If we don’t take risk, we don’t progress. Taking risk intelligently is the only way organisations can reinvent and transform to survive, create value and prosper in this time of uncertainty, while building resilience to protect value in the face of complex, ever-changing risk.
PwC’s Global Risk Survey 2023 reveals how leading organisations are changing the way they see risk by embracing the transformative power of technology and data in pursuit of opportunity and value creation.
The research—which surveyed 3,910 business and risk leaders, from the boardroom and C-suite, across tech, operations and finance, as well as risk and audit—also highlights how technology is playing an increasingly important role in helping organisations protect value by mitigating and managing downside risk more effectively.
The transition to new energy sources is seen as the biggest opportunity among external disruptors, cited by 54% of respondents (For Türkiye 64%), closely followed by changes in customer demand and preference (47%) (For Türkiye 35%). By contrast, supply chain disruption is the main external factor seen as more of a risk than opportunity, cited by 42% of respondents. For Türkiye, this rate remains low (29%) compared to global data.
The transition to new energy sources is seen as the biggest opportunity among external disruptors, cited by 54% of respondents, closely followed by changes in customer demand and preference (47%). By contrast, supply chain disruption is the main external factor seen as more of a risk than opportunity, cited by 42% of respondents.
Industry sector also has an impact on whether organisations sit at the value protection or value creation end of the risk appetite scale. Those in faster moving sectors, such as retail and tech, are more likely to embrace risk and seek opportunity, while those in regulatory driven sectors such as government and pharmaceuticals are more likely to prioritise compliance and focus on risk avoidance. Different functions within the organisation also have different perspectives on risk, with finance roles more likely than others to say their organisation is focused on risk avoidance over a high risk appetite.
Q. For each of the statements below, please indicate on the sliding scale which best describes your organisation. Q. To what extent do you currently see the following technology disruptors as a risk versus an opportunity for your organisation? Q. Which, if any, of the following situations / occasions trigger a review of your organisation's risk landscape? Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Crucially, our survey reveals a top performing 5% of organisations spread across all industry sectors—identified in the research as Risk Pioneers—who are forging ahead in the pursuit of opportunity. Underpinned by strategic enterprise-wide resilience and guided by a human-led, tech-powered approach, these pioneers are significantly more likely than other organisations to be upskilling internal teams and making greater use of advanced analytics, predictive modelling, cybersecurity tools and cloud to navigate risk. And they are more likely to see emerging technologies such as GenAI as an opportunity rather than a risk.
As a result, this leading group is better aligning the navigation of risk with business strategy to achieve a greater range of outcomes and value—from more robust regulatory compliance and streamlined reporting to enhanced customer trust and identifying new commercial opportunities.
Our survey highlights five compelling findings for leaders. Each is explored further in this report, focusing on why they matter to organisations and their stakeholders, the value they create, and practical ways to use technology and data in new ways to navigate risk.
Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience.
We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach—revealing four illustrative risk archetypes and a top-performing group of Risk Pioneers.
Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.
Five key actions for organisations to ensure they are resilient and equipped to survive, create value and prosper amid uncertainty and complex, ever-changing risk.
The journey to taking risk more intelligently—powered by technology and through the lens of reinvention, opportunity and growth—requires leaders to start with these four key questions
Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience.
Only inflation ranks higher than cyber (the top tech-related threat) in terms of the risks respondents feel most exposed to, while other digital and tech risks are almost on a par with macroeconomic volatility. A third of CEO respondents in our survey say they feel highly or extremely exposed to cyber risk, and those leaders primarily responsible for managing risk ranked cyber risk above inflation. However, these risks are not putting organisations off investing in technology with around half planning to invest in cybersecurity tools and AI, machine learning and automation technologies. Nearly half of participants from Türkiye have the same perspective. Looking at the responses from Turkey, inflation (68%) and macroeconomic volatility (61%) risks are by far ahead of cyber risks (19%) & digital and tech risks (13%).
But our survey shows such tech-related risks, from cyber attack to costly—and potentially brand damaging—mistakes in deploying technology are not putting organisations off investing in technology. The appetite for innovation and new technology is encouraging organisations onto the front foot. They are proactively assessing and mitigating these risks to transform and to manage their costs, support growth and ultimately build their resilience.
Preparing for technology investments, from cloud to emerging technologies such as GenAI, is the single biggest motivating factor for an organisation to review its risk landscape—cited by 57% of respondents overall (For Türkiye 32%), and 62% of respondents from large organisations with revenues of USD$5bn or more. That is higher than organisations being triggered into a review by a risk event (50%) or entering new markets (46%), marking a step-change in where and why risks are assessed. According to the responses given by participants from Türkiye, organizational strategy development, a risk event and periodic reviews are seen as more prominent motivating factors, contrary to global results.
Technology disruptors are also much more likely to be seen as opportunities than risks compared to other external non-tech disruptors. For example, 60% of respondents (For Türkiye 55%) see GenAI as an opportunity compared to just 35% (For Türkiye 10%) who see changes in regulation as an opportunity and 28% (For Türkiye 14%) who see supply chain disruption as an opportunity. Given their position at the forefront of exploring and implementing emerging tech across their organisations, the results also show respondents in operations and tech roles are more likely than all the other job roles and functions to see GenAI as an opportunity over risk. According to the responses from Türkiye, the external non-tech disruptor that is most seen as an opportunity rather than a risk is the transition to new energy sources.
This enthusiasm for GenAI echoes separate PwC research, the Global Digital Trust Insights Survey, which found 77% of respondents stating that GenAI will help their organisation develop new lines of business over the next three years, while our Global Workforce Hopes and Fears Survey of more than 50,000 workers reveals employees see more positive than negative impacts from AI on their roles, despite headlines about AI-fueled job losses.
We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach. This reveals four illustrative risk archetypes. And when we then looked at those organisations achieving the greatest range of outcomes, we identified a small distinct group of top-performing Risk Pioneers leading the way.
Click each archetype below to learn more.
5%This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful value creation outcomes than others.
Close this quadrant Back to Risk Archetypes28%Spread across most industries and culturally predisposed to the pursuit of value creation over value protection but rely primarily on their human insights and culture of innovation to achieve it. More than three-quarters (77%) have a high appetite for risk and 88% seek to uncover opportunity in risk over regulatory adherence. They are more likely to have a proactive approach to taking risk and building resilience. However, they are also more likely to be using basic technology and data tools for managing risk, which lack comprehensive integration. And their enterprise tech strategy is less likely to include investment in tech specifically to build resilience and manage risk.
Read more Close this quadrant Back to Risk Archetypes20%Focused more on value creation than value protection, are more advanced in the use of technology to achieve it, and are more likely to have fully integrated their use of technology and data in risk management and be using advanced and predictive risk management capabilities to identify and evaluate potential risks. This archetype is spread across most industries, apart from a significantly lower representation of organisations from government and public services. More than three-quarters have a high appetite for risk and 89% seek to uncover opportunity in risk over regulatory adherence. They have a proactive approach to building resilience to unexpected disruptive events.
Read more Close this quadrant Back to Risk Archetypes27%Culturally focused more on value protection and less advanced in their strategic use of technology. Government and public services organisations are more likely to be present in this archetype. Three quarters (76%) focus on risk avoidance over opportunity and 71% prioritise regulatory adherence when managing risk. This archetype is more likely to be using basic technology and data tools for navigating risk, lacking comprehensive integration. And they are less likely to be using tools such as advanced analytics or predictive modelling, real-time monitoring, data visualisation and cloud to identify and evaluate potential risks.
Read more Close this quadrant Back to Risk Archetypes20%Advanced in their use of technology and are more likely to have fully integrated their use of technology and data in risk management with regular updates and improvements—they are using it primarily for value protection rather than a strategic pursuit of value creation. Spread across all industries, almost two-thirds prioritise regulatory adherence over opportunity when managing risk and they are more likely to have low risk strategies.
Read more Close this quadrant Back to Risk ArchetypesIt should not be assumed the more reactive and protection focused nature of some of the archetypes within this quadrant signals a lack of ambition or intent to shift towards value creation. In turbulent economic conditions and disruptions that have affected some industries more than others, those organisations may be constrained in their ability to invest in the talent and technology needed, or may feel exposed to risks so significantly that value protection is seen as the best and only outcome currently.
Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.
As the chart below shows, Risk Pioneers are consistently outperforming other organisations through their approach to risk, particularly in value creation outcomes such as identifying new commercial opportunities and improving financial performance.
| Status | Risk pioneers | All |
|---|---|---|
| Enhanced customer trust and confidence | 89% | 40% |
| Identification of new commercial opportunities | 84% | 32% |
| Improved financial performance due to effective risk mitigation | 84% | 32% |
| More robust compliance with regulatory standards | 81% | 40% |
| Better alignment of risk management with business strategy | 80% | 31% |
| Increased accuracy in risk forecasting | 79% | 29% |
| Building competitive advantage | 79% | 31% |
| Expansion into new markets | 78% | 28% |
| Enhanced response time to emerging risks | 77% | 28% |
| Streamlined risk reporting and communication | 76% | 32% |
| Greater integration of risk management across business functions | 76% | 30% |
| Improved identification and tracking of potential risks | 75% | 31% |
| Improved resilience to external shocks or crises | 75% | 28% |
Our survey shows a fairly even spread of Risk Pioneers across most industries. They are particularly prevalent in financial services, retail and consumer, technology, media and telecoms, and from organisations with revenue of USD$5bn or more. Respondents are more likely than the survey average to be CEOs and the board (34%) and their organisation is more likely to have seen revenue increase in the past six to nine months and be expecting it to increase again in the next 12 months. Almost three-quarters (73%) of Risk Pioneers also have an enterprise-wide technology strategy and roadmap, which includes investment in technology specifically to drive resilience and/or manage risk—compared to 53% of overall survey respondents.
1.8x more likely to say they are very confident of balancing growth with managing risk
1.8x more likely to see GenAI as fully an opportunity than risk
1.6x more likely to proactively take risk to create opportunities versus prioritising safe or low risk strategies
1.4x more likely to prioritise building resilience to unexpected disruptive events versus prioritising stability and continuity when trigger events occur
More likely to view their own risk appetite (30%), their CEO’s (31%) and their board’s (26%) as eager/hungry, indicating closer leadership alignment on taking risk
2.7x more likely to be using advanced and predictive risk management capabilities together with cutting-edge technology and data to navigate risk
Less likely to say legacy technologies have impacted their organisation’s ability to manage and respond to risk.
2.6x more likely to have improved financial performance due to effective risk mitigation
2x more likely to have achieved more robust compliance with regulatory standards
These leading Risk Pioneer behaviours and outcomes reveal a clear gap that organisations need to address if they want to make more effective use of tech and create opportunity and value out of risk. Around two-fifths of all organisations have improved their approach to managing risk to enhance customer trust and improve compliance with regulation. But fewer than a third of organisations have achieved successful outcomes across other key areas, highlighting the opportunity to achieve better outcomes from their risk strategy and to provide strategic value.
There is clear ambition among most organisations to take a more tech-powered approach to risk, seen by their intention to invest in AI, machine learning, automation, cybersecurity and cloud. But many respondents are still at relatively early stages of maturity in their use of technology and data for managing risk. Just one in ten organisations are already using advanced and predictive analytics, cutting-edge tech and data for managing risk and are continuously refining and innovating.
Q. Which of the following statements best describes your organisation’s approach to using technology and data for risk management?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Risk pioneers, organisations with USD$5bn+ revenue and technology companies are more likely to be at the advanced stage of implementation, while respondents in the government and public services sector are more likely to be just starting to use technology and data to manage risk. Those organisations more advanced in implementation are using on average a greater number of technologies to navigate risk—4.6 versus 2.5 overall.
Existing legacy technology investments—often becoming more complex through years of mergers, acquisitions, restructuring and consolidation—are also impacting the ability of organisations to manage and navigate risk.
Q. In what ways, if any, have legacy technologies impacted your organisation’s ability to manage and respond to risk?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
There also appear to be differences between those in tech and operations and those in risk and audit when it comes to the perception of how mature their organisation’s use of tech and data to navigate risk is. For example, 68% of tech respondents and 63% of operations respondents say their organisation is using advanced analytics or predictive modelling to identify and evaluate potential risks to a large or very large extent. But this compares with just 49% of risk executives and 15% of audit respondents who agree with that statement.
Despite these challenges, as the Risk Pioneers are demonstrating, the opportunity for early advantage is still available to those bold enough to move quickly, and embrace emerging technology at speed.
An approach to risk led by a clear and authentic purpose can help organisations be more resilient and guide which risks to embrace or avoid. It ensures the whole organisation understands the direction and ambition for the future, and helps build trust with stakeholders—from employees and customers to investors and regulators.
Purpose provides a vital strategic lens on whether a risk is more threat or opportunity, particularly around issues such as climate change, sustainability, ethical supply chains and the responsible use of emerging tech, such as GenAI. Yet only around a third (32%) of respondents (For Türkiye 19%) say they strongly agree that their organisation uses purpose and vision for the future to make decisions about risk.
Working with your employees and wider stakeholders, such as investors, regulators and non-executive directors, to set a clear and authentic purpose builds the right risk mindset, which then feeds into the risk frameworks and metrics that will help build resilience and deliver sustainable outcomes.
Most organisations (91%) are confident they can balance growth ambitions with managing risk effectively (For Türkiye %84) , 40% of executives are very confident their organisation can balance growth with managing risk effectively (For Türkiye %32), and a further 51% are somewhat confident (For Türkiye %52). While only 1% of the participants globally answered "not very confident", it is noteworthy that this rate is 16% in Turkey.
There are differences when we analyse responses across different job roles and functions. For example, half of CEO and board respondents are very confident of balancing growth and risk compared to just 34% of operations leaders and 30% of audit leaders. And only just over a fifth of risk executives say their own risk appetite matches that of their CEO and board. This result is valid for Türkiye, CEO and board respondents are more confident (%91) compared to operations, finance and audit leaders.
However, there is misalignment between economic buyer groups, with 50% of CEO/Board ‘very confident’ compared to 34% of Operations and 30% of Audit leaders. Furthermore, only 22% of executives stated that their own risk appetite matched exactly with that of their CEO and Board. Looking at Turkey's data, it is concluded that there is a significant difference between the Board and CEO levels in terms of risk appetite (willingness to take risks), and that the risk appetite of CEOs is significantly higher.
There is also misalignment on the perception of the strategic value the risk function provides, with CEOs less likely than risk executive survey respondents to agree the risk function is demonstrating behaviours such as bringing risk insights to the board for better oversight, guiding the business through complex change and challenging senior management.
For example, 60% of risk executives say they are already demonstrating providing insights on new and emerging risks to senior management versus 54% of respondents from the wider business—CEOs, the board, operations, tech and finance.
This disconnect is also evident in PwC’s Global Internal Audit Study 2023, with business leaders stating they want more early and proactive strategic engagement with Internal Audit. Despite that expectation, only around a fifth of executives ranked strategic thinking and the ability to challenge constructively as key strengths of Internal Audit. And almost half (49%) said Internal Audit does not have strong alignment with other lines on key risks and challenges.
We see far greater alignment between the CEO/board and risk among the top performing Risk Pioneers. Almost a third (32%) of Risk Pioneers stated that their own risk appetite matched exactly that of their CEO and board, compared to just 22% of overall respondents.
This leadership disconnect needs to be resolved if risk management is to amount to more than value protection and a reactive response to threats. Fostering greater collaboration between the risk function, leadership and the wider business and having more strategic conversations earlier in the process are key if organisations are to find opportunities where competitors may still see risk.
There is a link between resilience investments and achieving risk management outcomes, with better performing organisations more likely to have invested across more resilience initiatives in the last 12 months.
Although around half of organisations have invested in specific resilience initiatives, these remain in isolated pockets with just 7% have invested across the board in more strategic and proactive enterprise-wide resilience.
Q. Which, if any, of the following resilience investments have your organisation made in the last 12 months or are planning to in the next 12 months?
Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
Our survey shows relatively strong investment currently in resilience initiatives such as investing in digital communication and remote sharing to enable remote working in a crisis, upgrading critical systems to be more resilient against cyber attacks and establishing protocols with major tech providers to coordinate incident responses. But there is room for improvement in initiatives such as establishing a cross-functional resilience team, expanding your network of key suppliers as part of business continuity plans and building back-up production facilities.
Ambitions of making risk a strategic player that helps organisations to take on risk with confidence and unlock new opportunities and sources of value must be matched with the development of skills and capabilities.
Yet only 31% of organisations say they strongly agree that upskilling teams to be better prepared for potential risks or that providing employees with the right skills to better enable them to solve complex problems are a priority. For Türkiye, this figure is even lower, %13.
Another key growth mindset behaviour evident in top performing organisations is detoxifying failure through a ‘safe to fail’ culture, where employees feel they can experiment and adapt to different circumstances and events. Yet only a quarter of respondents said they strongly agree their organisation has a safe to fail culture, compared to half of Risk Pioneers.
Organisations will need to recognise the whole organisation has a role to play in navigating risk, from increasing collaboration internally and externally across supply chains and ecosystems, to challenging their risk appetite and collectively building resilience. This presents the opportunity for a new role for risk teams where there will be a more strategic use for their insights and experience.
Organisations can no longer afford to rely on a reactive approach to risk that focuses primarily on avoidance. Nearly 40% of CEOs respondents think their company will no longer be economically viable a decade from now if it continues on its current path. From climate and geopolitical risk to macroeconomic volatility and the disruptive power of technology, organisations must change and reframe the way they see risk to build resilience and unlock opportunity.
The ability to adapt, change and reinvent at pace amid this constant change and uncertainty is vital for survival and sustainable growth. Harnessing the power of technology and data in new ways, combined with building more diverse multi-disciplinary capabilities across the organisation, will be critical to turning risk into that enabler of change and growth.
The PwC Global Risk Survey 2023 is based on 3,910 responses from business and risk management leaders (CEO, board, risk management, operations, technology, finance, audit) across 67 territories providing their views on the status and direction of risk in their organisation.
Survey responses are from a range of industry sectors and organisation sizes, with over a quarter from USD$5bn+ organisations.
PwC Research, PwC’s global Centre of Excellence for market research and insight, conducted this survey.
