The accountability deficit: why 49% of Fortune 500 risk functions cannot reach the board in time

A structural analysis of risk function organizational positioning across the Fortune 500, completed in the fourth quarter of 2025, produced a finding that should concern every board with a risk committee: 49% of organizations surveyed have risk function reporting structures that, in a material risk event requiring immediate board-level decision-making, would require the risk signal to pass through three or more management layers before reaching a board member. The median time to board notification under those structures, based on modeled escalation scenarios, was 72 hours. In a rapidly evolving risk event, 72 hours is governance failure.

The structural problem

The accountability deficit has a specific organizational anatomy. In the majority of cases identified in the analysis, the risk function is positioned within the finance or legal organization, reporting to the CFO or General Counsel. This positioning reflects the historical origins of enterprise risk management as a financial and legal compliance function, which is where it lived before risk management became a strategic discipline.

The problem with this positioning is not that CFOs and General Counsels are incompetent stewards of risk information. The problem is that the CFO's office and the legal department have their own information and reporting rhythms, their own priorities for what gets escalated to the CEO and the board, and, in some cases, institutional incentives that work against the rapid disclosure of material risks. A CFO managing a quarterly earnings cycle is not indifferent to the potential impact of a risk disclosure on the market's perception of the company's financial performance. That is not corruption. It is the natural operation of institutional incentives, and it slows the flow of risk intelligence to the people who need it.

The two-reporting-line problem

A related structural issue is the dual reporting arrangement that has become common in larger organizations: the Chief Risk Officer reports administratively to the CFO but has a "dotted line" to the Risk Committee of the board. In theory, this gives the CRO board access without requiring a full organizational restructuring. In practice, dotted-line relationships create ambiguity about which reporting line takes precedence in a material risk event. The CFO, who controls the CRO's budget and career trajectory, is the de facto primary. The dotted line to the board exists on paper but is rarely exercised for anything other than scheduled committee meetings.

The result is a risk function that has theoretical access to the board but practical dependence on the CFO's office for the organizational resources and authority required to exercise it. When a material risk event occurs, the risk function's first instinct is to bring the information to the CFO, who may or may not escalate it to the CEO, who may or may not escalate it to the board, at a pace determined by their individual assessment of the situation and their own institutional incentives.

The correlation with material governance failures

The analysis examined material governance failures, defined as situations that resulted in SEC enforcement actions, material restatements, regulatory sanctions exceeding $50 million, or significant operational disruptions with publicly disclosed board-level governance failures, across the Fortune 500 over a five-year period. The correlation between risk function positioning and material governance failure rate was 0.71, a statistically significant relationship.

The most common pattern in the failure cases was not that the risk function failed to identify the risk. In 78% of the material failure cases examined, documentation revealed that the risk had been identified and was present in risk function records before the event escalated to a material failure. The failure was not in risk identification. It was in the escalation path: the identified risk did not reach the board in a form that allowed the board to exercise meaningful oversight before the situation became unmanageable.

In the majority of cases, the identified risk passed through the CFO's or General Counsel's office, where it was assessed as a manageable operational issue, and was not escalated to the board because the intervening executive did not believe it met the threshold for board notification. The intervening executive was often wrong about the threshold, but there was no mechanism for the risk function to bypass the intervening executive and bring the information directly to the board.

The operating model changes that close the gap

The governance fix has three components. The first is direct reporting access for the CRO. The CRO or equivalent risk function head should have the explicit authority and mechanism to bring material risk information directly to the Risk Committee chair or independent board member without routing it through operational management. This does not require the CRO to report administratively to the board. It requires a defined protocol that specifies the conditions under which direct board notification is not only permitted but required.

The second is a defined materiality threshold for direct escalation. The protocol must specify, with sufficient precision to be operationally useful, what constitutes a material risk event that triggers direct board notification. Vague language about "significant" or "material" risks is not operationally useful. The threshold should be defined in terms of specific criteria: financial exposure exceeding a defined threshold, regulatory notification obligations triggered, operational disruption affecting more than a defined percentage of revenue, reputational events meeting a defined standard. The specifics will vary by organization. The precision is what makes the threshold actionable.

The third is a tested escalation protocol. The protocol should be exercised at least annually in a tabletop exercise that simulates a material risk event and tests the actual time from risk identification to board notification under the defined escalation path. Most organizations that believe their escalation protocols are adequate have never tested them. The tabletop exercise almost always surfaces gaps that were invisible on paper.

None of these changes requires a significant organizational restructuring. They require a governance decision by the board itself: a decision to specify, formally and with binding effect, what information the board requires, how quickly it requires it, and through what channel. The accountability deficit is ultimately a board governance problem, not a management organization problem. Boards that understand this and act on it close the gap. Those that leave it to management to resolve, within a management structure whose incentives work against rapid risk disclosure, do not.