Risk management is getting more attention from the C-suite, with Gartner surveys finding that 52% more CEOs cite it as a top priority for 2026 compared to 2025. The increase makes sense as organizations today face faster-moving, more interconnected risks that are increasingly shaped by technology.
Compounded by economic, regulatory and geopolitical volatility, the current operating environment makes traditional risk management approaches—where the core responsibilities of risk management are largely delegated to a central risk team—look increasingly inadequate. This is often because the central risk team is frequently alerted only after a risk has matured into an incident, which can then lead to other problems. For example, a cyber incident rarely stays confined to IT, often cascading into supply chain disruption, regulatory exposure and even talent fallout.
Business risk owners have the power and proximity to improve risk identification and response. However, Gartner surveys suggest that 88% of business risk owners are highly motivated to manage risk, yet only 35% feel confident in meeting risk ownership expectations.
This risk confidence gap is a structural vulnerability for organizations. When risk owners hesitate, wait for permission or treat risk processes as separate from “real work,” it undermines the organization’s ability to proactively and effectively manage its most critical risks in a coordinated way.
To bridge this gap, risk leaders must coach risk owners to recognize and respond to their risk responsibilities as quickly, thoroughly and autonomously as the current environment requires. That means creating risk management systems that enable business risk owners to learn and practice the right risk behaviors until they occur with such speed and precision that they appear reflexive. The following three practical steps can help businesses condition those reflexes.
1. Make Risk Ownership Hard to Avoid
Organizations tend to focus on making risk processes easier, for example, emphasizing streamlined templates, more accessible guidance or better tooling. The problem is that ease of use does not automatically improve risk owners’ quality of work or level of engagement.
The key to conditioning a risk reflex is to make risk ownership hard to avoid. Hard-to-avoid systems compel action by being: prominent (hard to miss), useful (hard to justify ignoring), and visible (hard to hide avoidance).
Ask yourself: Could someone be unaware of this process—or justifiably bypass this process—without anyone noticing? If the answer is yes, then its use is optional, in practice.
To put that into a practical example, imagine if your contract management platform was also your third-party risk gate. A contractor would be chosen from a pre-approved list of vendors that align with risk tolerance, and renewals would require embedded due diligence before they can be processed. In that design, the risk step is no longer “extra.” It is part of the process.
Similarly, imagine embedding risk workshops into the transformation project process so that project teams were prompted to consider the timeliest, potentially high impact and high likelihood risks at each milestone. Embedding workshops into the process would make them hard to avoid, highly visible and clearly relevant.
Do not ask the business to “come to risk.” Put risk where the business already is.
2. Provoke the Intellect
Reflexes also require stimulus. In risk ownership, stimulus is the moment where the risk owner is prompted to pause, assess and act.
If risk management wants better engagement or action from risk owners, then they must prompt or provoke the business with better stimulus. For example, think of the risk assessment process. Vague, surface-level risk assessment questions like “what are your biggest risks?” typically lead to vague, surface-level responses.
Consider how risk assessment questions can be designed to encourage more thoughtful responses:
- Ask questions that force specificity like “Are our objectives achievable, and what would cause us to miss them?”
- Explore cultural and information signals by asking “How open is management to hearing bad news, and what gets in the way?”
- Move from “Are controls in place?” to “What would break them under pressure?”
The goal is to receive better answers by asking more thoughtful, intentional questions. This idea is not limited to questions asked—it can also apply to how information is given or how meetings are structured. For example, risk management might capture leaders’ perception of risk ratings through live workshops and a provocative prompt could be disclosing the risk ratings agreed upon in other, prior meetings. Disclosing contrasting risk ratings from prior discussions would challenge others’ thinking and help them to engage or explain their reasoning more thoroughly.
3. Recognize Good Behavior
Reflexes are reinforced through recognition, yet most organizations tend to spotlight failure. Indeed, Gartner research found that only 22% of risk owners reported receiving positive feedback from ERM.
If risk management only measures and rewards “zero defects,” it risks teaching the organization to hide weak signals—exactly the opposite of what modern risk demands.
Recognition starts with identifying what “good” looks like: proactive monitoring, early escalation, transparent communication, creative mitigation and learning from near misses.
Give visibility to risk ownership by having risk owners present mitigation plans to one another, sharpening risk thinking and creating healthy peer pressure to show strong preparedness. Use a dashboard to show executive leadership where risk owners are excelling with desired behaviors positioned to be emulated rather than ignored. Treat proactive risk behavior as a leadership competency and recognize it as visibly as performance outcomes.
Honing Your Risk Reflexes
In a world of interdependent risks and accelerating decision cycles, risk leadership cannot succeed through centralization and enforcement alone. The organizations that keep pace will be those that build reflexive risk ownership across the business with systems that are hard to avoid, interactions that provoke better thinking, and recognition that reinforces the right risk ownership behaviors.
By closing the risk confidence gap, you will not only improve your risk management processes—you can improve the speed, resilience and decision quality of the entire organization.
This article was based on the opening keynote at Gartner’s 2025 Enterprise Risk, Audit & Compliance Conference.