The Risk Gap

Why risk management still falls short.

Despite significant investments in improving their risk management capabilities in the three years since the financial crisis began, most executives still rate their companies as "ineffective" or only "moderately effective" at incorporating emerging risks into their decision making.

That general lack of progress in improving risk management practices is among the findings in the second Oliver Wyman/Financial Times survey of 650 senior executives at large companies around the world. The survey offers a snapshot of what executives consider to be the biggest risks to their businesses and evaluates their methods to identify and assess potential threats.

The results clearly show that even with their renewed focus on managing risk, most companies still fail to integrate information about emerging risks into their decision making. Emerging risks are defined as both new risks, such as the 2010 eruption of volcanic ash in Iceland, and familiar risks in unfamiliar conditions, as when volatile commodity prices suddenly become some of the largest costs for businesses such as airlines and consumer products manufacturers.

Why do executives experience such a serious disconnect between their approaches to assessing risks and effectively using the information to make better decisions? The survey indicates that many organizations continue to rely on basic, "static" risk analytics and tools rather than multidimensional approaches that take advantage of a wide range of outside data. Many key decision makers, like boards of directors, also receive emerging risk information only infrequently.

Most executives consider global recession as the greatest risk to their businesses in the next 18 to 36 months. But immediate and pressing financial events have pushed risks not directly related to their business, such as climate change or pandemics, off most executives' radar screens. Only a small minority of executives surveyed consider potential threats related to environmental issues, societal risks, or technological concerns as major risks.

These results are troubling in a business environment increasingly defined by global recession, major policy government shifts, volatile commodity prices, and unstable financial markets. This report makes recommendations for how risk management programs should address not only traditional risks but also new risks that threaten to change the rules of the game.

The Risk Gap