2026 GRF Top Risks Report

Key Themes for DC-Based Organizations and their Global Communities

Organizations in the DC Metro region, and the broader national and international communities they serve, enter 2026 amid accelerating geopolitical instability, economic volatility, intensifying cyber threats, and rapid digital transformation. Because of the region’s unique concentration of nonprofits, associations, NGOs, and federal government contractors, these organizations face heightened exposure to federal appropriations cycles, regulatory shifts, technology mandates, and the evolving demands of a modern workforce.

Backed by extensive research, GRF’s Risk & Advisory Services team provides a review of the high-level risks that organizations are likely to face in the coming years, along with mitigation strategies to address these risks.

The three cross-cutting risk themes outlined in this report represent the most significant challenges and opportunities.

THEME 1: Strategic Drift Amid Global, Economic, and Digital Disruption

DC-influenced organizations are more exposed than most to the ripple effects of federal appropriations, policy shifts, global conflict, and economic uncertainty. This environment increases the risk of strategic drift, where mission alignment gradually erodes due to external pressures, funding instability, or reactive decision-making.

Strategic drift occurs when the organization gradually loses alignment with its strategic objectives, fails to adapt to changing stakeholder needs, or allocates resources ineffectively. In today’s environment, geopolitical instability, inflation, supply chain disruptions, and shifting global alliances have forced organizations to make rapid decisions that may unintentionally pull them away from their long-term mission.

For example, macroeconomic challenges place significant strain on traditional funding sources. Inflation, economic uncertainty, and global instability have encouraged organizations to diversify revenue streams to maintain financial resilience. Diversifying into new revenue streams can introduce risks that pull the organization away from its core strategy and mission, leading to decisions driven by donor requirements rather than organizational priorities.

THEME 2: Cybersecurity, Business Continuity and Resilience

Business continuity and resilience involve an organization’s ability to maintain essential functions during and after a crisis, such as a natural disaster, cyber-attack, or a pandemic. The DC Metro region is one of the highest-targeted cyber regions in the United States due to its proximity to federal agencies and the prevalence of sensitive data held by nonprofits, associations, and government contractors.

Organizations face escalating risks from ransomware, insider threats, nation-state actors, and supply-chain vulnerabilities—while simultaneously navigating new federal cybersecurity and AI requirements.

Major risks within this theme include:

• Cybersecurity and data security
• AI governance
• Digital disruption and transformation

THEME 3: Talent Management, Culture, and Organizational Governance

Talent shortages, burnout, and leadership gaps directly affect mission delivery, compliance readiness, and organizational resilience. At the same time, organizational culture, sustainability practices and governance have become critical components of talent strategy. This report details how culture and governance drive risks, and mitigation strategies to address these risks.

The 2026 GRF Top Risks Report provides GRF’s assessment of how these major themes are likely to impact your organization, and how you can address these threats. The appendices include detailed summaries, additional resources, and links to the research reports referenced, including insights from the NC State ERM Initiative, the Institute of Internal Auditors, Everbridge, ISACA, and CompTIA.

Melissa Musser, CPA, CIA, CITP, CISA

Partner and Director, Risk & Advisory Services

Thomas Brown, CISA, CIA, Security+, CAPM

Supervisor, Risk & Advisory Services

Alex McNeill, PMP

Enterprise Risk Management Advisor, Risk & Advisory Services