2027 Planning Season Is Here. Is Your Risk Management Story Ready?

As you prepare for 2027 planning meetings, your enterprise risk management (ERM) program is likely to be evaluated by how clearly it tells its own story. HUB’s 2026 research found that roughly one in three North American organizations still lack a mature, organization-wide risk strategy, and just 5% show the characteristics of an advanced program.¹ The good news: Closing that gap isn’t a rebuild. It’s a rework, and there’s still time to do it before your next board meeting.

When a HUB client considered opening operations in a new location, her team didn’t wait for the expansion to happen and then react. They first applied an ERM lens, mapping what would change, what threats would come with it and how to prepare in advance.

“That’s how you turn risk management from a function that says, ‘No, you can’t do that; it’s too risky,’ to, ‘OK, let’s identify what those threats are and deal with them,’ so they aren’t as bad once you make that big investment,” says Chrystie Howard, leader of Enterprise Risk Management for HUB International’s Complex Risk Practice, who runs these strategy sessions directly with client leadership teams long before a board ever sees the results.

What sets a strong risk program apart?

Strong programs put outside perspectives to work, inviting stakeholders to apply their expertise directly to the risk conversation rather than simply signing off on it. In those same strategy sessions, Howard watches for one telltale sign that a program is still maturing: leadership presenting only the downside of a risk, never the opportunity attached to it.

“It’s important to see both the downside and the opportunity side of it,” she says. That reframe should come from leadership at the table, not be left for the board to infer on its own.

Where do ERM programs break down?

Almost never at the top. Howard’s most common finding is a business continuity plan documented once and never revisited — contact information goes stale, nobody’s practiced it and the gap only surfaces when a real event forces the issue. A close second: Organizations fixate on the risks that score highest on impact or likelihood, while the moderate risks that need active mitigation get overlooked.

“Be realistic about your risk profile,” Howard says. “Don’t try to sugarcoat things. A board can work with a real picture. It can’t work with a polished one.”

THE HUB EDGE

Your executive leadership doesn’t need a longer risk report; it needs a sharper one. Five moves to make before you finalize your deck:

• Rewrite your reporting rhythm this quarter. Committee-level updates twice a year and one full update annually keep leadership informed without desensitizing them. Howard cautions that reporting too often, in too much detail, makes every issue start to sound like “the house is always on fire,” which trains a board to tune out exactly when you need it to lean in.
• Pressure-test your next big move before you make it. If a new market, product line or geography is on next year’s roadmap, apply an ERM lens now. Map what changes, what threats come with it and how you’ll prepare. That’s the difference between risk management as a brake and risk management as a growth enabler.
• Pull your continuity plan and check the date. If it hasn’t been touched since it was written, treat that as the finding. Confirm that contact information, response plans and ownership are current and then test them. A group exercise or regular training tells you more about real readiness than the document ever will.
• Look at your risk list and find the ones getting ignored. The highest-scored risks usually get all the attention. The moderate ones sitting quietly in the middle are usually where the real, fixable exposure is.
• Build one dashboard, not two conversations. Executive leaders need the short version; risk owners need the detail underneath it. A shared, real-time view closes that gap, instead of your team translating the same data twice for two audiences on two different schedules.

See where your organization lands on HUB’s Risk Maturity Assessment for a diagnostic across all four phases of your program. Connect with HUB’s Complex Risk Practice to prepare for your own board presentation.

HUB Expert

Chrystie Howard — ERM Leader, Complex Risk Practice