how those risks connect across the enterprise." ^[4]

The 19-point difference between the 67% who call enterprise risk management a top priority and the 48% who have implemented a model ^[17] is softer than it looks. The 48% counts organizations that have implemented "integrated risk management or an enterprise-wide operating model" ^[3], and the "or" admits firms that have only one of the two.

The more interesting number is the third. If 48% have implemented, 52% have not ^[18], yet 61% say insufficient integration leaves an incomplete view ^[20], so at least 9 points of respondents would sit in both groups ^[21]. That holds only if the three figures describe the same respondents, and the figures as reported do not say they do. If they do, owning a model has not been enough to produce the view. If they do not, no overlap is implied and the survey says what it appears to say, that roughly half the firms lack a model. A different respondent base for the 61% would prove the first reading wrong.

Data is the stated obstacle, and it is also the other top priority: data, analytics and reporting ranks alongside enterprise risk management at 67% ^[6]. Puthiyamadam said, "Organizations are generating more risk data than ever. But data alone doesn't improve decision making." ^[8] A counter-reading is sequencing. Firms may be fixing data first and building the model second, in which case part of the 19 points is timing, since the 67% priority runs over the next 24 months ^[2].

Grant Thornton ties the reliance on outside providers to talent, with 52% naming cybersecurity talent and skills shortages as a key challenge ^[14]. A detection service can be contracted. In our view the items Buffomante lists as the price of a shared view, "common risk definitions, integrated data, clear ownership and governance that spans functions and business segments" ^[5], are decisions inside the organization, and a detection contract does not make them.

The AI numbers need the same care. The 57% who named AI governance and AI use a top source of future risk or regulatory scrutiny are business leaders ^[9]; the 26% reporting advanced, integrated AI governance are IT leaders only ^[10]. The 31-point difference ^[19] compares two groups of respondents, so it shows direction only.