Recent Crises Reshaping Perceptions of Risk, Risk Management

Cyber risk remains the top risk on the minds of European risk managers, though the impact of events like the COVID-19 pandemic and the Russia-Ukraine war on their views of risk is clear, according to a survey by the Federation of European Risk Management Associations (FERMA).

FERMA's 2022 risk manager survey found 63 percent of risk managers surveyed citing cyber threats as the top risk in 2022, up from the 48 percent who put the peril in the top spot in the 2020 version of the FERMA survey.

Rounding out 2022's top 5 risks were supply chain or distribution failure, 41 percent; geopolitical uncertainties, 31 percent; uncertain economic growth, 31 percent; and overregulation, 27 percent.

By comparison, the remainder of the top 5 in the 2020 FERMA survey included uncertain economic growth, 27 percent; availability of key skills, 22 percent; data fraud or theft, 21 percent; and overregulation, 19 percent.

This year's report is the 11th edition of the FERMA survey and is based on responses from 556 risk managers in 27 countries. The survey was conducted in association with PricewaterhouseCoopers (PwC).

"The survey that has been run by FERMA during this period between 2020 and 2022 has highlighted the role of risk managers in managing the major crises that have struck during this period, firstly the COVID crisis and lastly the Ukraine war," said Francoise Berge, a partner at PwC, during a webinar discussing the survey findings. "This has been a very intensive period for risk managers, and it has also been a period of consolidation of the role of risk managers in organizations."

In assessing the risks facing organizations, "The post-COVID landscape is threefold," Ms. Berge said.

While cyber attacks remain the top concern, there's a set of risks related to events like the pandemic and the Russia-Ukraine conflict, such as supply chain risks, uncertain economic conditions, and geopolitical instability.

Another group of exposures is related to the various transitions confronting organizations, such as changing consumer behavior, climate change, technological changes, and regulatory change, Ms. Berge said.

Looking at risk managers' medium- and long-term views of risks, changing consumer behavior became the top concern within the next 3 years, according to the survey, cited by 36 percent of those surveyed. Cyber threats ranked as the number 2 medium-term peril at 35 percent, followed by uncertain economic growth at 32 percent.

Over the longer term, climate change ranked as the top risk within the next 10 years, cited by 48 percent of those surveyed, followed by changing consumer behavior at 24 percent and natural disasters at 21 percent.

Another participant in the FERMA webinar, Marco Terzago, risk and insurance manager at SKF and a board member of ANRA, the Italian risk management association, discussed the perception of changing consumer behavior as being among the top medium- and long-term risks facing organizations.

Mr. Terzago said he wasn't surprised to see changing consumer behavior ranking high on those lists. "It's true that we have other urgencies like of course supply chain or distribution failures or geopolitical uncertainties," he said. "But I would say that this is something that is an effect that respondents have highlighted to the medium- or long-term based on the fact that the world has completely changed. It is something like the 9/11 change because of the pandemic and the war crisis."

"Of course, the supply chain crisis has also accelerated some of the trends we were seeing before the pandemic," Mr. Terzago said.

The FERMA survey also asked risk managers to identify the top 5 risks lacking management attention in these times of transition. That group of exposures and the percentage of respondents citing them included climate change, 28 percent; cyber threat, 28 percent; geopolitical uncertainties, 21 percent; speed of technological change, 19 percent; and changing consumer behavior, 17 percent.

"Surprisingly what we see is that those five concerns are some of the top five risks," said Ms. Berge. "It is somewhat worrying to see that the risks our respondents rank as the top risks lacking management attention are also the risks ranked as the most critical."

Webinar panelist Karl Johan Rodert, group risk manager captive and insurance at Autoliv and president of SWERMA, the Swedish risk management association, said he thinks the lack of management attention to climate change risk might be due to the lack of direct impacts of climate change on many businesses thus far.

"What I'm seeing right now is the risk of climate change is not the effect of climate change, but rather if we don't live up to our promises, how will consumers behave with respect to our company? That might come into that changing consumer behavior," Mr. Rodert said.

This year's FERMA survey also underscored the COVID-19 pandemic's impact on heightening risk management's role in organizations.

"The COVID crisis has brought risk management closer to the board room," Charlotte Hedemark Hancke, senior risk specialist at SAP and a FERMA board member, said during the webinar. "And (risk managers) are also more involved now in strategic processes, not only dealing with risks but also other processes."

The survey found that 91 percent of the risk managers responding are involved to some extent in corporate strategy, either fully, mostly, or partially. In the 2020 survey, only 55 percent of risk managers were involved in their organizations' strategies.

The roles of risk managers in their organizations' strategies included reviewing strategic risks, 61 percent; contributing to the strategy definition, 40 percent; working on sustainable risks and impacts, 40 percent; working on disruption risks, 37 percent; working on different business plan scenarios, 33 percent; analyzing opportunities arising from strategic risks, 28 percent; and working on digital stakes, 16 percent.

In addition, the survey showed that the risk manager's role in the organization's governance is becoming consolidated, Ms. Hedemark Hancke said.

"The risk management function takes part in various different committees within the organization," she said. The survey showed 58 percent of respondents participating in their organizations' risk committees, 39 percent in the audit committee, and 34 percent in the executive committee.

"We also saw that 39 percent of the respondents stated that they can contact the CEO directly and 36 percent of risk managers present to the board more than once a year," Ms. Hedemark Hancke said. "So actually, the COVID-19 crisis did impact the frequency of risk management discussions at the board level, top management level."