Global ESG, Compliance, and Risk Report 2023

Mature Risk Management in Uncertain Times

November 2023

By Julia Gebhardt, Katharina Hefter, Juliane Butters, Eva Kalteier, Matteo Coppola, Bernhard Gehra, Thomas Pfuhler, Jeanne Kwong Bickford, Abhinav Bansal, and Pierre Roussel

BCG

群内每日免费分享5份+最新资料

300T网盘资源+40万份行业报告

为您的创业、职场、商业、投资、亲子、网赚、艺术、健身、心理、个人成长 …… 全面赋能！

关注公众号获取更多资料

添加微信，备
注“入群”
立刻免费领取
200套知识地图+最新研报

致终身学习者社群

行业报告/思维导图/电子书/资讯情报

收钱文案、增长黑客、产品运营、品牌企划、营销战略、办公软件、会计财务、广告设计、摄影修图、视频剪辑、直播带货、电商运营、投资理财、汽车房产、餐饮烹饪、职场经验、演讲口才、风水命理、心理思维、恋爱情趣、美妆护肤、健身瘦身、格斗搏击、漫画手绘、声乐训练、自媒体打造、效率软件工具、游戏影音……

扫码先加好友，以备不时之需

Mature Risk Management in Uncertain Times

The COVID-19 pandemic and the outbreak of war in Ukraine have tested risk management capabilities—in particular, in industries outside the financial sector—as never before. The torrent of challenges they posed proved too much for some companies, while others emerged strengthened and renewed. What exactly were the top-performing companies doing right during these crises—and what can the rest learn from them?

In this report, we look at the current status of risk management in industries outside the financial sector and review the principal findings from an extensive survey of senior executives across industries globally. Crucially, we then set out the practical measures that companies can take to move from aspiration to achievement in risk management.

The main conclusions of our report are as follows:

• Companies that had already put in the hard work to cultivate mature risk management emerged from these crises confident and relieved that they had done so. Indeed, these companies’ paths through the crises were altogether smoother than for rivals that had not brought their risk management capabilities to the same level of maturity. The difference was stark. While almost three in four companies (71%) with mature risk management capabilities agree that these capabilities helped to mitigate the many potentially negative consequences of the crises, only around half as many (37%) with less-developed risk management reported the same thing. When it came to the crunch, investment in risk management materially paid off.

• Our BCG survey also gets to the bottom of what mature risk management actually means in practice. To succeed in periods of intense crisis, risk management rests on a crucial interplay: a strong strategic foundation in combination with effective operative implementation. A corporate center first sets the overall strategy, and then the various business units and subsidiaries bring it to life, firmly integrating risk management into the culture and everyday processes of the whole organization. In companies with mature risk management, there is close and constant cooperation between the center and the outlying entities.

Indeed, more than half of top performers (58%) state that the influence of the strategic risk management team at the center of the organization was a success factor during this period of crises. Next in the list of importance came embedding risk management into strategy and planning processes (46%), and data and analytics (also 46%). The latter finding supports the belief that the analysis of data collected by the organization, together with AI, and generative AI in particular, are essential elements of an advanced risk management capability.

• For leaders and starters—those already equipped with mature risk management and those with still some way to go, respectively—very different challenges lie ahead. Starters can certainly learn much from the path already taken by leaders. But first, they need to focus on fixing the basics, such as securing buy-in from senior management to make risk management a priority. For leaders, the maturity of their risk management inevitably requires them to maintain more developed frameworks and processes.

While starters are still exclusively directing their attention within their organization, leaders are also paying close attention to the external environment and its emerging risks, such as the rapid growth of regulatory scrutiny. Starters urgently need to make progress in moving to the next stage of maturity to derive the full benefit of risk management revealed in our survey.

This report sets out how they can do just that.

Introduction: Industries Outside the Financial Sector Arrive Late to the Party

Risk management has long-standing roots within financial institutions, where it has played a vital role in preventing crises or alleviating their most damaging effects. The avalanche of regulatory requirements in the wake of the 2008 financial crisis forced these institutions to take their risk management to a yet more advanced stage, leading to increased sophistication and a wave of innovation.

Outside the financial sector, however, risk management has taken longer to establish itself and mature. This has been partly due to a comparative lack of clear regulatory requirements. Another reason is the greater difficulty in quantifying nonfinancial risks, and therefore in building the requisite quality of database.

However, recent crises—namely, the COVID pandemic and the Ukraine war—have turned an unprecedented spotlight on risk management outside the financial sector. The many risks resulting from these volatile situations, such as supply chain disruption, increased cyberattacks, or the potential expropriation of assets, have severely tested the resilience of companies worldwide.

Our survey investigates the current status of risk management and the role it played in helping companies through these turbulent conditions. It confirms what financial institutions have experienced in the past: mature risk management is vital for withstanding crises as they happen, but also for preparing organizations to anticipate and handle those of the future, such as the escalating volume of regulation on environmental, social, and governance (ESG) topics and the potential ramifications of noncompliance.

The survey garnered responses from senior executives at 150 companies of various sizes, in different industries, and from all over the world. Almost all the companies are from outside the financial sector. (The breakdown of respondents is shown in Exhibit 1.)

Exhibit 1 - Our Findings Are Based on Feedback from 150 Companies

Industries

Participants

Source: BCG analysis.
Company size (#FTE)

Company revenue

Crisis Spotlight: Principal Findings on Impact of Risk Management

The survey results clearly show that risk management was an essential factor in companies’ resilience and success in times of crisis.

Importantly, when risk management has progressed to a certain level of maturity, its value escalates. Almost three in four (71%) respondents from companies that boast high maturity agree that it has helped mitigate the worst effects of recent crises, whether military conflict, pandemic, or a blockage in the supply of semiconductors. However, only 37% of companies with a low level of maturity say the same thing. (See Exhibit 2.)

Higher maturity allows companies to respond to local challenges in ways that are appropriate to a given country or region.

A high level of maturity grants flexibility, allowing companies to respond to local challenges rather than applying identical solutions across the board, even when they are not appropriate to a given country or region.

The value of mature risk management was most keenly appreciated in larger organizations. As their supply chains are more intricate, any relevant interruption creates more complex challenges that demand more sophisticated, comprehensive, and structured risk mitigation. Moreover, given their greater resources, these companies were more likely to have already had mature risk management in place at the onset of these crises.

As Exhibit 3 shows, the perceived importance of risk management at times of crises increases with the value of the company. Indeed, companies are much more likely to “strongly agree” with this notion when they are worth more than \$10 billion.

What Top-Performing Companies Did Differently During the Crisis

What are the main lessons companies can learn from the experience of top performers during recent crises?

A key conclusion of our study is that companies that had already formed a central strategic risk management team and had integrated risk management into their overall strategy and planning process were more likely to withstand the effects of crises.

When asked what helped them to survive the challenges, top performers were most likely (58%) to cite the formation of a strategic risk management team at the corporate center. Next in order of importance came embedding risk management into the strategy and planning process and the intensification of data analytics, both with 46%. (See Exhibit 4.)

These findings confirm that the strategic and operative aspects of risk management must work closely in tandem to achieve the best results. In times of global crises and in complex company structures especially, a central team first needs to lay a strong strategic foundation.

Exhibit 2 - A Highly Mature Risk Management Is Key to Navigating Through Crisis

Did risk management contribute to mitigate implications of this crisis/pressure?

Source: BCG analysis.

Exhibit 3 - Complexity Requires Maturity: The Bigger the Company, the Higher the Need for More Sophisticated Risk Management

Did risk management contribute to mitigate implications of this crisis/pressure (pandemic, Ukraine war)?

Assets of \$500 million−\$5 billion

Source: BCG analysis.
Assets of >\$5 billion−\$10 billion

Assets of >\$10 billion

Exhibit 4 - Global Crises Requires a Shift Toward Centralizing and Integrating Risk Management

Risk management changes that helped to succeed in crisis (top performers only)

Source: BCG analysis.

This team consolidates all relevant information and draws insights on risks, providing invaluable guidance to the outlying parts of the organization during periods of volatility. Various business units and subsidiary legal entities within the organization then implement the overarching strategy according to their specific needs, embedding it into their everyday operations.

The importance of a central strategic risk management team grows with the size of the company. The reactive approach is simply inadequate at times of crisis for more complex corporations.

The perceived importance of a central strategic risk management team grows with the size of the company, a finding that helps to explain why larger companies value mature risk management more highly. For smaller companies, ad hoc operative risk management may at times be sufficient to handle risks as they arise. But as companies become larger, their internal operations and international network of suppliers become more complex. The reactive approach is simply inadequate at times of acute crisis: in the absence of an overarching strategy that offers more comprehensive solutions and institutionalized processes, a company will be unable to cope with multiple concurrent challenges.

Of course, the ideal organizational setup also depends to a significant extent on the company’s business model, global footprint, and risks to which it is most susceptible. For example, companies in industries that depend heavily on certain regions, such as mining and commodities, might be advised to organize themselves very differently from, say, automotive companies, which are primarily preoccupied with a wholly different class of risk.

For both strategy formulation and operative implementation, leading companies recognize the importance of having up-to-the-minute data at their disposal, as well as the most appropriate data analytics capabilities and tools for evaluating it. The advanced use of data and analytics in risk management is an essential element within the overall digitization of the whole organization. Together with AI and generative AI, advanced analytics help to combat risk. For example, a company could collect all available data from different internal and external sources with respect to the risks under consideration and then analyze it in a structured way, with the aid of machine learning, to spot any suspicious patterns.

The BCG survey also revealed another key differentiator of top performers—the ability to identify threats. In companies more severely affected by the crisis, the task of identifying risks was left to senior executives. Moreover, the risks that were highlighted were more likely to be internal, such as labor shortages, low employee engagement, or substandard technology.

Top performers, on the other hand, had instituted processes and a culture throughout the entire organization, handing the initiative to all employees to raise the alarm about potential risks. Indeed, 35% of top performers emphasized the importance of internal sensing skills and culture in identifying risks early on—before they could start to inflict damage.

With the assistance of external experts, top performers also devoted more attention to potential risks emanating from outside the organization, such as supply chain issues, increasing regulation, geopolitical tensions, natural disasters, and pandemics.

Going Deeper: How to Reach Maturity in Risk Management

We have seen from our survey that mature risk management helps companies to get through crises relatively unscathed and have identified what top performers do differently. But what does high maturity in risk management mean in terms of an organization’s target operating model?

This section sets out what companies need to do to move from best intentions to best practice in risk management.

To begin with, it is essential to understand the risk types that companies are focusing on. Exhibit 5 shows that operational risk is by far the most covered. This confirms a shift in emphasis from financial to nonfinancial threats, a natural progression given the nature of the disruptions caused by the recent crises.

To simplify matters for the purposes of our survey, we divided the target operating model into three areas. We analyzed what leaders with mature risk management did differently from starters in the following areas:

Exhibit 5 - Risk Strategy: Top 5 Risks Are Covered by More Than 70%

Which risks types do you cover in your risk management setup?

Source: BCG analysis.

• Strategy and Governance. A comprehensive risk taxonomy and strategic risk management across all risk types.

• Process. Strategic and operative risk governance and organization.

• Basics. Data management and a culture of resilience.

Overall, we can see that a higher level of maturity has been reached in the strategy and governance aspects of the target operating model. However, attention to risk in process and basics is less mature, a shortcoming that needs to be resolved if companies are to exploit the full potential of risk management. (See Exhibit 6.) For example, without the solid platform of advanced data management and a developed culture of resilience, they cannot hope to manage risk in the most effective way possible.

Leaders and the Target Operating Model

Let’s delve more deeply into the two aspects of the target operating model detailed in the above graphic—strategic and operative risk governance and organization—and understand what separates the leaders from the starters, as well as what the latter can do to catch up.

Process. We asked respondents to rate the maturity level for both their strategic and operative risk management. We found that leaders reached a similar level of maturity in both the strategic and operative aspects. (See Exhibit 7.)

The close interaction between strategic and operative aspects holds the key to success, particularly when confronting complex risks.

Exhibit 6 - Long-Term Effectiveness Requires Strong Risk Management Bases

Source: BCG analysis.

What is also interesting is that more starters had reached a higher level of maturity in strategic than in operative risk management. It seems that starters may also have begun to follow the trend of appointing a central strategic team to oversee risk management. However, to reach the overall maturity necessary to combat crises effectively, operative risk management must be equally advanced. It is the close interaction between strategic and operative aspects that holds the key to success here, particularly when confronting complex risks.

Risk Management Review Cycle and Cooperation. We asked respondents to gauge the frequency of both their strategic and operative risk management review cycles. The results indicate that leaders have attained an entirely different stage of development. Everything is more institutionalized and automated.

Exhibit 8 shows the different approaches on both the strategic and operative side. Many starters still perform a monthly review of their strategic risk management, whereas leaders conduct reviews much less often, suggesting that they have already comprehensively embedded the strategy within everyday operative risk management, rendering frequent reviews unnecessary.

When looking at operative risk management cycles, results show that half of the leaders are continuously performing operative risk management reviews. This suggests that an automated, comprehensive, structured setup and established processes are already in place throughout the organization and simply require regular fine-tuning. Starters, on the other hand, are still lagging, with their risk management needing only sporadic reviews because the operation is much less developed. It is vital that starters implement processes that can sense and respond to emerging risks— such as those relating to AI and ESG—to make the organization more future-proof.

Exhibit 7 - Balanced Dualism as Success Factor: Both Strategic and Operative Risk Management Require Focus to Be Successful

What is the maturity level of your risk management instruments for your risk steering?

Source: BCG analysis.
1 E.g., no quantitative assessments.
2 E.g., Excel-based, manual assessments.
3 E.g., automated monitoring, advanced scenario analysis/simulations.

Exhibit 8 - Risk Management Cycle: Leaders Tend to Use a Continuous Risk Management Cycle, While Starters Use a Monthly or Yearly One

What is the frequency of your risk management cycle per steering type?

Source: BCG analysis.

The degree of internal cooperation is also differentiated between leaders and starters. With starters, there is less cooperation between the center and the outlying units. (See Exhibit 9.) In contrast, leaders use a more advanced cooperative and iterative approach. This finding demonstrates that an effective and efficient risk management framework has a strong central strategic foundation, but also relies on subsequent close operative collaboration. Especially with complex company structures and global processes, it is essential to bring central and local expertise together to extract the full potential of risk management.

Leaders value advanced analytics more highly, showing the importance of data-driven decision making to mature risk management.

People. Interestingly, leaders and starters rank the desired capabilities of risk managers in a different order. (See Exhibit 10.) Whereas starters strongly prioritize strategic thinking, leaders value advanced analytics more highly, showing the importance of data-driven decision making to mature risk management. The finding is in line with the conclusion relating to the risk management review cycle. Leaders are already well advanced when it comes to defining and implementing the strategic aspects of risk management, and those capabilities have therefore become less important.

What Are the Challenges Now Facing Top Performers and Starters?

Given their respective stages of development, leaders and starters perceive different risk management challenges. (See Exhibit 11.) Starters are still focusing on fixing the basics. Advocates within the organization are pushing senior management to recognize the importance of risk management and build a supportive culture. As risk management is not yet a priority, this is often a struggle—the function may even face a round of cost cutting in the prevailing tough economic environment. Such lack of investment, of course, threatens progress to mature risk management, hindering organizational resilience in future crises.

Leaders’ main challenges stem from their success. For one thing, as risk management reaches maturity, there is inevitably more interaction between the center and an expanding network of operative units. Companies must also adapt to the ensuing complexity, maintaining focus on the current areas of concern and remaining sufficiently agile to reassign priorities where necessary.

In contrast to starters that are still bogged down in internal

Exhibit 9 - Cooperation Is Key for Effectiveness

Source: BCG analysis.

Exhibit 10 - Organization: According to Respondents, Handling Risks Demands Strategic Thinking, Advanced Analytical as Well as Management and Leadership Skills

What are the top three skills/capabilities that risk managers will need in future?

Source: BCG analysis.

matters, leaders also scan the external environment for emerging risks. For example, only 14% of starters cited rising regulatory scrutiny as a major challenge, compared with 44% of leaders. Starters’ lack of attention to other rapidly intensifying new risks, such as those relating to ESG and AI, could have material consequences as well.

Outlook: Preparing for the Next Crisis

We asked companies to describe how they are planning to change their risk management setup. Their answers again reflect the different stages of development for leaders and starters. (See Exhibit 12.)

Starters are still looking to embed risk management into the strategy and planning process, build a strong risk management relationship between the corporate center and the rest of the organization, and build the sensing skills and culture that enable risks to be identified early— before they start to inflict damage.

The strategic platform has already been set by the center, and the risk management responsibilities that are now being more widely dispersed need to be appropriately assigned.

Leaders, meanwhile, have moved on to the vital task of quantifying nonfinancial risks, which relies heavily on the availability, quality, and usability of data. Some also plan to reorganize risk management internally to derive the maximum benefit from their greater maturity. The strategic platform has already been set by the center, and the risk management responsibilities that are now being more widely dispersed need to be appropriately assigned.

Complex international organizations will need constant local feedback from outlying units on the diverse and rapidly developing regulatory requirements in the many countries and regions in which they do business. A strong risk culture thereby enables proactive, rather than reactive, risk management.

What are currently the biggest challenges for risk managers? Starter

Exhibit 11 - Challenges Differ According to Maturity: Risk Managers Need to Handle a Diverse Set of Risks, with Different Challenges for Leaders and Starters

Source: BCG analysis.

Exhibit 12 - Outlook: Starters Plan to Change Risk Management Setup, Especially to Embed Risk Management into Strategic Planning and Strengthen Risk Oversight

How are you planning to change your risk management setup?

Starter

Source: BCG analysis.

ur survey findings demonstrate the vital role that risk management has played in helping organizations through recent crises. Moreover, we see that its value in such adverse times increases with its level of maturity.

The evidence in our survey suggests that starters sense what needs to be done to emulate the success of leaders. To reach this goal, companies should concentrate their attention on the following three actions:

• Make risk management a cornerstone in all key processes within the entire organization to ensure resilience

• Combine a strong strategic risk management center with efficient and effective distributed operative risk management to secure a holistic understanding and appropriate mitigation of risks through a robust and consistent process.

• Enhance data analytics by focusing on the quantification of nonfinancial risks and using tools such as AI to make full use of available data.

By following these best practices from risk management leaders, more companies can make themselves futureproof. They can then focus their energies on innovation and profitable growth in the full knowledge that they have built the resilience necessary to resist whatever the next crisis throws at them.

About the Authors

Julia Gebhardt is a Managing Director and Partner in the Munich office of Boston Consulting Group. You may contact her by email at Gebhardt.Julia@bcg.com.

Juliane Butters is a Project Leader in the Cologne office of Boston Consulting Group. You may contact her by email at LeisButters.Juliane@bcg.com.

Matteo Coppola is a Managing Director and Senior Partner in the Milan office of Boston Consulting Group. You may contact him by email at Coppola.Matteo@bcg.com.

Thomas Pfuhler is a Managing Director and Partner in the Munich office of Boston Consulting Group. You may contact him by email at Pfuhler.Thomas@bcg.com.

Abhinav Bansal is a Managing Director and Partner in the Mumbai office of Boston Consulting Group. You may contact him by email at Bansal.Abhinav@bcg.com.

For Further Contact

If you would like to discuss this report, please contact the authors.

Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we work closely with clients to embrace a transformational approach aimed at benefiting all stakeholders—empowering organizations to grow, build sustainable competitive advantage, and drive positive societal impact.

For information or permission to reprint, please contact BCG at permissions@bcg.com. To find the latest BCG content and register to receive e-alerts on this topic or others, please visit bcg.com. Follow Boston Consulting Group on Facebook and X (formerly known as Twitter).

Katharina Hefter is a Managing Director and Partner in the Berlin office of Boston Consulting Group. You may contact her by email at Hefter.Katharina@bcg.com.

Eva Kalteier is a Project Leader in the Munich office of Boston Consulting Group. You may contact her by email at Kalteier.Eva@bcg.com.

Bernhard Gehra is a Managing Director and Senior Partner in the Munich office of Boston Consulting Group. You may contact him by email at Gehra.Bernhard@bcg.com.

Jeanne Kwong Bickford is a Managing Director and Senior Partner in the New York City office of Boston Consulting Group. You may contact her by email at Bickford.Jeanne@bcg.com.

Pierre Roussel is a Managing Director and Partner in the Paris office of Boston Consulting Group. You may contact him by email at Roussel.Pierre@bcg.com.

Our diverse, global teams bring deep industry and functional expertise and a range of perspectives that question the status quo and spark change. BCG delivers solutions through leading-edge management consulting, technology and design, and corporate and digital ventures. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, fueled by the goal of helping our clients thrive and enabling them to make the world a better place.

群内每日免费分享5份+最新资料

300T网盘资源+40万份行业报告

为您的创业、职场、商业、投资、亲子、网赚、艺术、健身、心理、个人成长 …… 全面赋能！

关注公众号获取更多资料

添加微信，备
注“入群”
立刻免费领取
200套知识地图+最新研报

致终身学习者社群

行业报告/思维导图/电子书/资讯情报

BCG+2023年全球ESG、合规和风险报告-英-16页-WN11