SIGNIFICANT GAP IN RELEVANCE AND CAPABILITY RATINGS ON SEVERAL RISKS While some ratings variation among individual respondent groups was expected, an analysis of the combined ratings for the three respondent groups uncoveredadditionalinsights.Theanalysisidentifiedlargegapsbetweenhigher risk relevance and lower organizational capability in several areas. This RelevanceCapabilityGapeflect r spotentiallysignificantriskmanagementvulnerabilites. Chief among these is Cybersecurity, which continues to exasperate organizations largeandsmall,publicandprivate,fo-prr ofitandnoprofit.Thisubiquitosand dynamic risk was rated as the most relevant by respondents, along with Talent Management(Figuer 3).Yet,onaverage,gan or izationalcapabilityagged significan.Lartly gedisparitesalsoarenotedforTalentManagement,Disruptive Inovation,e, Cultr DataPrivacy,andEconomicandPolitcalVolat. ilty
“As we have witnessed with the pipeline hack this year, these cybersecurity attacks can have a huge trickle-down effect. All industries are susceptible to cybersecurity risk to some extent.” – Board, Manufacturing
Fortheserisks,theelr ationshipbetweenelr evanceandcapabilityvaries.highellyr evantriskmaybeemor difficultomanage because it is unpredictable and not easily controllable, due to, for example, external factors that may augment risk velocity. This appearstobethecasefoee rth ofthesixriskswithelargestdisparites:Cybersecu,rity DisruptiveInovation,andEconomic andPolitcalVolat.Howevilty er,forTalentManagement,e, Cultr andDataPrivacy—risksthatcanbemanagedinternaloughlythr coolsntr andprocesses—thegapsmayeflect r emor uncertaintycomingoutfthepandemicratherthanalackofcool.ntr Figure 3:
AVERAGE RATINGS PER RISK AREA Percentage who gave a rating of 6 or 7 on a scale of 1 to 7 PERSONAL KNOWLEDGE
Note: OnRisk 2022interviewquestions:Howknledgeableareyouabouteachofthefolowingrisks?elHowr evantareeachofthefolowingriskstoyur cuenr gan tor ization?Overall,howcapableisyourcompanywhenitcomestohandlingenterprisewiderisk?Respondentscouldchosearatingfromascale of1to7,with1beingthelowest(“notatall”)and7beingthehighest(“extr
emely”).espo lr ndents.
ORGANIZATIONAL CAPABILITY
RISK RELEVANCE
n=90.
www.theiia.org 10
