Irish businesses are significantly increasing their spend on risk management technology to keep up with the speed of digital transformation but are not yet realising full value from that investment. This is among the key findings of PwC’s 2022 Risk Survey which sought the views of more than 3,500 global and Irish risk and compliance leaders on evolving risk management practices and related challenges.
Other key findings included the need for Irish organisations to invest more to enable risk-informed decision making; to involve risk functions earlier in the decision-making process and to invest in developing a risk culture.
We’ve seen greater awareness of certain risks as a result of the pandemic
“In the current volatile business environment, executives need to revise and adapt their strategies and operating models at a rapid pace,” says PwC partner and risk assurance leader Richard Day. “They need to be able to make confident decisions that are informed by a panoramic view of risk. Risk management capabilities provide the greatest value to board members and senior management when they are embedded within the organisation’s strategic planning and decision-making processes.”
Irish organisations have some way to go when it comes to adopting an integrated approach to risk management. However, six out of ten Irish respondents to the PwC survey said that they faced challenges due to the lack of a co-ordinated approach to business risk. In addition, just one fifth (21 per cent) of Irish risk leaders are realising benefits from a governance, risk and compliance system that is holistic and integrated.
Why an SSE Airtricity energy audit was a game changer for Aran Woollen Mills on its net-zero journey
Getting solid legal advice early in your company’s journey is invaluable
Water pollution has no one cause but many small steps and working together can bring great change
Empowering women in pharma: MSD Ireland’s commitment to supporting diverse leadership
The top risks facing Irish businesses, according to the survey, are inflation, energy costs, geopolitical, talent management, supply chain disruption, regulatory compliance, cyber threats, and ESG.
“We’ve seen greater awareness of certain risks as a result of the pandemic,” Day says. “Health risk might have been theoretical before but is seen as very real now. Cyber is also very topical here in Ireland following the HSE breach. Awareness of geopolitical risk has also risen, not least as a result of the war in Ukraine. Climate change has gone way up the agenda in recent years as well. These are all linked. The war in Ukraine has seen energy costs skyrocket and energy costs are linked to climate risk. Available talent also remains a big issue.”
Being aware of the risks is one thing, dealing with them is quite another. “There is no silver bullet to make risk go away,” Day says. “Good risk management begins with making it someone’s problem. Someone in the organisation has to be responsible for it. After that, businesses need to adopt an integrated data-led approach to it and include thorough risk assessments in decision-making processes.”
If a company is considering an investment in two different businesses and one has a much higher energy demand than the other, it might opt for the one with less exposure to energy costs and a lower carbon footprint, he says.
Horizon scanning is also essential. “We’ve all heard about Ukraine now but how many businesses would have been considering the possibility of a four-month delay in grain deliveries before the outbreak of the war unless they had been listening to the US warnings about the Russian military build-up? You can’t make risks like that go away but you can prepare for them. Businesses have to make sure all risks are considered as part of decisions. A risk-reward mindset needs to be part of the organisation’s culture.”
Organisations that have stood out from the pack have not just managed risks, they’ve taken on risks with confidence
Risk avoidance is not necessarily the best strategy and Day says that organisations need to have a clearly defined risk appetite. “Without risk there is no return,” he says. “Businesses need to be risk aware but not risk averse. People need to understand that there is risk in everything that a business does. It is up to the board to set the appetite and the guide rails for taking risk. Businesses need a risk function that is reporting regularly on the risks which may lie ahead. For example, is the organisation exposed to garage forecourts whose business models will be challenged in the years ahead?”
He says the financial sector is well used to dealing with risks like that. “Financial institutions will place limits on total lending to certain sectors to manage its exposure. Other businesses considering European expansion might decide to limit it to one major and two minor territories in any one year to enable them to deal with risks arising from things like cultural differences.”
He believes a properly resourced risk management function is essential for all businesses of any reasonable scale. “It may be counter-intuitive but the system that enables you to drive a car at 30km/h in a built-up area or at 120km/h on a motorway is the brakes. You trust the brakes to be able to stop the car when necessary. The brakes are like the risk management function and sticking to the rules of the road is the same as operating within the risk guide rails set by the board.”
That requires investment and commitment. “The board and senior management must buy into it,” says Day. “They need to invest in the risk function to ensure they have the right information to hand when making decisions. It’s not just about asking questions, it’s also about having someone in the organisation whose responsibility it is to provide that information before the questions are asked. They also need to invest in the technology which can bring the data together to give them insights into future trends that inform decisions on the introduction of new products and services.”
These investments deliver proven benefits. “The organisations that have stood out from the pack in the past two years have not just managed risks, they’ve taken on risks with confidence,” Day concludes. “These businesses enjoy an agility advantage. They have the right resources engaged in making risk-informed decisions at the right time. These businesses are reaping the rewards of consulting with risk professionals at the outset of new programmes and initiatives.”
For more information visit pwc.ie