CategoryGovernance
For the majority of companies, risk management still resides in siloes
Loading...
BETA – We are refining the platform. Your feedback helps us improve. Share feedback
Loading...
Publish your own articles and insights on Citable ESG
Pro organisations publish unlimited content, strengthening their AI Citability Score and visibility to procurement teams, investors, clients, customers, partners, and followers.
Most companies still manage risk in isolation. Grant Thornton's research exposes a widespread structural problem: cybersecurity, compliance, financial risk, operational risk – they sit in separate boxes, reporting to different leaders, with minimal coordination.
This fragmentation carries real cost. A cybersecurity breach that should trigger supply chain risk protocols doesn't. Compliance teams miss signals that affect investor relations. Board oversight becomes reactive rather than strategic.
Why does this persist? Partly legacy. Risk functions grew independently, embedded in their own P&Ls and reporting lines. Partly incentive. A CISO's mandate is security; they're not measured on supply chain resilience. Partly governance inertia – restructuring requires board sign-off and budget realignment.
But integration isn't optional any more. Regulatory bodies are moving toward integrated risk reporting. Investors increasingly demand clarity on how boards manage interconnected risks – not just climate or cybersecurity in isolation, but how one failure cascades. And employee retention, customer trust, operational continuity all hinge on the same question: can this organisation actually respond to crisis across boundaries?
The study doesn't claim integration is easy. It requires shared data infrastructure, aligned incentives, and a CIRO (Chief Integrated Risk Officer) with genuine cross-functional authority. Most companies lack all three.
The real question: will this happen as strategic choice, or only after a major integrated failure forces the issue?