86% see the risk. 14% train for it.

Dear {{ first_name | reader }},

Deloitte's Reputation, Crisis and Resilience practice has just published its latest Corporate Affairs report, The Road to 2030, built on interviews with 42 CA leaders, mostly at FTSE 100 companies, conducted between December 2025 and February 2026. Most of it is fairly predictable: growth has taken precedence over purpose, AI adoption is still uneven, and boards are asking for less presentation and more evidence.

But one number buried in that same dataset deserves more attention than Deloitte gives it. Eighty-six per cent of CA leaders name business performance and transformation as a top-three risk for 2026.

Geopolitical training, in a year the report itself calls a 'standing condition' of volatility rather than a periodic shock, sits at the bottom of the same leaders' investment priorities: 14%. Cyber crisis communications capability does only slightly better, at 21%. AI training claims 69%.

This week's issue also owes something to Paul Holmes, founder of PRovoke Media, who published his own read of the report a few months ago (see link below), and it's worth your time on its own terms. Holmes takes Deloitte's ROSE measurement framework apart, questions whether the report's 'reputational' and 'economic' CA categories are as distinct as Deloitte claims, and argues that the report's 'recalibration from purpose towards performance' is a false dichotomy.

Holmes’ analysis, like Deloitte’s report itself, focuses on the broader findings rather than one particular tension that caught my attention: the gap between the risk CA leaders say keeps them up at night and the training budget available to address it.

That is where this piece picks up.

The Road to 2030 is Deloitte's fourth report tracking the Corporate Affairs function, and its topline argument is structural reset. Eighty-three per cent of CA teams say they're undergoing significant transformation, and 66% are changing operating models outright.

Only 24% have a formal, documented AI strategy, even though 95% are prioritising AI upskilling over the next twelve months. The headline argument is that CA is shifting from a purpose-driven, reputation-focused function to a commercially driven, growth-focused one, and that AI is the accelerant.

None of that is wrong. It's also not the part that matters most to this newsletter's readers.

Reports like this one shape budget conversations for the next several years, whether or not any individual reader agrees with them. When a Deloitte partner tells a CEO that AI training is this year's top priority and geopolitical training is the bottom of the list, that framing travels straight into board packs.

If you're the person in the room arguing for crisis and risk capability funding, you're now arguing against a well-resourced consultancy's own published ranking — one built from your peers' own survey responses, not from Deloitte's imagination.

The report hands you the counter-argument to that ranking, though. You just have to read past the AI headline to find it.

Deloitte's 'Steward' archetype, one of four foundations the report uses to describe CA leadership, is described as guiding the organisation through uncertainty via what Deloitte calls a 'systematic approach to risk, crisis and resilience.' One sentence, three words doing three different jobs.

I've made this argument before and I'll keep making it: risk, crisis and emergency communication are epistemologically distinct disciplines. Risk management works on a horizon of months to years: monitoring, probability, mitigation. Crisis communication compresses that down to hours and days, once escalation and reputational exposure are already live. Emergency communication compresses further still, into minutes, and the only thing that matters is protective action, fast.

Fold all three together and you get exactly what this report's data shows: a single training line that AI can eat almost entirely, because nobody has drawn a line between disciplines that run on wildly different clocks, skills and failure modes.

Eighty-six per cent of CA leaders cite business performance and transformation as a top-three risk. Reputation follows at 55%, cybersecurity at 36%, geopolitics at 33%. None of those are small numbers. They describe a leadership cohort seriously rattled by volatility.

Now look at where the training budget goes.

Deloitte also asked CEOs how they perceive the CA function, and the split explains a lot: 49% see it as a growth function, 43% as a control function (the risk and assurance discipline), and 8% as a content function.

Growth is where the CEO's attention and the training budget both point. Control, the part of the job that contains a crisis when one hits, is being treated as the legacy mandate rather than the future one. That's not a coincidence next to a 14% figure but the mechanism producing it.

Reputation risk sits at 55% in the raw ranking, then gets reclassified a few pages later: Deloitte calls it less a standalone risk than an 'amplifier.' Fair enough, on its face. But the very next sentence describes what an amplifier does: it can 'compress decision timelines, increase regulatory scrutiny and constrain strategic options.'

Read that back. Compressed decision timelines and constrained strategic options are not features of background noise. They're features of a crisis in motion.

Deloitte has, in the space of two sentences, both downgraded reputation risk and accurately described why it deserves to be treated as one of the most dangerous risks on the list. If anything, 'amplifier' is the more honest word — and the more urgent one.

None of this means the report is wrong to be excited about where CA is heading. Its section on AI as risk and governance is clear-eyed: it argues that AI introduces a new class of regulatory, ethical and reputational exposure that goes well beyond the usual cyber and data concerns, and that CA leaders are increasingly expected to set the guardrails for how an organisation is seen to use AI in public.

Only 17% of CA leaders flagged governance, risk and compliance as a barrier to AI adoption — a low number that, read against 95% racing to upskill on AI, is itself a warning sign. Everyone's building the plane. Not many are checking who's flying it.

The 2030 outlook is honest about the stakes, too. Deloitte pictures CA becoming a guardian of truth in a 'post-reality' information environment saturated with synthetic content, acting as the 'human backstop' against disinformation that can surface from anywhere, at any moment. That's the right destination.

It's just described with no road to get there: no mention of monitoring cadence, escalation triggers, or how a function builds the muscle to tell watch from live before the moment arrives.

Use the numbers, not the narrative. If you're building the case for crisis or geopolitical training budget this year, Deloitte's own figures are your strongest ammunition: an 86% risk citation sitting next to a 14% training allocation is not a subtle gap, and it's not one you have to construct yourself — it's sitting in a report your CEO or board may already have read.

Separate the disciplines explicitly when you make that case. Don't ask for 'risk and crisis training' as one bucket, because that's exactly the framing that let it slide to the bottom of the list.

Ask for risk monitoring capability, crisis response capability and emergency communication capability as three distinct lines, each with its own cadence and its own justification. A single vague line is easy to deprioritise. Three specific, differently-urgent ones are harder to wave away.

By Deloitte's own account, CA leaders expect to be the 'ultimate guardian of trust' by the end of the decade, an indispensable function securing investor confidence in a post-reality world. That's good.

But guardianship isn't a title a report confers. It's built through hours logged in scenario planning, monitoring discipline and segmented response, none of which show up in a training budget currently outweighed five to one by AI fluency.

The organisations taking that 14% figure seriously now, and building the operational capability while it's still cheap and unfashionable, will be the ones able to claim the title in 2030.

Everyone else will have a slide about it.

5,000+ professionals use Skill Leap to get ahead with AI. Right now, two of their best courses are completely free - Claude 101 and the 14-Day AI Boot Camp.

Claude 101 covers prompting frameworks, Artifacts, file analysis, and real-world workflows in 19 lessons.

The Boot Camp covers ChatGPT, Gemini, Midjourney, and prompt engineering in 16 lessons. Downloadable workbooks. LinkedIn certificate.

Zero cost, no credit card, no catch.

Get 2 Free AI Courses

_{Transparency & Disclosures}

_{AI Transparency: In alignment with EU AI Act requirements, please note that AI technology was used in the research, drafting, and/or image generation for this edition. All strategic analysis, professional opinions, and final editorial oversight are conducted exclusively by the author. Affiliate Disclosure: Some links in this briefing may be affiliate links. I only recommend tools and services I use personally or have vetted for professional efficacy. Professional Advice: This newsletter is for educational and informational purposes only and does not constitute legal or professional crisis management advice. © 2026 RiskComms FZCO. All rights reserved.}