CEOs and boards in the US are more concerned about disruptive technology threats than exerting control over employee misconduct and company ethics, a Deloitte risk management survey shows.

About 35% of respondents believe new technology poses the biggest risk to company growth over the next three years, followed by cyber incidents at 27%.

But only 20% of respondents are concerned by weak and unhealthy organisational culture.

Bosses are investing accordingly: 43% of CEOs and 47% of board members expect investment in cyber-security programs over the next three years, while 34% of CEOs and 40% of board members expect to acquire new technology over the same period.

The expectation of 35% of CEOs and 29% of board members to invest in building a healthy company culture fall below every other spending priority, including hiring new talent, strengthening business partner risk programs, and maturing company brand and reputational risk programs.

About half the respondents say they lack the capability to identify events that may cause reputational damage, or to forecast impacts on brand and reputation. Only 24% of respondents believe reputational damage poses a threat to growth.

There is a significant disconnect between CEOs and boards around ethics and employee misconduct. About 38% of board members believe ethics and company integrity are a risk to reputation, yet only 29% of CEOs agree.

Only 31% of board members are concerned with misconduct and its effect on reputation, lagged by CEOs on 23%.

The report says CEOs’ attitudes may stem from overconfidence in their ability to manage company culture and conduct.

About 41% of CEOs and 42% of board members say physical and cyber-security risks pose the greatest reputational threat in the next year.

Like organisational culture, reputation is an area that can be managed most effectively by leadership, as opposed to cyber, health and safety, the report says.

Deloitte says reputational risk may be one area over which CEOs and boards have greatest control.

Fewer than half of company leaders plan to invest in culture risk programs.

About 45% of CEOs and 59% of board members say they last reviewed company culture two or three years ago; 23% of both say the last time was four years ago or longer.

And only 30% of respondents plan to invest in monitoring employee behaviour in the next year.