What worries boards and management most in 2018

The risks boards and senior executives are most worried about in 2018 are related to staying competitive in the face of rapid changes in the global marketplace, a global survey of 728 directors and executives suggests.

That is a shift from 2017, when respondents were most concerned about increasing regulatory scrutiny and adverse economic conditions in markets in which their companies do business. These two concerns dropped to fourth and eighth in 2018.

The surveys were conducted in North America, Asia Pacific, Europe, and Africa by the North Carolina State University Enterprise Risk Management Initiative and global consulting firm Protiviti. Respondents were asked to rank 30 strategic, operational, and macroeconomic risk issues.

Overall, respondents expect the global business environment to be significantly risky in 2018 but slightly less so than in 2017. Risk perceptions varied by region, industry, and positions within a company.

“Going into 2018, board members and senior executives are not worried so much about economic issues but about operational and strategic issues,” said Mark Beasley, CPA, the ERM Initiative’s director.

The survey doesn’t answer why the shift is happening, Beasley said, but “we’re seeing a really strong stock market and we seem to be moving further and further away from the [financial] crisis. Also, the current U.S. [presidential] administration is de-emphasising regulatory scrutiny.”

Top risks

The quick pace of technological innovation and how that changes business models has board members and senior executives most worried in 2018.

Three of the top five risks are related to concerns about staying competitive in the face of rapid changes in the global marketplace. Sixty-seven per cent of the survey respondents considered the rapid speed of disruptive innovation a risk with significant impact. And 61% worried that their company’s culture may resist adjustments to the business model and operations necessary to respond to the rapid changes, or may not encourage timely escalation of risk issues.

One example driving these concerns is the emergence of driverless vehicles, Beasley said. Also, many board members and senior executives were caught off guard by online distribution giant Amazon’s plan to purchase brick-and-mortar grocery chain Whole Foods. The deal promises to change the way consumers shop for food, but many businesses didn’t see it coming, he said.

Among the 30 given risks, board members and senior executives ranked these as the ten with the most significant potential impact in 2018:

1. Rapid speed of disruptive innovation.
2. Resistance to change.
3. Managing cyber threats.
4. Regulatory change and heightened regulatory scrutiny.
5. Corporate culture may not encourage timely escalation of risk issues.
6. Succession challenges and talent retention.
7. Privacy management and data security.
8. Adverse economic conditions in markets in which the company does business.
9. Productivity and efficiency increases with the help of big data.
10. Digital, low-cost competition.

Different risk views within a business

The survey also picked up on differing views about the magnitude and severity of risks amongst directors, CEOs, CFOs, and chief risk officers.

Board members perceived the risk environment for 2018 as the most dire. Chief risk officers appeared to be the most optimistic for 2018.

“Neither one probably has it right,” Beasley said. “What that tells me, management and board members need to be talking.”

To assess whether companies’ risk management is ready for rapid changes, the survey authors recommend executive committees or risk management committees consider these seven diagnostic questions and talk about the answers with their boards:

• Is the risk assessment process frequent enough? Does it involve all appropriate organisational stakeholders?
• Is the business environment monitored over time for evidence of changes that may invalidate one or more critical assumptions underlying the company’s strategy?
• Are risks evaluated in the context of the company’s strategy and operations?
• Is the process supported by an effective methodology and relevant risk criteria? Does the process consider extreme as well as plausible scenarios and does it consider a sufficient time horizon to pick up strategic risks?
• Does the process encourage an open, positive dialogue for identifying and evaluating opportunities and risks? Does it give adequate attention to differences in viewpoints that may exist across different global jurisdictions?
• Does the process delineate the critical enterprise risks from the day-to-day risks of managing the business?
• Is the board informed of the results on a timely basis? Do directors agree with management’s determination of the significant risks?

—Sabine Vollmer (Sabine.Vollmer@aicpa-cima.com) is a CGMA Magazine senior editor.