Enterprise risk oversight anchored primarily in audit was once sufficient, but today, it is a blind spot, writes Adley John Fisher, risk management professional. Boards that continue relying predominantly on assurance-based visibility may remain formally compliant while becoming strategically blind to emerging enterprise exposure.
Over the past two decades, boards have formally expanded their responsibility for enterprise risk oversight. In practice, however, the governance structures through which most boards oversee risk remain deeply anchored in audit and financial reporting paradigms. While this design was historically appropriate, it has become increasingly misaligned with the sources of today’s most consequential corporate failures.
Audit-dominated risk oversight has transitioned from a historical standard to a modern governance liability. Current board-level risk architectures tend to systematically privilege financial assurance over proactive risk intelligence, can suppress weak operational and technical signals and leave boards exposed to failures that are foreseeable in retrospect but invisible in advance.
The structural legacy of audit-anchored risk oversight
Board-level risk oversight did not evolve by accident. Modern governance frameworks grew out of a period in which financial integrity, regulatory compliance and internal controls represented the dominant sources of corporate risk. In that context, anchoring risk oversight within audit committees was rational, efficient and widely considered the proper governance standard.
But risk has evolved. Today, the threats most likely to destabilize organizations increasingly originate outside traditional financial reporting domains. They arise across cyber, operations, supply chains, technology, culture and strategy. As complexity has increased, so has the strain on governance structures.
As highlighted in the 2009 Walker Review, governance reforms after the financial crisis explicitly recognized the need to reduce overload on audit committees and introduced the concept of separate board risk committees to improve forward-looking risk oversight. Empirical evidence reinforces this structural pattern. As of 2026, nearly 80% of S&P 500 companies assign cybersecurity risk oversight to the audit committee with fewer than 10% assigning it to a dedicated risk committee.
This structural legacy creates a pull toward audit-centric thinking, and the methodology heavily favors risks that are easy to quantify, audit and map to existing internal controls but may under-emphasize emerging systemic threats that lack historical precedent or measurable assurance indicators. The limitation is not audit itself but its design, which is to assess whether controls work, not whether underlying assumptions about risk still hold.
At its core, this reveals a tension between retrospective assurance and proactive risk intelligence. Audit is necessarily backward-looking in its primary function, validating that controls function as intended. Risk oversight, by contrast, must be forward-looking, assess emerging exposure and anticipate how complex systems may fail under stress before control failures become visible.
When risk is governed primarily through an audit lens, boards may inadvertently receive lagging indicators presented as forward-looking assurance. This creates a dangerous paradox where strong assurance over existing controls grows exposure to risks those controls were never designed to address. Major failures like Wirecard and Carillion illustrate this pattern as partial contributing factors rather than sole causes. Boards were not short of data, but the data was filtered through an audit paradigm that prioritized compliance while obscuring deeper operational, cultural and technological fragilities.
The filtering of weak signals
Today, the earliest indicators of significant failure rarely appear first in financial statements. More often than not, they emerge as weak operational or technical signals. It starts with a subtle deterioration in safety culture or recurring technology workarounds. It looks like near-miss incidents, data governance weaknesses, supply chain dependencies, talent capability gaps or abnormal operational behaviors. Individually, these issues appear manageable. Collectively, they are systemic.
In audit-dominated structures, these signals often require translation into financial, compliance or control-based language before escalation to the board. This translation process acts as a corporate filter.
The systemic blind spots caused by these filters are reflected in governance case studies like Boeing’s 737 MAX, where cultural, engineering and escalation failures prevented early warning signals from reaching the board effectively. Signals that are operationally significant but not yet financially measurable are often deprioritized, softened or absorbed within management reporting layers before reaching directors. As a result, boards may maintain strong visibility over control compliance while possessing limited visibility over the organization’s true exposure landscape.
Recent governance failures demonstrate that boards often struggle not because information was entirely absent but because the information reaching them had already been filtered through assurance-oriented reporting pathways. These pathways naturally prioritize control effectiveness, policy adherence and measurable compliance metrics over unresolved ambiguity, technical complexity or systemic vulnerability. Governance visibility becomes strongest where uncertainty is lowest, while the organization’s most consequential emerging risks frequently remain outside the board’s direct field of vision until failure hits.
Out of Your Technological Depth? It’s Your Duty to Say So.
If a director can admit to not knowing enough to make a decision, it’s a sign the board has built and reinforced honesty
Read moreDetailsStructural misalignment at board level
Realistically, incremental enhancements to risk registers or reporting templates will not fix this. If the underlying oversight architecture remains unchanged, the structural misalignment stays. Instead, boards must fundamentally re-examine several foundational assumptions:
- Mandate: Is enterprise risk oversight concentrated within committees whose expertise and historical orientation remain primarily financial?
- Focus: Does board reporting primarily emphasise control effectiveness and assurance outcomes, or does it also provide visibility into emerging exposure, operational uncertainty and systemic fragility?
- Escalation pathways: Are non-financial risks elevated only after they become measurable in financial or compliance terms?
- Expertise: Does the board consistently engage sufficient operational, technological, cyber, safety or systems-level expertise when overseeing complex enterprise risks?
- Information architecture: Are directors receiving sufficiently unfiltered operational perspectives, or only management-curated assurance summaries designed around existing reporting structures?
Research increasingly supports a clearer separation between audit assurance and enterprise risk oversight functions, particularly within large or operationally complex organizations. Such separation is not intended to diminish audit’s importance but to recognize that assurance and strategic risk oversight are distinct governance disciplines requiring different orientations, information flows and expertise.
But let’s be realistic — simply splitting into two entities may backfire. One wrong step and we end up creating information silos, turf wars over who owns what and a mountain of duplicated paperwork that bombards management while critical risks slip right through the cracks between committees.
How to actually build a modern risk structure
To make this work in the real world, a board should consider three practical changes:
Separate the work, but connect the people
The audit committee needs to keep its eyes firmly on the rear-view mirror, focusing on financial integrity, accounting controls, overall operational controls and legal compliance. At the same time, a dedicated risk committee needs to look through the windshield, focusing entirely on forward-looking vulnerabilities and systemic operational threats.
To prevent an oil-and-water situation between committees, the board should mandate that the chair of each committee sits as a member of the other, the old “in my shoes” method. Even better, bring both committees together twice a year for joint sessions to look at the overlap, like how a massive cyber breach would impact financial liability or the hidden compliance risks of deploying new AI tools.
Create a direct line to the chief risk officer
We have to stop looking at risk through a filter. The chief risk officer needs a direct, independent reporting line straight to the risk committee that is completely separate from the CFO’s office and parallel to how internal audit talks to the audit committee.
To ensure this line carries real value rather than polished corporate speak, board reporting should include explicit sections for unresolved operational anomalies and emerging risk themes, enabling directors to observe early warning signals rather than only formalized risk summaries.
Put ‘systems-native’ directors in the room
A new committee structure loses its effectiveness if the people sitting at the table don’t change. The traditional board matrix, usually packed with retired CEOs, CFOs and corporate lawyers, needs an injection of different real-world experience. If a company operates in a complex environment, the board must recruit at least one operationally native director.
These are people who have spent their careers running cybersecurity operations, managing messy supply chains, leading engineering teams in high-stakes industries, traveling from one workplace to another and understanding a screw press like it’s the back of their hand. When management presents a risk report, these directors know how to push past the talking points and stress-test the actual assumptions.
Conclusion
The issue is not the value of audit but its structural dominance within modern risk governance architectures. Governance systems designed around financial integrity and control assurance are increasingly ill-equipped to oversee risks that emerge from operational complexity, technological interdependence, organizational culture and systemic fragility.
Boards that recognize this structural gap and adapt by incorporating broader domain expertise, diversified reporting pathways and more direct exposure-focused intelligence, will likely be better positioned to fulfil their fiduciary responsibilities in substance rather than merely in form.
Adley John Fisher is a risk management professional with experience in enterprise and operational risk across complex organizations. He has advised audit and risk committees on enterprise risk management frameworks and writes on how organizational structures shape risk visibility and decision‑making. He is the author of the risk culture management framework (RCMF), a practitioner model exploring the implementation gap in organisational risk culture. 
