Risk in Review: key findings and themes

2019 Risk in Review Study

Although cybersecurity is rated as the most important risk associated with digital initiatives, there’s room for improvement in terms of integrating assurance functions in digital risks and having the skill levels to successfully manage such risks. The lack of process integration of assurance functions on digital initiatives compared with the level of involvement on external reporting of data breaches suggests that they are being brought in too late in the process to help manage cyber/digital risks:

Cybersecurity risk: 51% of respondents rate cybersecurity as the number one risk associated with digital initiatives.
Cybersecurity reporting: Just over half (55%) described their risk, IA or compliance function as integrated to fully integrated into ‘the exchange of information – such as data involving data incidents – with external sources such as industry associations’.
Digital risk integration: Less than half of the risk, IA or compliance function were ‘always involved’ in the management of risks stemming from digital initiatives: risk 37%, IA 28% and compliance 36%.
Digital skills: Only 33% described their risk, IA or compliance function as having team members with ‘digital or data analytics skills’ integrated to fully integrated into the workforce.

Digital initiatives have enabled better risk prediction and management. There are further opportunities for influencing senior executives and boards in relation to providing the right risk levels around digital initiatives.
Better risk prediction: 54% of global respondents agreed or strongly agreed that digitalisation has provided them with better risk prediction. The same proportion ranked this as the top benefit from the risk, IA or compliance function being involved in digital initiatives.
Risk management and digital initiatives: 54% of respondents were ‘actively balancing risk management and risk appetite’ around the implementation of digital initiatives. 49% agreed or strongly agreed that they were working with “senior executives and boards” to make such adjustments.