Risk and compliance leaders face a new mandate: growth, governance, resilience

Ecosystem development now leads, with 62% of CROs and CCOs seeing significant opportunity to expand strategic alliances and partnerships, up from 59%. Revenue potential dipped to 60% from 62%, and geographic expansion fell to 47% from 52%. Partnerships let organizations enter markets and add capabilities without the capital and licensing drag of building in new jurisdictions. But every ecosystem is a third-party ecosystem, and third-party management ranks just 10th of 12 investment priorities.

Cyber threats lead at 3.57 on a five-point impact scale, down from 3.72, followed by AI implementation risk (3.46), third-party risks (3.38), economic conditions (3.37) and talent and succession challenges (3.35). Nine of the top 10 risks were flat or lower, a sign of a risk register maturing rather than a threat landscape improving. Privacy and identity protection is the only top-10 risk climbing with conviction, and concern about disruptive innovation is building.

Focus on people and integration, not models. CROs and CCOs rank equipping the workforce (44%), integrating AI with existing technologies and processes (41%) and improving governance and accountability (40%) as top priorities. Managing AI's impact on third parties (10%) and avoiding AI errors (18%) rank near the bottom, even as vendors embed AI into products organizations already use. A complete AI inventory, including third-party embedded AI, and named accountability for each deployment are practical first steps.

49% of risk and compliance leaders report high confidence in protecting enterprise value and 46% in transforming the enterprise, but only 38% in responding with agility. Organizations have spent a decade building frameworks, controls and testing regimes, but not speed. Cyber incidents, third-party outages and AI failures are all speed problems. Clearer decision rights, preauthorized playbooks and scenario testing against the top risks on the register help close the gap.

Cybersecurity is the top investment priority at 48%, followed by business process improvement and infrastructure modernization. Data privacy nearly tripled, from 7% to 20%, matching privacy's rise as a risk. Third-party management sits at 14%, 10th of 12 priorities, and crisis management fell to 4% from 8%, even though partnerships are the top growth opportunity and responding is the weakest capability. Stress-testing the investment slate against the risk register helps fix that misalignment.