Key Observations

The qualitative interviews for OnRisk 2022 provide a snapshot of how the principal drivers of risk management interact, which risks pose the greatest challenges to their organizations, and how alignment on risk management efforts impacts success. Analysis of the results identified six key observations that shed light not only into how risks are understood, but also how the ability to manage risk is perceived. In-depth examinations of these observations are found later in this report.

• There are notable variations among risk management players on certain risks. Overall, there is general alignment on organizational capability, risk relevance, and personal knowledge. However, there are noteworthy variations in several key risk areas.

• Significant gaps exist between risk relevance and organizational capability ratings on several risks. The gap between how risk management players rate risk relevance versus organizational capabilities is alarmingly wide for Talent Management, Disruptive Innovation, Data Privacy, Cybersecurity, and Culture.

• Risks to pay attention to going forward. Five risk areas emerged as top of mind for respondents: Cybersecurity, Talent Management, Culture, Disruptive Innovation, and Economic and Political Volatility. Of note, four of the five also had the largest gaps between risk relevance and organizational capabilities, suggesting risk players know where work needs to be done.

• Perceptions of risk relevance vary greatly across ESG components. While alignment among the three groups is relatively strong on these risks, Organizational Governance holds far greater relevance for respondents than do Social Sustainability and Environmental Sustainability.

• The pandemic revealed opportunities to improve organizational risk management. COVID-19 may not have improved the ability to predict risks, but it increased confidence for many in reacting to risks. For others, it provided a wake-up call on how they manage risk and the added challenges associated with managing risk in decentralized or siloed conditions.

• Senior executives and boards desire broader scope for internal audit services. Respondents feel that their current assurance services are adequate but suggest some improvements in assurance reporting. This offers an opportunity to demonstrate the value of independent assurance across a wider spectrum of risks.