If we don’t take risk, we don’t progress. Taking risk intelligently is the only way organisations can reinvent and transform to survive, create value and prosper in this time of uncertainty, while building resilience to protect value in the face of complex, ever-changing risk.
PwC’s Global Risk Survey 2023 reveals how leading organisations are changing the way they see risk by embracing the transformative power of technology and data in pursuit of opportunity and value creation.
The research—which surveyed 3,910 business and risk leaders, from the boardroom and C-suite, across tech, operations and finance, as well as risk and audit—also highlights how technology is playing an increasingly important role in helping organisations protect value by mitigating and managing downside risk more effectively.
“The age of the benign risk environment is over for the foreseeable future, amplified by the increasing pace and impact of technology change. These threats mean taking risk intelligently—powered by technology and framed by growth and opportunity—is now critical to adapting and reinventing yourself in this constantly changing world to both protect and create value.”
The transition to new energy sources is seen as the biggest opportunity among external disruptors, cited by 54% of respondents, closely followed by changes in customer demand and preference (47%). By contrast, supply chain disruption is the main external factor seen as more of a risk than opportunity, cited by 42% of respondents.
Industry sector also has an impact on whether organisations sit at the value protection or value creation end of the risk appetite scale. Those in faster moving sectors, such as retail and tech, are more likely to embrace risk and seek opportunity, while those in regulatory driven sectors such as government and pharmaceuticals are more likely to prioritise compliance and focus on risk avoidance. Different functions within the organisation also have different perspectives on risk, with finance roles more likely than others to say their organisation is focused on risk avoidance over a high risk appetite.
Q. For each of the statements below, please indicate on the sliding scale which best describes your organisation. Q. To what extent do you currently see the following technology disruptors as a risk versus an opportunity for your organisation? Q. Which, if any, of the following situations / occasions trigger a review of your organisation's risk landscape? Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Crucially, our survey reveals a top performing 5% of organisations spread across all industry sectors—identified in the research as Risk Pioneers—who are forging ahead in the pursuit of opportunity. Underpinned by strategic enterprise-wide resilience and guided by a human-led, tech-powered approach, these pioneers are significantly more likely than other organisations to be upskilling internal teams and making greater use of advanced analytics, predictive modelling, cybersecurity tools and cloud to navigate risk. And they are more likely to see emerging technologies such as GenAI as an opportunity rather than a risk.
As a result, this leading group is better aligning the navigation of risk with business strategy to achieve a greater range of outcomes and value—from more robust regulatory compliance and streamlined reporting to enhanced customer trust and identifying new commercial opportunities.
Our survey highlights five compelling findings for leaders. Each is explored further in this report, focusing on why they matter to organisations and their stakeholders, the value they create, and practical ways to use technology and data in new ways to navigate risk.
Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience.
We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach—revealing four illustrative risk archetypes and a top-performing group of Risk Pioneers.
Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.
Five key actions for organisations to ensure they are resilient and equipped to survive, create value and prosper amid uncertainty and complex, ever-changing risk.
The journey to taking risk more intelligently—powered by technology and through the lens of reinvention, opportunity and growth—requires leaders to start with these four key questions
Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience.
Only inflation ranks higher than cyber (the top tech-related threat) in terms of the risks respondents feel most exposed to, while other digital and tech risks are almost on a par with macroeconomic volatility. A third of CEO respondents in our survey say they feel highly or extremely exposed to cyber risk, and those leaders primarily responsible for managing risk ranked cyber risk above inflation.
But our survey shows such tech-related risks, from cyber attack to costly—and potentially brand damaging—mistakes in deploying technology are not putting organisations off investing in technology. The appetite for innovation and new technology is encouraging organisations onto the front foot. They are proactively assessing and mitigating these risks to transform and to manage their costs, support growth and ultimately build their resilience.
Preparing for technology investments, from cloud to emerging technologies such as GenAI, is the single biggest motivating factor for an organisation to review its risk landscape—cited by 57% of respondents overall, and 62% of respondents from large organisations with revenues of USD$5bn or more. That is higher than organisations being triggered into a review by a risk event (50%) or entering new markets (46%), marking a step-change in where and why risks are assessed.
Technology disruptors are also much more likely to be seen as opportunities than risks compared to other external non-tech disruptors. For example, 60% of respondents see GenAI as an opportunity compared to just 35% who see changes in regulation as an opportunity and 28% who see supply chain disruption as an opportunity. Given their position at the forefront of exploring and implementing emerging tech across their organisations, the results also show respondents in operations and tech roles are more likely than all the other job roles and functions to see GenAI as an opportunity over risk.
This enthusiasm for GenAI echoes separate PwC research, the Global Digital Trust Insights Survey, which found 77% of respondents stating that GenAI will help their organisation develop new lines of business over the next three years, while our Global Workforce Hopes and Fears Survey of more than 50,000 workers reveals employees see more positive than negative impacts from AI on their roles, despite headlines about AI-fueled job losses.
“Artificial intelligence automation can help us improve efficiency, while data analysis capabilities can help us make more accurate judgments and mitigate risks.”
We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach. This reveals four illustrative risk archetypes. And when we then looked at those organisations achieving the greatest range of outcomes, we identified a small distinct group of top-performing Risk Pioneers leading the way.
Click each archetype below to learn more.
5%This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful value creation outcomes than others.
Close this quadrant Back to Risk Archetypes28%Spread across most industries and culturally predisposed to the pursuit of value creation over value protection but rely primarily on their human insights and culture of innovation to achieve it. More than three-quarters (77%) have a high appetite for risk and 88% seek to uncover opportunity in risk over regulatory adherence. They are more likely to have a proactive approach to taking risk and building resilience. However, they are also more likely to be using basic technology and data tools for managing risk, which lack comprehensive integration. And their enterprise tech strategy is less likely to include investment in tech specifically to build resilience and manage risk.
Read more Close this quadrant Back to Risk Archetypes20%Focused more on value creation than value protection, are more advanced in the use of technology to achieve it, and are more likely to have fully integrated their use of technology and data in risk management and be using advanced and predictive risk management capabilities to identify and evaluate potential risks. This archetype is spread across most industries, apart from a significantly lower representation of organisations from government and public services. More than three-quarters have a high appetite for risk and 89% seek to uncover opportunity in risk over regulatory adherence. They have a proactive approach to building resilience to unexpected disruptive events.
Read more Close this quadrant Back to Risk Archetypes27%Culturally focused more on value protection and less advanced in their strategic use of technology. Government and public services organisations are more likely to be present in this archetype. Three quarters (76%) focus on risk avoidance over opportunity and 71% prioritise regulatory adherence when managing risk. This archetype is more likely to be using basic technology and data tools for navigating risk, lacking comprehensive integration. And they are less likely to be using tools such as advanced analytics or predictive modelling, real-time monitoring, data visualisation and cloud to identify and evaluate potential risks.
Read more Close this quadrant Back to Risk Archetypes20%Advanced in their use of technology and are more likely to have fully integrated their use of technology and data in risk management with regular updates and improvements—they are using it primarily for value protection rather than a strategic pursuit of value creation. Spread across all industries, almost two-thirds prioritise regulatory adherence over opportunity when managing risk and they are more likely to have low risk strategies.
Read more Close this quadrant Back to Risk ArchetypesIt should not be assumed the more reactive and protection focused nature of some of the archetypes within this quadrant signals a lack of ambition or intent to shift towards value creation. In turbulent economic conditions and disruptions that have affected some industries more than others, those organisations may be constrained in their ability to invest in the talent and technology needed, or may feel exposed to risks so significantly that value protection is seen as the best and only outcome currently.
Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.
As the chart below shows, Risk Pioneers are consistently outperforming other organisations through their approach to risk, particularly in value creation outcomes such as identifying new commercial opportunities and improving financial performance.
| Status | Risk pioneers | All |
|---|---|---|
| Enhanced customer trust and confidence | 89% | 40% |
| Identification of new commercial opportunities | 84% | 32% |
| Improved financial performance due to effective risk mitigation | 84% | 32% |
| More robust compliance with regulatory standards | 81% | 40% |
| Better alignment of risk management with business strategy | 80% | 31% |
| Increased accuracy in risk forecasting | 79% | 29% |
| Building competitive advantage | 79% | 31% |
| Expansion into new markets | 78% | 28% |
| Enhanced response time to emerging risks | 77% | 28% |
| Streamlined risk reporting and communication | 76% | 32% |
| Greater integration of risk management across business functions | 76% | 30% |
| Improved identification and tracking of potential risks | 75% | 31% |
| Improved resilience to external shocks or crises | 75% | 28% |
Our survey shows a fairly even spread of Risk Pioneers across most industries. They are particularly prevalent in financial services, retail and consumer, technology, media and telecoms, and from organisations with revenue of USD$5bn or more. Respondents are more likely than the survey average to be CEOs and the board (34%) and their organisation is more likely to have seen revenue increase in the past six to nine months and be expecting it to increase again in the next 12 months. Almost three-quarters (73%) of Risk Pioneers also have an enterprise-wide technology strategy and roadmap, which includes investment in technology specifically to drive resilience and/or manage risk—compared to 53% of overall survey respondents.
1.8x more likely to say they are very confident of balancing growth with managing risk
1.8x more likely to see GenAI as fully an opportunity than risk
1.6x more likely to proactively take risk to create opportunities versus prioritising safe or low risk strategies
1.4x more likely to prioritise building resilience to unexpected disruptive events versus prioritising stability and continuity when trigger events occur
More likely to view their own risk appetite (30%), their CEO’s (31%) and their board’s (26%) as eager/hungry, indicating closer leadership alignment on taking risk
2.7x more likely to be using advanced and predictive risk management capabilities together with cutting-edge technology and data to navigate risk
Less likely to say legacy technologies have impacted their organisation’s ability to manage and respond to risk.
2.6x more likely to have improved financial performance due to effective risk mitigation
2x more likely to have achieved more robust compliance with regulatory standards
These leading Risk Pioneer behaviours and outcomes reveal a clear gap that organisations need to address if they want to make more effective use of tech and create opportunity and value out of risk. Around two-fifths of all organisations have improved their approach to managing risk to enhance customer trust and improve compliance with regulation. But fewer than a third of organisations have achieved successful outcomes across other key areas, highlighting the opportunity to achieve better outcomes from their risk strategy and to provide strategic value.
“Do you truly understand the risks you are accepting? Protecting your organisation is a tradeoff looking at risk and your acceptance of risk against efficiency and profitability—they play off one another. For example, one food manufacturer we work with had one ingredient costing around USD$30m per year and procurement wanted to get that down by USD$2m. The supplier said consolidating production from five different plants to one would generate economies of scale and achieve the savings. What they didn’t realise was that doing this introduced a single point of failure in their supply chain for a critical ingredient that USD$9bn-worth of deliverable goods depended on—and this single plant was in a part of Oklahoma with a history of large tornadoes within a 10-mile radius of the plant.”
There is clear ambition among most organisations to take a more tech-powered approach to risk, seen by their intention to invest in AI, machine learning, automation, cybersecurity and cloud. But many respondents are still at relatively early stages of maturity in their use of technology and data for managing risk. Just one in ten organisations are already using advanced and predictive analytics, cutting-edge tech and data for managing risk and are continuously refining and innovating.
Q. Which of the following statements best describes your organisation’s approach to using technology and data for risk management?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Risk pioneers, organisations with USD$5bn+ revenue and technology companies are more likely to be at the advanced stage of implementation, while respondents in the government and public services sector are more likely to be just starting to use technology and data to manage risk. Those organisations more advanced in implementation are using on average a greater number of technologies to navigate risk—4.6 versus 2.5 overall.
"Technology comes into its own when risk and opportunity are joined up and understood across functions and business lines, elevating it to a strategic level. Integrating risk with reporting ensures accuracy and consistency in communication on risk, uniting teams internally and building trust and credibility externally. Consolidating sustainability risk and information using technology promotes a comprehensive understanding of operational resilience, visibility into the real costs of the value chain, and helps identify market opportunities. Instead, using technology that is flexible and scalable allows organisations to follow a more manageable roadmap of incremental and steady change.”
Existing legacy technology investments—often becoming more complex through years of mergers, acquisitions, restructuring and consolidation—are also impacting the ability of organisations to manage and navigate risk.
Q. In what ways, if any, have legacy technologies impacted your organisation’s ability to manage and respond to risk?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
There also appear to be differences between those in tech and operations and those in risk and audit when it comes to the perception of how mature their organisation’s use of tech and data to navigate risk is. For example, 68% of tech respondents and 63% of operations respondents say their organisation is using advanced analytics or predictive modelling to identify and evaluate potential risks to a large or very large extent. But this compares with just 49% of risk executives and 15% of audit respondents who agree with that statement.
Despite these challenges, as the Risk Pioneers are demonstrating, the opportunity for early advantage is still available to those bold enough to move quickly, and embrace emerging technology at speed.
"AI can help streamline the risk management process by automating repetitive tasks and reducing the risk of human error. With the power of AI, risk managers can make more informed decisions and create a safer, more secure future."
An approach to risk led by a clear and authentic purpose can help organisations be more resilient and guide which risks to embrace or avoid. It ensures the whole organisation understands the direction and ambition for the future, and helps build trust with stakeholders—from employees and customers to investors and regulators.
Purpose provides a vital strategic lens on whether a risk is more threat or opportunity, particularly around issues such as climate change, sustainability, ethical supply chains and the responsible use of emerging tech, such as GenAI. Yet only around a third (32%) of respondents say they strongly agree that their organisation uses purpose and vision for the future to make decisions about risk.
This compares with 59% of Risk Pioneers, who strongly agree their organisation uses purpose and future vision to guide risk decisions and this can be seen in their approach to external disruption. For example, 44% of Risk Pioneers see supply chain disruption as mostly or fully an opportunity over risk, versus 28% of overall respondents and 63% see the transition to new energy sources as mostly or fully an opportunity versus 54% of the rest of the survey respondents. And when it comes to a responsible approach to tech, almost three-quarters (74%) of Risk Pioneers have already implemented ethical frameworks for emerging tech versus 39% of survey respondents overall.
“An approach based on adherence to minimum regulatory standards and avoidance of financial loss creates risk in itself.”
Working with your employees and wider stakeholders, such as investors, regulators and non-executive directors, to set a clear and authentic purpose builds the right risk mindset, which then feeds into the risk frameworks and metrics that will help build resilience and deliver sustainable outcomes.
Most organisations (91%) are confident they can balance growth ambitions with managing risk effectively, but there are differences when we analyse responses across different job roles and functions.
For example, half of CEO and board respondents are very confident of balancing growth and risk compared to just 34% of operations leaders and 30% of audit leaders. And only just over a fifth of risk executives say their own risk appetite matches that of their CEO and board.
There is also misalignment on the perception of the strategic value the risk function provides, with CEOs less likely than risk executive survey respondents to agree the risk function is demonstrating behaviours such as bringing risk insights to the board for better oversight, guiding the business through complex change and challenging senior management.
For example, 60% of risk executives say they are already demonstrating providing insights on new and emerging risks to senior management versus 54% of respondents from the wider business—CEOs, the board, operations, tech and finance.
This disconnect is also evident in PwC’s Global Internal Audit Study 2023, with business leaders stating they want more early and proactive strategic engagement with Internal Audit. Despite that expectation, only around a fifth of executives ranked strategic thinking and the ability to challenge constructively as key strengths of Internal Audit. And almost half (49%) said Internal Audit does not have strong alignment with other lines on key risks and challenges.
We see far greater alignment between the CEO/board and risk among the top performing Risk Pioneers. Almost a third (32%) of Risk Pioneers stated that their own risk appetite matched exactly that of their CEO and board, compared to just 22% of overall respondents.
This leadership disconnect needs to be resolved if risk management is to amount to more than value protection and a reactive response to threats. Fostering greater collaboration between the risk function, leadership and the wider business and having more strategic conversations earlier in the process are key if organisations are to find opportunities where competitors may still see risk.
There is a link between resilience investments and achieving risk management outcomes, with better performing organisations more likely to have invested across more resilience initiatives in the last 12 months.
Although around half of organisations have invested in specific resilience initiatives, these remain in isolated pockets with just 7% have invested across the board in more strategic and proactive enterprise-wide resilience.
Q. Which, if any, of the following resilience investments have your organisation made in the last 12 months or are planning to in the next 12 months?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Our survey shows relatively strong investment currently in resilience initiatives such as investing in digital communication and remote sharing to enable remote working in a crisis, upgrading critical systems to be more resilient against cyber attacks and establishing protocols with major tech providers to coordinate incident responses. But there is room for improvement in initiatives such as establishing a cross-functional resilience team, expanding your network of key suppliers as part of business continuity plans and building back-up production facilities.
Ambitions of making risk a strategic player that helps organisations to take on risk with confidence and unlock new opportunities and sources of value must be matched with the development of skills and capabilities.
Yet only 31% of organisations say they strongly agree that upskilling teams to be better prepared for potential risks or that providing employees with the right skills to better enable them to solve complex problems are a priority. That compares to 60% and 58% of Risk Pioneers respectively who strongly agree with those statements.
Another key growth mindset behaviour evident in top performing organisations is detoxifying failure through a ‘safe to fail’ culture, where employees feel they can experiment and adapt to different circumstances and events. Yet only a quarter of respondents said they strongly agree their organisation has a safe to fail culture, compared to half of Risk Pioneers.
Organisations will need to recognise the whole organisation has a role to play in navigating risk, from increasing collaboration internally and externally across supply chains and ecosystems, to challenging their risk appetite and collectively building resilience. This presents the opportunity for a new role for risk teams where there will be a more strategic use for their insights and experience.
Organisations can no longer afford to rely on a reactive approach to risk that focuses primarily on avoidance. Nearly 40% of CEOs respondents think their company will no longer be economically viable a decade from now if it continues on its current path. From climate and geopolitical risk to macroeconomic volatility and the disruptive power of technology, organisations must change and reframe the way they see risk to build resilience and unlock opportunity.
The ability to adapt, change and reinvent at pace amid this constant change and uncertainty is vital for survival and sustainable growth. Harnessing the power of technology and data in new ways, combined with building more diverse multi-disciplinary capabilities across the organisation, will be critical to turning risk into that enabler of change and growth.
The PwC Global Risk Survey 2023 is based on 3,910 responses from business and risk management leaders (CEO, board, risk management, operations, technology, finance, audit) across 67 territories providing their views on the status and direction of risk in their organisation.
Survey responses are from a range of industry sectors and organisation sizes, with over a quarter from USD$5bn+ organisations.
PwC Research, PwC’s global Centre of Excellence for market research and insight, conducted this survey.
Asia Pacific Risk Services Leader, Mainland China and Hong Kong Digital Trust & Risk Leader, PwC Hong Kong
Tel: +[852] 2289 2919
