Shaun Willcocks, Global Risk Markets and Internal Audit Leader, joins our GCCR co-leader Bobbie Ramsden-Knowles to discuss the newly launched PwC’s Global Risk Survey 2023 and the key behaviours of Risk Pioneers, organisations successfully driving reinvention, growth and resilience.
Shaun Willcocks, Global Risk Markets and Internal Audit Leader, joins our GCCR co-leader Bobbie Ramsden-Knowles to discuss the newly launched PwC’s Global Risk Survey 2023 and the key behaviours of Risk Pioneers, organisations successfully driving reinvention, growth and resilience.
Bobbie Ramsden-Knowles:Hello everyone. And thanks so much for joining us today for this episode of Emerge Stronger Through Disruption. My name's Bobbie Ramsden Knowles. I'm co-leader of PwC's Global Centre for Crisis and Resilience, or GCCR for short. And I'm coming to you today from our office in London. Now in our podcast series, my GCCR co-leader, Dave Stainback and I aim to tackle the challenges facing business in this environment of constant change and crisis.
And we also discuss how successful business leaders can emerge stronger through this ongoing disruption that we're all seeing. Today, I'm really excited because we're joined by Shaun Willcocks, who's our Global Risk Markets Leader for PwC. And he's here today to discuss the newly launched PwC Global Risk Survey 2023.
So in today's episode, we're going to explore some of the data and the insights revealed by almost 4,000 business leaders worldwide, especially focusing on trends seen among the top performers who we've identified as the Risk Pioneers, and we're going to really delve into actions organisations can take to become a Risk Pioneer.
Hi Shaun, it's so nice to have you on with us today. Can we perhaps start by you introducing yourself and giving us a quick overview of your role?
Shaun Willcocks: Hi Bobbie, great to be here and thank you very much for having me on the podcast. I'm a partner in our Japan firm based in Tokyo. I'm originally from the UK, but moved here around 12 years ago.
Although if you'd heard me speak Japanese, you'll probably think I arrived yesterday. I lead PwC's global Internal Audit practice, and I'm also the Markets Leader for our broader Risk business. And our Risk business brings together various interconnected capabilities that allow us to address the multidimensional risks that organisations face today.
So this includes areas like cyber, ESG, data modelling, forensics, internal audit, Regulatory Compliance, Enterprise Tech and Risk and Control Capabilities. So a lot of things under one roof.
Bobbie: Yeah, absolutely. And look, thank you again for coming today and talking to us about the survey. Look, clearly we work really closely together already at the moment, given how closely knitted Risk and Resilience are, we can't really talk to an organisation about one without the other.
So it's brilliant that you were able to come today and talk through and present the results in the survey. So let's get right into it, if we can. Could you run us through some of the nuts and bolts of the survey?
Shaun: Sure. Thank you, Bobbie. So we launched the survey at the end of November and it captured the views, I think you mentioned, from 4,000 executives and business leaders, and they came from many different parts of the organisation, including IT, operations, finance, and also second and third line risk and audit functions. The responders came from 67 countries, so it provided a truly global view of risk and what matters to businesses around the world.
The theme of the study is how risk is moving from something that people just see as a threat to something that businesses can embrace to help them transform and grow. And at the heart of this is technology. In particular, how technology helps organisations take risk in an intelligent way and build resilience in the right places.
Bobbie: That's brilliant. I think as many people know, we published a survey last year, the Global Crisis and Resilience Survey, which was focused on something we called and termed the Resilience Revolution. I think there are a lot of parallels, actually, in what you've just said there, and I imagine some of the findings from the Risk Survey.
And in particular, what we found was that organisations are really shifting their ways of preparing and responding to disruption, to actually recognising the importance of creating value and transforming organisations so that they thrive, not just survive in today's business environment. I wonder, could you perhaps share with us some of the insights and highlights from the Global Risk Survey?
Were there any survey findings that particularly resonate with yourself?
Shaun: Yes, Bobbie. So there were three key findings. So I'll run down those three. First of all, the technology is creating an appetite for risk. What we found was that cyber and digital risks ran high up the list of threats. 37%, 32% of executives respectively felt that they were extremely or highly exposed to those risks.
However, that's not putting off organisations investing in technology. So around half were still planning to invest in cybersecurity, AI and automation. And the good news is that preparing for these technology investments was one of the biggest factors in triggering a review of their risk landscape. So that meant that they were going into this with eyes open and recognising that these risks were something they had to tackle head on.
And we also saw that technology disruption was more likely to be seen as an opportunity compared to other sort of non technology disruptors. Around 60% saw GenAI, for example, as an opportunity rather than something to be afraid of.
The second finding we have is that confidence in managing risk was high, but there was a disconnect between the perception of the readiness and actual readiness.
So 40% of executives were very confident that their organisation can balance growth with managing risk effectively, and 51% were somewhat confident. However, there was a misalignment between some stakeholders. So for example, 50% of CEO and board respondents were very confident, but that dropped to 34% and 30% when you look to operations and audit leaders, for example, and only 22% of executives thought that their own risk appetite matched that of the CEO and board.
So there was a disconnect there. And there was also some misalignment between CEOs and Risk executives on the strategic value that those risk functions provided. CEOs are generally less likely to agree that the risk function was demonstrating those value add behaviours compared to sort of how those risk functions rated themselves.
So I think what this meant was that there's an opportunity for better conversations between these different stakeholder groups on what's really valuable to the business and getting some alignment or more alignment on things like risk appetite. So I think, in other words, there are opportunities to demonstrate new ways to create value from risk. So I would see that very much as an upside.
And the third finding out of the study was that the Risk Pioneer group that you mentioned before are the ones forging the path ahead. So we highlighted the top 5% of top performing organisations and we batched those as Risk Pioneers. And they're the group that achieved greater range of positive outcomes from these activities, and they were more likely to focus on value creation, rather than just the value protection aspects of risk, and they were twice as likely, for example, to see AI, you know, as fully an opportunity rather than a threat. They're also more likely to invest in technology to navigate risk. For example, predictive risk tools. They also invested in resilience initiatives, and they had a risk function that demonstrated more strategic value across more areas.
And interestingly, this group was also more likely to describe their risk appetite as eager or hungry. And I think this is important and linked to one of the underlying themes in the study, that companies need to take risks intelligently to transform and thrive today.
Bobbie: I think that's really interesting. I think one of the key messages I'm hearing from you is this point around the fact that actually there are opportunities to demonstrate new ways to create value from risk.
And it feels like that actually does require a change in mindset in organisations. And I wonder if you could talk a little bit more about the Risk Pioneers, because it sounds to me like they play a critical role in driving that change in mindset to creating value from taking risk is as much as managing risk from a negative perspective.
Shaun: So our analysis grouped most respondents into four what we call archetypes based on whether they're more focused on value creation or value protection, and whether they did this from more of a human-led approach or a tech-powered approach. So this created a quadrant with these four archetypes, and there was fairly even spread across these four areas, ranging from 20 to 28% in each group.
So the groups were, first of all, Innovators, and this accounted for 28 % of the groups. And this group focused on value creation, but mainly relied on their human insights and culture to achieve the value.
The Disruptors, which were 20% focused more on value creation, were more afraid with using advanced technology in doing this. And they typically had a high appetite for risk and looked to uncover the opportunity in risk.
The third group was Defenders, and this was 20%, and they're more likely to have fully integrated their use of technology and data and risk management, and more likely to have low risk strategies that focus on value protection rather than value creation.
And the last group, the Pragmatists, that counted for 27%, was culturally more focused on value protection and less on the advanced use of technology and the strategic use of technology. And so this group might be considered the more conservative group out of those four archetypes.
Now, the top 5% was the group that we classed as Risk Pioneers, and they sat between the Innovator and Disruptor, and achieved a good balance between their human and technology dimensions. You're probably asking why did this matter? Why would an organisation want to strive to be a Risk Pioneer? Well, in our CEO survey, the number of 40% of CEOs was highlighted where they think their company will no longer be economically viable a decade from now if it continues along its current path.
So this means getting a balanced strategy that's right for the company that addresses both value protection and creation is critical. So companies need to embrace risk to disrupt and grow, and the survey found that Risk Pioneers were almost twice as likely to proactively take risks to create these opportunities versus prioritising more safe and low risk strategies.
Equally, companies need to build resilience to protect themselves against the crisis and global macroeconomic trends that are disrupting others in the market. So this includes building resilience into their business strategies and being agile and ready to adapt when they're not working.
Bobbie: That definitely resonates, I think, with the findings that we had from the Global Crisis and Resilience Survey.
And I think in particular, the point that it's not just operational disruption that organisations need to be resilient for, but in fact, actually their business strategy in long term. Business model also needs to be resilient and be able to flex and adapt to the external environment shifts that we're seeing at the moment.
There's definitely a lot of common themes, which is brilliant to see coming out. I think the other point our survey really picks up on was the importance of having an integrated and tech-enabled resilience programme with a dedicated sponsor. I think from what we are hearing and what you've heard, you know, clearly the message resilience creates value, builds trust, and ultimately protects an organisation's reputation if done right.
Shaun: That's right.
Bobbie: So Shaun, we always like to give our podcast listeners some actionable insights to take away. I wonder if perhaps you could talk about a few key actions you think business leaders might want to reflect upon in order that they can become a Risk Pioneer.
Shaun: Sure Bobbie. There were five key ways we highlighted from the study that organisations can move towards being a Risk Pioneer.
The first one was build in resilience to strategy and strategic decision making. So this can include stress testing new strategies and scenario planning. For example, leadership workshops where you can test different ‘what if’ scenarios. So this should look for blind spots in the organisation's strategy.
And our survey found that around half of organisations have invested in specific resilience initiatives, which is good. But only 7% have invested across the board in more strategic and proactive enterprise-wide resilience. So there is more to do in this space, particularly as things change, these scenarios might change. So it has to be something that you come back to and keep looking out and stress testing.
The second area is match the tech ambition with action. So we discussed earlier that there is an appetite to invest in technology. It's important, though, to think about risk and ensure this is built into every transformation project and new initiative rather than being something of an afterthought.
And this is backed up with proper investment and resources. Most organisations want a more tech-powered approach to risk, but many are still at a relatively early stage of their maturity. Only one in ten, for example, are using advanced and predictive analytics and other cutting-edge tech in risk. So the ambition is there, but it needs to be backed up with action.
I think, importantly, a willingness to try new things is critical, and this includes piloting and trialling technology, even when you're not sure necessarily the outcome, and part of this is defining key success factors and KPIs (Key Performance Indicators) so you can monitor your Return on Investment - and being agile and adapting when it's not going well, and not being afraid to fail and change direction there.
The third area is put purpose at the heart of the risk strategy, so make sure that your risk strategy is aligned with your corporate objectives and vision, and the purpose and values of the organisation. What this does is helps ensure that the whole organisation understands the direction and framework your risk appetite and decision making is operating in. So this helps build trust with the various stakeholders, including employees, customers, investors, and regulators, when you have that strong purpose and vision.
Fourth area is, we mentioned earlier about the leadership disconnect, so it's helping to fix that. So it's talking more about risk and understanding each other's different viewpoints.
So you can get a middle ground or at least understand why a particular decision is being taken. So this will involve better collaboration between these different stakeholder groups and different lines of the organisation. Such as risk compliance and internal audit teams, and then the different functions in the organisation, and it can include co-developing new technology together, and co-developing different approaches to risk between these different teams. So that sharing and collaborating, I think, is a very important aspect of this. And being willing to challenge and stress test the strategy, and this will help elevate the conversations to a more strategic level. This was also explored in our Global Internal Audit study that we released in September. And that gave some ideas on how this collaboration and co-development can work.
Lastly, the fifth area is creating a culture that's diverse and where bold thinkers can thrive. So think of ‘culture’ as the glue that binds the organisation together, but also the fuel that can help it innovate. So having that growth mindset was evident, for example, in top performing organisations, and part of that is detoxifying failure through a ‘safe to fail’ culture, where people can feel that they can experiment and adapt, and that's an important part of it. And management can build these opportunities into their strategy and planning for transformation projects so you can build this environment upfront when you embark on these initiatives.
And I think this last one is particularly important and could be a differentiator for competitive advantage. Another way of looking at it is that if you don't take risks, you don't progress. And this is true of every decision or change in an organisation. It has an inherent risk to it and you need to take risks. And I think the difference in today's world is how we use technology, and these new approaches to risk to do this in an intelligent way and build this into decision making at all levels.
Bobbie: Yeah, I couldn't agree more on that technology point. I think certainly what we're seeing is the use of technology in helping organisations build their resilience through having a greater visibility of where their vulnerabilities might lie actually enables organisations then to confidently take risk in their decision making.
I think also the point you made around strategic resilience is really critical. We're seeing a lot of organisations look at and analyse these big macro risks that they're trying to manage. But the important bit that they're then often speaking to us about is actually, the So what? How do we manage this risk? How do we make decisions around it? How do we plan for it? So I think that strategic resilience point is really important as well.
That seems like a really great place to wrap up. We've covered so much, Shaun. Thank you so much for that great discussion and also great summary of the survey results.
Shaun: Thank you, Bobbie, for having me.
Bobbie: Brilliant. And for all our listeners in our upcoming episodes of Emerge Stronger Through Disruption, we, as always, will continue to tackle the topics that keep our business leaders up at night. We'd love to hear ideas from listeners about the topics you'd like us to address. So please do get in touch with both Dave and me via LinkedIn.
And in the meantime, remember to subscribe to Emerge Stronger wherever you get your podcast. Thank you for listening. We'll see you next time.