Global Risk Management Survey Key Findings

Perennial Risks, New Reality

Although many of the top 10 risks remain unchanged since 2021, the macroeconomic environment in which they must be managed is markedly different. The velocity of risk evolution, which was triggered by the pandemic in many areas, continues to intensify and forge greater interconnectivity between risks.

Top 10 Current Risks

1. Cyber Attack or Data Breach
2. Business Interruption
3. Economic Slowdown or Slow Recovery
4. Failure to Attract or Retain Top Talent
5. Regulatory or Legislative Changes
6. Supply Chain or Distribution Failure
7. Commodity Price Risk or Scarcity of Materials
8. Damage to Reputation or Brand
9. Failure to Innovate or Meet Customer Needs
10. Increasing Competition

As predicted in the 2021 survey, cyber attack or data breach remains the top current and future risk, both globally and for risk and C-suite professionals. Cyber attack or data breach also remains in respondents’ top 10 future risks for every region. Cyber risk did not come into the top 10 until 2015, but it has since risen in importance and became the number one risk globally in 2021 and again in 2023.

Corporate digitization programs as well as increases in remote working and the widespread use of automation and service centers mean that cyber exposure is a critical aspect of overall organizational success. Mitigation actions and protocols can quickly become ineffective as soon as attackers shift their tactics. As Aon’s 2023 Cyber Resilience Report highlights, ransomware attacks were more than 1,010 percent higher in the third quarter of 2023 than they were in the first quarter of 2019, even though they declined in 2022. The overall rise in malicious activity is evident in regular news reports of breaches and exemplifies the need for continued vigilance and proactive protections.

Our survey respondents report their highest-ever level of readiness for cyber attack or data breach at 89 percent, while their reported loss of income from cyber attack or data breach was unchanged from 2021 at 18 percent. Notably, this is the second lowest loss of income reported for the global top 10 risks. These figures align with Aon’s Cyber Resilience Report: despite a sharp rise in incident frequency and severity, ransom payments remained flat and average cyber maturity improved, going from “basic” to “managed” from 2021 to 2023. All these data points indicate that organizations are prioritizing this risk and have plans in place to address its potential effects on their business.

Despite the levels of preparedness reported, only 13 percent of respondents say they have quantified cyber risk, and 24 percent say they have developed risk management plans. The low number for quantifying cyber risk is concerning. It suggests a disconnect between tactical risk improvement and risk governance and deviates from what Aon would recommend as best practice for enterprise management of cyber risk. This is something that organizations should ensure they address, considering changing regulatory requirements for reporting material cyber incidents and risk governance. In short, the complexity and velocity of cyber risk remain challenging for organizations.

Business interruption remains the number two risk, intrinsically linked to many other top 10 risks. Respondents in Latin America rank it as their number one current risk, as do respondents from the natural-resource sector. Business interruption is now more systemic partially because of global business operations’ use of new technology. Additionally, the focus for companies is shifting from event-based to impact-based risk assessment. Though its impacts were previously viewed as linear, the pandemic demonstrated that business interruption can affect multiple industries, regions, trade paths and companies simultaneously as they phase in and out of periods of recovery. At the same time, the number of business interruption events has been increasing. Not only have impact assessment criteria for business interruption shifted from being event-based to becoming impact-based, but they have also been redefined to include environmental, social and governance (ESG)–related categories and increasingly non-damage as well as property damage losses. Ethical, social and reputational impacts are increasingly significant criteria for business interruption losses. So-called non-damage events may not cause any physical damage, but they can result in similar material financial losses. Persistent inflation has also driven up the value of some assets, which can lead to valuation coverage gaps in the event of a business interruption–related loss.

Ranked at number eight in 2021, supply chain or distribution failure moved up to six in our latest survey — its highest ranking in 14 years. This risk is inextricably linked to cyber attack or data breach (ranked number one), business interruption (number two), and commodity price risk or scarcity of materials (ranked number seven). Geopolitical volatility in Asia and Eastern Europe has created new disruptions in production and distribution and exacerbated the supply chain issues, such as workforce shortages, that began during the pandemic. Procurement directors in multinational organizations cite inadequate staffing for transportation and logistics of goods as a major supply chain exposure, preventing them from moving product at their desired pace.

According to the data in this survey, less than 40 percent of organizations have conducted supplier resilience assessments, and less than 20 percent have diversified their supplier base to mitigate supply chain or distribution failure risk. Additionally, only 12 percent of participants indicate they have quantified their supply chain or distribution failure risk. Insufficient mitigation efforts, therefore, appear to be correlated closely with a rise in supply chain or distribution risk exposure.

Respondents rank damage to brand or reputation at number eight — its lowest position since the survey’s debut in 2007. 8 percent of respondents report a loss of income stemming from reputational or brand damage during the 12 months prior to taking the survey. This is the same figure as our 2021 survey, but when a loss does occur, incidents that may seem inconsequential can quickly turn into global headlines when amplified by social media and a 24/7 news cycle; they also have the potential to reduce corporate income and valuations.

The effects of reputation damage on consumer perceptions and behavior — especially among those closely attuned to organizational transparency and ethics — can be immediate and devastating. One incident can not only dampen sales and amplify the cost of selling a product but also damage the entire brand and trigger substantial loss of income. Boards weigh each potential action against how a public with constantly shifting opinions and sensibilities can possibly interpret that action. And because cyber risks and reputational risks are so heavily interconnected, it’s vital that companies have in place robust advance planning for incident recovery. While survey participants appear to be attuned to the causes and effects of reputational and brand damage and are putting plans in place, they are struggling to quantify the risk, with only 11 percent of respondents reporting that they had quantified the risk of damage to brand and reputation.

Top 10 Future Risks

1. Cyber Attack or Data Breach
2. Economic Slowdown or Slow Recovery
3. Commodity Price Risk or Scarcity of Materials
4. Failure to Attract or Retain Top Talent
5. Regulatory or Legislative Changes
6. Business Interruption
7. Increasing Competition
8. Workforce Shortage
9. Failure to Innovate or Meet Customer Needs
10. Cash Flow or Liquidity Risk

Participants predict the future top 10 risks will remain fairly consistent with current top risks. Cyber attack or data breach remains the number one risk in the future, reflecting technology’s role as both a key enabler of economic growth and driver of the progressively complex, evolving cyber threat landscape.

The human-capital impacts on the risk landscape are likely to intensify, according to survey participants. Failure to attract or retain top talent retains its number four rank in predictions for the future, and workforce shortage moves into the top 10 predicted risks, ranking at number eight in 2026 globally. Seven industry sectors include workforce shortage in their top 10 future risk lists, and the healthcare providers and services sector list it as their number two future risk. This illustrates the importance of alignment between risk and people leaders in acknowledging human capital’s fundamental role in enterprise growth as risk resilience and workforce resilience become more intertwined.

Our predictions for other notable future risk rankings gathering momentum:

• Political risk, ranking at number 16 in 2023, moves up five spots in the future risk list to number 11. Participants are clearly concerned that the effects of geopolitical volatility will increase the risk to their organizations. Indeed, increased levels of political polarization across the globe mean a change in a country’s government could come with significant policy changes, causing heightened uncertainty. And with a protracted conflict in Ukraine and greater instability in Israel and the wider Middle East, this prediction may prove accurate.
• Climate change also moves up five spots between 2023 and 2026. While respondents do not rank climate change risk at the level our experts consider appropriate, it does rank as a number seven and nine future risk, respectively, by participants in Latin America and Europe in 2023’s survey.
• AI rises a massive 32 places, going from number 49 in the 2023 current risk list to number 17 in the future risks. HR respondents place AI in their top 10 future risk list at number eight, while participants from India and the UK rank it their number seven and number three top future risk, respectively. This signals that while organizations recognize AI’s economic potential and are embracing new technologies to fuel growth, they also recognize the potential cyber security, legal, operational and human-capital risks it brings.

We believe that survey participants have underrated the following risks:

From a regional perspective, there is some consistency: five current top 10 risks — cyber attack or data breach, business interruption, economic slowdown or slow recovery, supply chain or distribution failure, and regulatory or legislative changes — appear across all geographies.

Cyber attack or data breach is the number one risk in three regions in the most recent survey; only North America ranked this risk number one in 2021, illustrating the escalation in severity and globalization of cyber risk. Nine industries now rank cyber as their top current and future risk, compared with five sectors in 2021.

Failure to attract or retain top talent made it into the top 10 in four regions in our latest survey, versus in two regions in 2021. Another key people risk, workforce shortage, is also gaining momentum, entering the top 10 current risk rankings in Europe and North America. That such people-related risks are not included in Latin America’s top 10 current or future lists is likely a reflection of the sluggish growth that the region has recently suffered.

Damage to brand or reputation remains in the top 10 risks in three regions in our 2023 survey, though in 2021, it was ranked number four in Asia-Pacific and has now dropped out of that region’s top 10. It remains in the top 10 for European and North American participants and has entered the top 10 in Latin America.

Political risk, ranked number five in current risks by respondents from Latin America and the Middle East and Africa, is gaining ground as a perceived threat amid ongoing political instability, rising to number one and number two, respectively, in those regions’ future rankings.

Commodity price risk or scarcity of materials is gaining momentum and is rising in the future risk rankings for respondents in Asia-Pacific, Latin America, and the Middle East and Africa and staying level for respondents in Europe. It does not appear in the North American current or future top 10, suggesting that participants in the region may feel abundant domestic production affords them significant protection from global shortages of commodities.

As stated earlier, respondents from Latin America and Europe include climate change in their top 10 future risks. A review of the top 10 costliest economic loss events due to natural catastrophes in the first half of 2023 provides context for those rankings. Four of the top five events in 2023 — earthquakes in Turkey and Syria; the La Plata Basin drought across Brazil, Argentina and Uruguay; the Emilia Romagna floods in Italy; and the drought in Spain — all took place during the survey data capture period, bringing the devastating impact of climate change into sharp focus in those regions.

Risk and C-suite professionals rank cyber attack or data breach as their number one current and future risk. HR professionals choose the failure to attract or retain top talent as their top risk, and finance professionals select commodity price risk or scarcity of materials as theirs. Notably, respondents in all role types selected the same number one risks for their current and future top 10 lists.

Top 10 Current Risks by Respondent Role

Given that the failure to attract or retain top talent ranks high across all regions and industries, it’s no surprise that HR professionals rank it as their number one current and future risk. While HR and C-suite respondents rank it as a top 10 current risk, workforce shortage was not included in current top 10 lists for respondents in other roles; this is remarkable, given that this is a major concern across several key industries, including healthcare.

It is also significant that C-suite professionals did not include damage to brand or reputation in their top 10 current risks, though risk and finance professionals rank it at number eight and number 10, respectively. Because the C-suite is under increased scrutiny from customers, employees and shareholders regarding corporate social responsibility and ESG, reputational risk would be a likely candidate for a top 10 risk. That it does not appear in C-suite respondents’ top 10 lists indicates a sense that the respondents either have appropriate measures in place to manage the risk or that they view responsibility for reputational risk lies with their organizations’ risk management teams.

Respondents in all roles rank economic slowdown or slow recovery as their number two future risk, and all roles but HR professionals include political risk in their top 10 future risks, illustrating concerns over uncertainties related to ongoing economic and political volatility. Other risk rankings varied. For example, only HR professionals’ future top 10 risks include aging workforce and related health issues and AI risks.

Maintaining a competitive advantage, protecting your balance sheet, focusing your talent agenda and promoting sustainable growth is not easy in today’s fast-evolving landscape. We believe risk resilience and workforce sustainability are fundamental to the success of any organization navigating current geopolitical and macroeconomic turbulence. Whether risks emanate from a proactive digital agenda, climate exposure, supply chain dependence or talent challenges, a shared perspective and fact-based analytics (both retrospective and predictive) can provide invaluable insights about these risks and trends that inform business leaders and enable them to make better decisions about their management.

What is unique in Aon’s 2023 survey is that it vividly illustrates the increasing prominence of the corporate human-capital agenda in two key ways. First, it shows the opportunity. A resilient, skilled and engaged workforce will be able to better execute corporate strategy and create a tangible competitive advantage. On the other hand, it highlights the risks. In today’s landscape, the knock-on impact of getting workforce strategy wrong is bigger than ever and could ultimately prevent businesses from delivering on their goals.

C-suite and people leaders continue to face workforce challenges and opportunities, such as a global pandemic, remote work, a social justice movement, the great resignation and quiet quitting, employee wellbeing and, most recently, a backdrop of economic uncertainty. Risk issues are continuing to blur the line between human capital and business operations. The availability and skills of our workforces are a source and accelerant of business risks such as supply chain and business interruption, and the growing profile of strategic threats — such as a failure to innovate or increased competition — create an environment in which talent gaps become one of the most significant issues on the minds of executives.

As the risks converge, the response from companies needs to be more focused. Boards and other stakeholders are requiring increased visibility into how these people risks and opportunities are being monitored and tracked by leadership over time. As a result, people leaders need to be equipped with the information to address these topics from multiple angles, including how to manage and mitigate the inherent risks. Furthermore, they need to demonstrate progress in managing related exposures and anticipating what will come next.

In a period of rapid change and heightened volatility, finance and risk, people leaders need to come together to better understand how these are interrelated. The goal should be to have a single interpretation of the strategic and financial significance of their firms’ risk profile and follow a united strategy for mitigating, managing and bringing capital to these exposures. We hope the findings from our survey provide food for thought on the key areas that threaten earnings volatility for business today as well as tomorrow.

General Disclaimer
This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent, or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss caused by reliance on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.