Key Takeaways
- • Two-thirds of 196 surveyed organizations reported that lack of collaboration between risk and compliance functions dramatically slowed operational efficiency and program effectiveness.
- • 100% of respondents in Oracle's 2021 survey indicated they need to improve risk management and audit capabilities, signaling widespread recognition of capability gaps across enterprises.
- • Nearly 25% of organizations incurred unexpected emergency costs due to cybersecurity breaches and malware infections by end of 2020, driven by inadequate remote work security protocols during the pandemic transition.
- • The average organization manages 182 third-party vendors with system access weekly, yet 58% of surveyed companies believe they have already experienced vendor-related breaches, exposing significant third-party risk management gaps.
- • 90% of 2021 anti-bribery and corruption survey respondents expected their ABC compliance risks to increase or remain elevated compared to 2020, indicating escalating regulatory pressure.
Summary
The 2021 risk and compliance benchmarking surveys reveal a sector grappling with fundamental integration challenges and capability shortfalls. Across multiple organizational cohorts—from enterprise IT departments to wealth managers to healthcare systems—decision-makers consistently identified misalignment between risk and compliance functions as a primary drag on program performance. The Compliance Week survey of 196 organizations found that two-thirds reported collaboration deficiencies between these critical functions, with respondents indicating the disconnect "dramatically slowed" program execution and effectiveness metrics.
Technology infrastructure and remote work transitions emerged as acute pain points. The pandemic-driven shift to distributed workforces created cascading vulnerabilities. By the end of 2020, approximately 25% of organizations faced unexpected costs to remediate cybersecurity breaches and malware infections—a direct consequence of insufficient security protocols governing remote work environments. The proliferation of cloud-based tools and personal device usage amplified attack surfaces, with cyber crime complaints to the FBI's Internet Crime Complaint Center nearly quadrupling since the onset of COVID-19. Meanwhile, organizations had begun relying on an average of 182 third-party vendors with weekly system access, yet 58% of companies believed they had already incurred vendor-related breaches, indicating substantial gaps in third-party risk visibility and management.
The capital and human resource constraints facing compliance programs further compressed operational capacity. Recession pressures drove budget and staffing reductions precisely when security and fraud risks intensified. Oracle's survey of 212 enterprise decision-makers found that 100% of respondents acknowledged the need to improve risk management and internal audit capabilities—a consensus view underscoring systemic capability shortfalls across the sector. Additionally, 90% of respondents in anti-bribery and corruption compliance surveys expected ABC risks to increase or remain flat relative to 2020, suggesting regulatory environments were becoming more stringent even as organizations operated with constrained resources.
The data indicates that effective risk and compliance advancement in 2021 required addressing three interconnected imperatives: integrating fragmented governance, risk, and compliance functions; modernizing technology infrastructure to support real-time visibility and automated controls; and establishing comprehensive third-party risk management frameworks. Organizations that successfully aligned these elements demonstrated materially improved efficiency, accuracy, and regulatory risk reduction compared to peers with siloed program structures.
Technology infrastructure and remote work transitions emerged as acute pain points. The pandemic-driven shift to distributed workforces created cascading vulnerabilities. By the end of 2020, approximately 25% of organizations faced unexpected costs to remediate cybersecurity breaches and malware infections—a direct consequence of insufficient security protocols governing remote work environments. The proliferation of cloud-based tools and personal device usage amplified attack surfaces, with cyber crime complaints to the FBI's Internet Crime Complaint Center nearly quadrupling since the onset of COVID-19. Meanwhile, organizations had begun relying on an average of 182 third-party vendors with weekly system access, yet 58% of companies believed they had already incurred vendor-related breaches, indicating substantial gaps in third-party risk visibility and management.
The capital and human resource constraints facing compliance programs further compressed operational capacity. Recession pressures drove budget and staffing reductions precisely when security and fraud risks intensified. Oracle's survey of 212 enterprise decision-makers found that 100% of respondents acknowledged the need to improve risk management and internal audit capabilities—a consensus view underscoring systemic capability shortfalls across the sector. Additionally, 90% of respondents in anti-bribery and corruption compliance surveys expected ABC risks to increase or remain flat relative to 2020, suggesting regulatory environments were becoming more stringent even as organizations operated with constrained resources.
The data indicates that effective risk and compliance advancement in 2021 required addressing three interconnected imperatives: integrating fragmented governance, risk, and compliance functions; modernizing technology infrastructure to support real-time visibility and automated controls; and establishing comprehensive third-party risk management frameworks. Organizations that successfully aligned these elements demonstrated materially improved efficiency, accuracy, and regulatory risk reduction compared to peers with siloed program structures.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.