New BCG Survey Highlights the Value of Mature Risk Management Across All Industries, and What Lagging Organizations Can Learn from Leaders
BOSTON—Recent global crises like the COVID-19 pandemic and the Ukraine war have spotlighted the crucial need for mature risk management capabilities across all industries and sectors. Boston Consulting Group (BCG) is today publishing a report that examines the current state of risk management within the business world and sets out the practical measures that companies can take to move from aspiration to achievement.
“Mature Risk Management in Uncertain Times,” BCG’s Global ESG, Compliance, and Risk Report 2023 is based on a global survey of senior executives from 150 companies of various sizes across industries. According to the report, while 71% of companies with mature risk management capabilities agree that these competencies help to mitigate the many potentially negative consequences of global crises, only 37% of organizations with less developed risk management say the same thing.
“The many associated risks caused by turbulent and unpredictable global situations like the pandemic and the Ukraine war—such as supply chain disruption, increased cyberattacks, or the expropriation of assets—have severely tested the resilience of companies all across the economy,” said Julia Gebhardt, a managing director and partner at BCG and a coauthor of the report. “Our survey shows us that to succeed in periods of intense crisis, risk management requires a strong strategic foundation wherein the corporate center sets the overall strategy and then the various business units and subsidiaries bring it to life, integrating risk management within the culture and everyday processes of the whole organization.”
More than half of survey respondents at top-performing companies (58%) stated that the influence of the strategic risk management team at the center of the organization was a success factor during the recent periods of crises. Next in importance was a tie between embedding risk management into strategy and planning processes and data and analytics (both 46%). The latter finding supports the belief that the analysis of data collected by the organization, together with AI and generative AI, are essential elements of an advanced risk management capability.
Leaders and Starters
The report categorizes companies with mature risk management practices already in place as “leaders,” and those with still some way to go as “starters.” And while starters can learn much from the path already taken by leaders, they must first focus on fixing the basics, such as securing buy-in from senior management to make risk management a priority. For leaders, the maturity of their risk management inevitably requires them to maintain more developed frameworks and processes. For example, while starters are still bogged down in internal matters, leaders are able to scan the external environment for emerging risks. Only 14% of starters cited rising regulatory scrutiny as a major challenge, compared with 44% of leaders. The lack of attention currently paid by starters to rapidly intensifying new risks, such as those relating to environmental, social, and governance (ESG) matters and AI, could have material consequences.
The survey results suggest that starters sense what needs to be done to emulate the success of leaders. The report’s authors argue that to reach this goal, companies should concentrate their attention on the following three actions:
- Make risk management a cornerstone in all key processes within the entire organization to ensure resilience.
- Combine a strong strategic risk management center with efficient and effective distributed operative risk management to secure a holistic understanding and appropriate mitigation of risks through a robust and consistent process.
- Enhance data analytics by focusing on the quantification of non-financial risks and using tools such as AI to make full use of available data.
“Mature risk management is vital for withstanding crises as they happen but also for preparing organizations to anticipate and handle the risks of the future, such as the escalating volume of regulation on ESG topics and the potential ramifications of noncompliance,” said report coauthor Katharina Hefter, a managing director and partner at BCG. “Starters urgently need to make progress in moving to the next stage of maturity in order to derive the full benefit of risk management.”
