SAN DIEGO—Forecasting risk is not expected to get easier in the next three years, with cyberattacks and regulation topping the list of emerging risks, according to a new report published jointly by Marsh and RIMS.

The 13th annual Excellence in Risk Management report found that while risk professionals are increasingly relied upon to identify and assess emerging risks, there are still organizational and other barriers to identifying those risks. In fact, nearly half of survey respondents—48%—predicted that forecasting critical business risks will be more difficult three years from now, while just over one-quarter said it would be the same.

“Whether emerging risks are on your doorstep, around the corner, or on the far horizon, they have the potential to catch organizations unaware,” said Brian Elowe, Marsh’s U.S. client executive leader and co-author of the report. “It’s important for risk professionals to maintain awareness of global risk trends, and to make the connection to their organizations’ business strategy.”

Where do risk professionals turn when trying to understand the impacts of emerging risks on their organization? According to the report:
One of the goals of this year’s Excellence survey’s goal was to better understand how organizations view the emerging risks facing them, what tools they use and the barriers they face in assessing, modeling, and understanding the risks. According to the findings, a majority of respondents—61%—cited cyber-attacks as the likely source of their organization’s next critical risk. This was followed by regulation, cited by 58% of the respondents, and talent availability, cited by 40% of the respondents.

Based on survey responses and insights from numerous focus group discussions, it became clear that risk professionals generally agree on the importance of identifying emerging risks, and also that there is no clearly established framework for doing so. More can be done to better identify, assess, and manage the impact emerging risks may have on organizations.

For example, a majority—60%—of the risk management respondents said they use claims-based reviews as one of the primary means to assess emerging risks, compared to 38% who said they use predictive analytics.

“The widespread use of claims-based reviews means that a majority of organizations are relying on studying past incidents to predict how emerging risks will behave rather than using predictive analytic techniques like stochastic modeling and game theory to help inform their decision making,” Elowe said.

Survey respondents also cited several barriers to understanding the impact of emerging risks on their business strategy.

Decisions with lack of cross-organization collaboration ranked first among risk professional respondents.

“Lack of collaboration across the organization is still an issue for many risk professionals. On the other hand, breaking down silos has become less of a concern for executives,” said Carol Fox, vice president of strategic initiatives for RIMS and co-author of the report. “Tackling emerging risks often requires creative yet pragmatic approaches. It has to encompass internal cross-functional conversations — formal and informal — around the intersection of risk and strategy, senior-leadership engagement, and tapping into external information sources. Risk professionals are encouraged to broaden the scope and collaboration around emerging risk issues within their organizations.”

According to the report:

As the risk environment becomes increasingly complex and more entwined with financial decisions, risk strategy is increasingly a boardroom issue. As we have seen in past Excellence surveys, senior leaders’ expectations of the risk management department have increased in everything from leading enterprise risk management to providing better risk quantification and analysis.

However, while more is being asked of risk professionals, investment is not necessarily keeping pace. For example, the percentage that say they expect to hire more staff dropped to 25% this year from 37% when we asked in 2015. “We’ve all experienced this elevation of risk management at our institutions, but…as we are battling for budget, it becomes pretty easy for risk management to get pushed over to the side,” said the assistant vice president of risk management at a major university.

The survey is based on more than 700 responses to an online survey and a series of focus groups with risk executives in January and February 2016.