Irish organisations are more cautious than their global peers where risk is concerned, according to the latest PwC global risk survey. Forty-eight per cent of Irish respondents said their organisation proactively took risks to create opportunities, compared with 57 per cent globally.
“This is quite a significant difference,” says Andy Banks, partner and governance and risk leader with PwC Ireland. “If organisations don’t take risk, they don’t progress. Taking risk intelligently is the one of the ways organisations can transform to survive while creating value and building resilience in the face of a complex, ever-changing business environment.”
More than 3,900 business and risk leaders around the world, including in Ireland, participated in the PwC global risk survey. Unsurprisingly, cyber and macroeconomic volatility were identified as top risks by Irish organisations. One third of Irish business and risk leaders believe their organisations are highly or extremely exposed to both risks. Next on the list was inflationary risk (30 per cent) followed by digital and technology risks such as AI, identified by 25 per cent of respondents.
Interestingly, with generative artificial intelligence (GenAI) expected to transform business in the coming years, only 28 per cent of Irish respondents see the technology as an opportunity, compared with 60 per cent of global respondents.
Change in mindset needed
Banks notes that the more cautious approach in evidence on the part of Irish organisations is in part explained by the higher proportion of unregulated businesses in sectors such as retail included in the global survey. However, a change in mindset in relation to risk is still required, he believes.
“There is an opportunity cost to a more cautious approach,” he says. “If you look at the evolution of risk management over time it has progressed from a focus on risk mitigation and avoidance to a focus on business strategy and supporting the identification and enablement of business opportunities.”
It’s about taking calculated risks. “C-suites and boards need to understand the risk environment and the strategic trade-offs that have to be made when making decisions. That means fully understanding the risk-reward equation, which requires alignment between the board and senior management and risk professionals to ensure everyone understands and is aware of the risks involved when making strategic decisions. There needs to be a harmonisation of thinking in relation to risk across the organisation. This will help businesses operate more effectively within their defined risk appetite.”
According to PwC director of governance, risk and compliance Shane Walker, certain organisations are leading the way in terms of using risk for opportunity generation. “There is a certain cohort of risk pioneers that are trailblazing in this area,” he says. “They are embracing the concept of using risk for value generation and opportunity creation. These businesses are looking at it from an outcomes perspective. They see GenAI as a key opportunity rather than a risk, for example. In fact, these risk pioneers tend to use technology to identify future risks and are proactively looking around corners to see what might lie ahead. They are also more likely to focus on building resilience rather than putting in place strategies to avoid certain risks or minimise exposure to them. They are aligning the risk and resilience agendas to minimise disruption to the organisation.”
The survey results in relation to resilience building were somewhat mixed for Irish organisations. On the positive side, some investment in resilience initiatives has taken place in the last 12 months. Ireland is ahead of the curve in several areas: 77 per cent versus 63 per cent global in digital communications; 65 per cent versus 55 per cent global in implementing recovery technology solutions; and 67 per cent versus a global 60 per cent in upgrading critical systems.
More to do on building resilience
On the other hand, just 38 per cent of Irish respondents said they had a business-wide technology strategy, including investing in technology specifically to drive resilience and risk management. Less than a quarter, 23 per cent, strongly agree that their organisation actively builds resilience across their business. Globally it is 30 per cent. Only 28 per cent are planning to expand their network of key suppliers in the year ahead as part of their business continuity plans while just 35 per cent are planning to establish a resilience team with members from functions like business continuity, cyber, crisis management and risk management.
The results in terms of technology use are equally concerning. Just over one sixth, 17 per cent, of Irish respondents are currently using advanced analytics or predictive modelling to a very large extent to identify and evaluate potential risks; only 18 per cent are implementing real-time monitoring systems to a very large extent for timely risk identification; and just one in 10 is using AI and machine learning to a very large extent for automated risk assessment and response.
Less than one in three, 30 per cent, are planning to invest in analytics and business intelligence tools to navigate risk over the next one to three years versus 47 per cent globally; and just 35 per cent plan to invest in AI, machine learning and automation technologies. This is behind the global curve, which stands at 49 per cent.
Leveraging the technology investment properly
“One of the key findings both globally and in Ireland is that better-performing organisations are using technology to deliver insights to support strategic decisions,” says Banks. “They are using AI to automate and drive efficiencies and data analytics to support more accurate predictions and decisions. Organisations everywhere need to up their game in this respect. There is no shortage of appetite to invest in technology. However, leveraging this investment effectively is an area where many have struggled.”
Walker points to some of structural challenges faced by businesses when it comes to leveraging technology investment. “Eighty-five per cent of respondents highlighted that they have yet to fully integrate their investments in technology and data for risk management,” he notes. “But this is a very complex undertaking. The majority of large organisations have evolved over a long period of time in terms of processes and systems. Some can be siloed with a number of legacy systems in place. This can present data quality and other challenges. It’s not a case that investment in technology will resolve all of the problems. It’s very much a journey of discovery.”
Skills issue
The human side of the equation is also critically important, and the survey revealed a potential skills deficit. Just 17 per cent of Irish respondents strongly agreed that their organisation provides employees with the right skills to better enable them to solve complex problems and only 25 per cent strongly agreed that upskilling internal teams to be better prepared for potential risks is a priority.
“Technological change is happening at a faster pace than ever,” says Banks. “If organisations are not staying abreast of that they are definitely missing out on opportunities. And they need to take control and manage risks. They also need to continue to invest in the risk function both in terms of people and technology. Risk professionals traditionally came from an accountancy background and were focused on risk minimisation and avoidance. In future, organisations will require more multidisciplinary skill sets which marry traditional accountancy skills with wider business expertise and capabilities in areas like IT, AI and data analytics. Risk professionals will need to be able to interpret data and translate the results to explain what they mean for the business and what actions need to be taken to mitigate risks, build resilience and exploit opportunities.”
Change means taking risks, and organisations need to invest
Looking to the longer-term future, Walker notes that the 2023 PwC CEO survey found that one in five Irish business leaders are of the view that their organisation will no longer be viable a decade from now if it remains on the current path. “They understand that their organisations need to change if they are to remain relevant and stay in business,” he says. “Change means taking risks, and organisations need to get comfortable with that and invest in the people and technology required to manage those risks to both protect and create value for their businesses.”