2025 Global State of Risk Report

Introduction

The future of risk management is not just about real-time dashboards or slick interfaces—it’s about turning risk into a strategic advantage. In 2025, organizations face mounting pressure to deliver successful projects while navigating intensifying external challenges. Regulatory demands, market trends, and geopolitical conditions—especially in sectors like manufacturing, energy, construction, and utilities—are forcing a fundamental rethink of how risk is understood and managed across portfolios and the enterprise.

The “Global State of Risk Report” confirms this shift: investment in risk management is accelerating, but critical gaps in visibility remain. A lack of real‑time insight remains the biggest barrier to progress, leaving teams reacting to risks rather than anticipating them. To move forward, organizations must adopt predictive, data-driven risk intelligence, grounded in advanced tools and a culture that prioritizes transparency and analytics.

AI is central to this transformation. It’s not a futuristic add-on—it’s already redefining how organizations detect and respond to risk. Respondents see AI as enabling foresight—the ability to shape outcomes proactively instead of reacting to threats. Alongside this, quantitative risk analysis must become a core capability—offering a disciplined, objective framework to evaluate uncertainty and support strategic decisions at scale.

Technology alone isn’t enough. Without the right governance structures and a culture that embraces data, even the most advanced tools will fall short. This report explores what leading organizations are doing differently—and how you can close the gap between insight and action in your capital projects.

— Manuel Carmona, Risk and Decision Analysis Specialist, EdyTraining, Ltd.

The greatest risks to capital projects

When risk professionals identified the risks that most challenge their organizations, a clear pattern emerged: cost pressures, supply chain disruptions, and macro‑economic shifts dominate the landscape. Together, these three risk areas account for 70% of responses, underscoring that most organizations face a familiar set of threats—even if the exact mix differs by industry.

While some sectors like energy zero in on cost volatility, and manufacturing emphasizes supply chain risk, the underlying message is universal: project managers are juggling multiple critical risks at once, with no single threat standing alone.

Key insights:

• 62% of energy sector respondents flagged cost as a major risk to capital projects, likely driven by large-scale infrastructure investments and commodity price volatility.
• Construction respondents reported the most balanced risk profile, with no single category standing out above the rest.
• 54% of manufacturing respondents highlighted supply chain risk, reflecting complex global networks.
• 20% of utilities respondents identified data‑related risks among the major risks, likely tied to regulatory reporting requirements.

The visibility gap

The findings leave no doubt: real‑time visibility is the biggest barrier to effective portfolio risk management, cited by 40% of organizations. That choice outstripped all other options by a wide margin, underscoring how critical this blind spot has become for organizations managing complex projects and portfolios—particularly for those in manufacturing and construction.

Executives feel this gap more sharply than anyone else. Half of the executives surveyed selected the lack of real‑time visibility as their top concern, reinforcing the same view from specialists who struggle with siloed information, outdated reporting cycles, and limited cross‑project tracking. The message is consistent: without real-time data, decisions are reactive instead of proactive.

Key insights:

• 40% of respondents listed lack of real-time visibility as their #1 challenge.
• Roughly half of respondents want real-time insights as their #1 project management tool improvement, followed closely by software integrations.

Risk structure

Risk management today remains heavily fragmented. 37% of respondents said they operate on a project‑by‑project basis, while only a quarter indicated they manage risk enterprise‑wide, and just 12% said they have a portfolio‑level structure.

This approach leaves blind spots. Risk reviews are happening, but too often they’re only “somewhat consistent” or less, revealing possible gaps in cadence and oversight. This suggests that while many organizations have pockets of rigor, the dominance of project‑level management prevents these efforts from scaling into a fully integrated, enterprise‑wide strategy.

Key insights:

• 37% of respondents manage risk on a project‑by‑project basis.
• 25% of respondents report an enterprise‑wide risk structure.
• 12% of respondents have a portfolio‑level risk structure.

Stage of assessment

Planning emerged as the most common stage for risk review, but responses showed that risk assessment isn’t confined to one moment—it’s happening at multiple points across the project lifecycle. Just over a third of respondents said they assess risk throughout the entire lifecycle of the project.

While risk assessment is occurring across the entire project lifecycle, planning remains the focal point, indicating a possible tendency to focus more on the front end and under‑emphasize execution, monitoring, and post‑project review.

Key insights:

• Planning is the peak stage for risk assessment.
• Risk is addressed at multiple stages, but focus skews toward planning in combination with other stages.
• 35% see risk assessment as a continuous discipline rather than an activity tied to a discrete phase.
• Post‑project review sees the least focus, leaving lessons learned under‑captured.
  
  

The risk management toolkit

Risk management today runs on a patchwork of tools—a hybrid of commercial platforms, in‑house builds, and, most often, spreadsheets. For 42% of respondents, Excel and Google Sheets are used in tandem with additional risk management tools. This fragmented mix shows there’s no single dominant tool—but overall satisfaction with existing setups suggests teams are comfortable working this way for now.

At the portfolio level, the picture barely changes. The same mix of spreadsheets, custom builds, and commercial tools carries over, showing a remarkable consistency across project and portfolio risk management. A slight uptick in GRC platform use hints at the growing importance of governance and oversight at broader levels, but the overall trend is clear: organizations rely on multiple tools to balance capability with flexibility.

The executive–practitioner divide

The research uncovers a striking divide between the C‑suite and practitioners—leaders see ‘extremely effective’ programs, while those deep in the data face a very different reality. Executives were 2.5 times more likely to say their programs are “extremely effective,” while a third of technical specialists labeled them only “somewhat effective.”

This disparity highlights how experiences differ depending on the role. Leaders see polished dashboards and summary reports, while practitioners navigate the day‑to‑day gaps in data, processes, and tools.

Key insights:

• Executives are 2.5 times more likely to rate their programs as “extremely effective.”
• 33% of technical staff see their programs as only “somewhat effective.”

Construction: Building risk visibility across projects

In construction, real‑time visibility is the single largest challenge—a barrier that undercuts efforts to manage dependencies across multiple jobs, especially since nearly half structure risk management project‑by‑project rather than across a broader portfolio.

The external factor that most strongly influences project risk management strategy in construction is regulatory influence, while labor market fluctuations, material cost volatility, and weather patterns were also noted.

When asked about their biggest challenges in communicating risk to executives, respondents repeatedly came back to one central issue: turning complexity into clarity. They struggle to translate highly technical details into information leaders can act on without centralized dashboards—insight that connects directly to budgets, schedules, and project outcomes.

Key insights:

• 45% manage risk at the project level.
• 40%+ identified lack of real‑time visibility as their top portfolio risk management challenge.
• 60%+ of construction professionals use Excel exclusively or as part of their software toolkit.
• AI and automation are seen as future disruptors, but not today’s top priority.

Manufacturing: Supply chains drive the conversation

Manufacturing runs on integrated operations—and that scale brings both strength and vulnerability. Supply chain risk looms largest, exposing the sector to the fragility of global sourcing networks. Despite generally strong risk programs, manufacturing must navigate relentless pressure to innovate, adapt, and deliver efficiencies.

While regulatory influence emerged as the overarching trend across industries, manufacturing also cited market trends, economic conditions, and security and safety concerns as external factors that strongly influence project risk management strategy.

Investment is accelerating faster here than in any other sector, signaling that manufacturers see modernization as urgent. But spreadsheets still anchor daily workflows, and executives lack the visibility they need for fast decisions—proof that the sector is only partway through its transition from manual to predictive risk management.

Survey responses suggest manufacturing operates in competitive environments that may encourage calculated risk-taking, driven by the sector’s demand for innovation, efficiency gains, and constant adaptation to changing demands.

Key insights:

• 54% named supply chain risk as their greatest concern for capital projects.
• 52%+ expect to increase significant investment in risk management capabilities, the highest across sectors.

Energy: Aggregation and dependency challenges

Many energy sector respondents report an enterprise-wide approach to risk management —but that scale brings its own problems. The sector’s greatest challenge isn’t visibility alone, it’s aggregation and dependency tracking across massive, interconnected investments.

With some of the highest stakes—from safety‑critical operations to billion‑dollar infrastructure — Energy takes fewer risks, constrained by heavy regulation and geopolitical volatility. Adoption of advanced dashboards and monitoring tools lags behind strategic intent, creating a gap between where the industry wants to be and what its systems can actually deliver today.

Key insights:

• 62% flagged cost risk as their biggest concern for capital projects, likely due to large-scale infrastructure investments and commodity price volatility.
• Energy leaned highest toward an enterprise‑wide structure.
• Many selected aggregation and dependency tracking over visibility as their top challenge.

Utilities: Managing risk under regulation

Utilities manage risk under the weight of regulation, and that framework defines everything they do. Beyond visibility, the sector wrestles with complex aggregation and dependency challenges created by deeply interconnected systems.

Regulatory mandates, market shifts, and security concerns dominate external pressures—yet many utilities still manage risk at the business‑unit level, creating silos in even the most compliance‑driven environments. AI is viewed as transformative, but adoption is slow, leaving utilities behind the curve compared to faster‑moving sectors like manufacturing and construction.

Key insights:

• 20% named lack of data as their top concern for capital projects—the highest of any sector.
• Most manage risk at the business‑unit level rather than portfolio‑wide.
• Regulatory requirements dominate as the primary external factor shaping risk strategy.

Investment priorities

The planned path forward is clear: investment in risk management is scaling up across industries, led by manufacturing. This appetite for investment signals that teams aren’t just maintaining status quo; they’re preparing for transformation.

When asked what improvements they want most, respondents were clear: real‑time insights topped the list, with nearly half naming it their #1 software priority. AI‑powered insights followed closely, with more than 40% citing it as a key enhancement. Together, these responses point to a future where risk systems aren’t simply logging data—they’re built to detect, predict, and guide.

Key results for the most important capabilities organizations want added to their project risk management tools:

• 49% – Real‑time insights
• 48% – Software integrations
• 43% – AI insights
• 30% – Executive stakeholder reporting
• 21% – Visualizations

And the momentum is clear: 74% of organizations expect to increase investment in risk management capabilities—indicating strong intent to fund the shift from today’s fragmented tools to tomorrow’s intelligent, connected systems.

The future of capital project risk

Across every industry, AI-powered automation is set to redefine how organizations manage uncertainty. Other trends will play a role—real‑time monitoring and risk-prediction are gaining traction in parts of construction and energy, and regulation and security pressures will continue to shape utilities and energy. But these factors sit in the shadow of AI, which respondents see as the primary driver of transformation.

The future of risk management is not merely about real-time dashboards or slick interfaces—it's about transforming risk from a compliance function into a strategic advantage. Organizations can no longer afford reactive models. To thrive in uncertainty, they must adopt predictive, data-driven, and enterprise-wide risk intelligence powered by advanced tools and a culture that values transparency and analytics.

Key insights:

• AI & automation lead the way—the top disruptive force for every industry, especially construction and manufacturing.
• Real‑time monitoring and risk-prediction are emerging trends.
• Regulation and security remain critical in regulated sectors like utilities and energy, though they rank far behind AI in perceived impact.

The bottom line: AI is expected to play the leading role in redefining risk management—with analytics, oversight, and compliance pressures evolving in its wake.

AI: The catalyst for a new era in risk management

AI is not a futuristic add-on—it is already reshaping how organizations understand, detect, and respond to risk. More than a tool, AI is a disruptive impulse—one that can enable risk management to move from primarily reactive to a more predictive driver of action.

Organizations that embrace AI will unlock not just efficiency, but risk foresight—the ability to proactively shape outcomes, not just respond to threats.

Key impacts of AI on risk management:

• Early warning systems: Pattern recognition in large datasets allows for preemptive risk alerts before traditional systems detect them.
• Dynamic risk scoring: AI continuously recalibrates risk profiles based on real-time data inputs (e.g., delays, costs, geopolitical signals).
• Enhanced scenario modeling: AI augments Monte Carlo and Bayesian models by optimizing input assumptions and discovering hidden interdependencies.
• Automation of low-value tasks: Reduces time spent on manual data aggregation, freeing teams for strategic analysis.
• Bias reduction: Algorithmic decision-making mitigates cognitive and political biases that plague subjective assessments.
  
  

Making the case for quantitative risk analysis

As risk grow more complex, quantitative risk analysis (QRA) must become the cornerstone of future-facing risk management. While many organizations still rely on qualitative scoring and intuition, QRA provides a disciplined, objective framework to evaluate uncertainty, test assumptions, and support strategic decision-making.

When built into planning and execution, QRA doesn’t just improve forecasting — it gives organizations the confidence to defend high-stakes decisions to boards, investors, and regulators. From shock anticipation to smarter contingency planning, QRA is the foundation for risk management that’s built to scale.

Five key benefits of QRA:

• Improved forecast accuracy: Simulations (e.g., Monte Carlo) powered by technologies like Lumivero’s @RISK expose probable cost and schedule ranges—not just point estimates.
• Prioritization by impact: Quantifies which risks matter most, focusing effort and resources intelligently.
• Decision confidence: Supports go/no-go and funding decisions with probabilistic metrics rather than gut feel.
• Portfolio optimization: Portfolio-wide risk management software like Lumivero’s Predict! enables cross-project risk aggregation, dependency analysis, and strategic balancing of risk exposure.
• Auditable risk logic: Provides traceable, data-backed justifications for decisions, enhancing governance and accountability.
  
  

Culture and governance: The hidden enablers of predictive risk intelligence

Technology alone won’t transform risk management—culture and governance must evolve alongside tools.

Leadership teams must cultivate a data-literate culture where decisions are grounded in evidence, not hierarchy or habit. Risk appetite statements, escalation protocols, and enterprise frameworks must be formalized and reinforced across the organization. This requires:

• Cross-functional collaboration.
• Training programs to upskill staff in probabilistic thinking and critical analysis.
• Accountability structures that reward transparency, not risk aversion.

Until risk is treated as a strategic input to decision-making, rather than a compliance checkbox, AI or quantitative risk analysis models may not achieve their full potential.

Next steps in risk management

The “Global State of Risk Report” highlights where organizations are making progress—and where critical gaps remain. From spreadsheets still anchoring workflows to the overwhelming demand for real‑time and AI‑powered insights, it’s clear the future of risk management will require new innovation, new processes, and new levels of visibility.

Lumivero partners with organizations worldwide to bridge those gaps—helping teams move from reactive reporting to predictive, portfolio-wide risk intelligence through its solutions for capital project risk management. Download the "2025 Global State of Risk Report" or request a demo of Lumivero's decision solutions to start making high-impact decisions with clarity, confidence, and shared context.

Appendix: Analysis methodology and tools

The analysis presented in the “Global State of Risk Report” was conducted using a combination of statistical and qualitative tools to ensure rigor and depth in the interpretation of results.

Quantitative data analysis was carried out using XLSTAT, Lumivero’s statistical and data analysis solution designed for applied research. The open-ended questions were coded by themes using NVivo, Lumivero's qualitative data analysis software built to support qualitative and mixed methods analysis. Cross-comparisons were made between the themes and the closed-ended questions and by sector.

Cross-disciplinary analysis team:

• Silvana di Gregorio PhD, Product Research Director and Head of Qualitative Research, Lumivero
• Fabien Llobell PhD, Head of Quantitative Research, Lumivero
• Thalia Anagnostou, Manager, Product Marketing, Lumivero
• Manuel Carmona, Risk and Decision Analysis Specialist at EdyTraining, Ltd.

Technical writer and editor: Abigail Jacobsen, Content Marketing Manager at Lumivero.

Tool citations:
Lumivero (2025). XLSTAT statistical and data analysis solution.
https://www.xlstat.com/en
Lumivero (2025). NVivo qualitative data analysis software.
https://lumivero.com/products/nvivo/