While the threat of supply chain disruption caused by factors such as cyber breaches, natural disasters and geopolitical instability in Asia and the Middle East continues to grow, chief among the key concerns for boards of directors and executives at companies around the world are the rapid pace of technological developments and disruptive innovations, along with organizational resistance to change, according to the results of a new survey.
The report, “Executive Perspectives on Top Risks for 2018,” from consulting firm Protiviti and the Enterprise Risk Management (ERM) Initiative in the North Carolina State University Poole College of Management, is based on the responses from 728 board members and executives at U.S.-based and non-U.S.-based organizations across public and private sectors. The results indicate that growing concerns around disruptive innovation significantly outpace fears of economic uncertainty and regulatory scrutiny, which have consistently been the top risk issues of board members and executives over the past several years. Threats related to cybersecurity are a key concern for business leaders as well, particularly in light of recent cyberattacks such as WannaCry, along with those affecting major organizations like Equifax, the report explains. Interestingly, board members across all industries perceive a much riskier environment in 2018 relative to 2017.
“Disruption and digital transformation are taking place across all industries and threatening core business models,” says Pat Scott, an executive vice president with Protiviti. “It’s clear from our latest survey that there has been a major shift in the top concerns for organizations. Digitalization-related risks have supplanted overall economic conditions and regulatory scrutiny atop the list of risk issues for board members and executives who are worried that new technologies and their impact on established business models could outpace their organizations’ ability to keep up and remain competitive.”
The top 10 risks for 2018, according to the respondents, are:
- Rapid speed of disruptive innovations and/or new technologies may outpace the organization’s ability to compete and/or manage the risk appropriately—without making significant changes to the business model.
- Resistance to change may restrict the organization from making necessary adjustments to the business model and core operations.
- The organization may not be sufficiently prepared to manage cyber threats.
- Regulatory changes and regulatory scrutiny may increase.
- The organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues.
- The organization’s succession challenges and ability to attract and retain top talent may limit its ability to achieve operational targets.
- Ensuring privacy/identity management and information security/system protection may require significant resources.
- Economic conditions in the organization’s target markets may significantly restrict growth opportunities.
- An inability to utilize data analytics and big data to achieve market intelligence and increase productivity and efficiency may significantly affect the ability to manage core operations and strategic plans.
- Existing operations may not be able to meet performance expectations related to quality, time to market, cost and innovation, as well as competitors—especially new competitors which are “born digital” and have a low-cost base for their operations.
“In light of the shifting risk landscape, it’s particularly interesting to observe an increasing concern among survey respondents that their organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues to senior management and the board,” says Dr. Mark Beasley, Deloitte Professor of Enterprise Risk Management and director of NC State’s ERM Initiative. “As boards of directors and senior executives seek to improve their understanding of emerging risk issues, they may need to re-evaluate how their organization’s culture might be impacting the robustness and transparency of their risk identification and risk reporting efforts.”
While I too was interested to read that “the organization’s culture may not sufficiently encourage the timely identification and escalation of risk issues” was cited as the fifth leading risk concern, I am more intrigued that “Resistance to change may restrict the organization from making necessary adjustments to the business model and core operations” is the second top concern. Do you think that is a key risk in your organization or among key suppliers? How do you think companies can work to change that resistance among employees?