Unlock the Power of Risk Management for Business Growth

Emerging Risks and Challenges

Risks are emerging at an astonishing pace, as evidenced by most insurance CROs using early-warning KPIs for a broader set of risks than those considered material under their Own Risk and Solvency Assessment. For instance, while only 20 percent of insurers incorporate data and technology risks in their latest ORSA, a remarkable 50 percent use early-warning KPIs for these risks. Climate risk stands out as a notable exception; 60 percent of respondents consider it material, but only 25 percent have an early-warning KPI in place.

Many emerging risks, such as data and technology, cyber, and climate risks, are now prominent in companies' risk taxonomies. Additionally, several challenges are adding to the complexity of the CRO's task. One of the most significant is the scarcity of talent, both in attracting and retaining it. Half of the survey respondents reported difficulties in filling roles in data and technology, cyber risk, and nonlife underwriting.

Transforming the Risk Function

Across all insurers in the survey, it's clear that the role and status of the CRO, as well as the risk function itself, must evolve. The size of the risk function varies widely, from 0.07 percent to 2.8 percent of the total workforce (with an average of 0.8 percent), and the average risk budget represents only 0.3 percent of operational expenses. This indicates diverse operating models with no clear market best practice.

The actual role of the CRO is expanding, including risk-based decision-making, managing the relationship with the CEO and board, communicating the company's risk position, and aligning the overall risk appetite and framework. However, only 34 percent of survey participants said the second line has veto power on important decisions, and only 17 percent reported that business units' decisions are often changed due to collaboration with or challenge from the risk team.

Inconsistent Adoption of Best Practices

In our work with organizations, we've identified four best practices for involving risk in decision-making, but none have been fully adopted by insurance companies. Two-thirds of respondents have fully implemented processes to ensure comprehensive risk dialogue, even in time-constrained situations. Also, two-thirds have a transparent set of criteria for key event-driven decisions. Half of respondents said the CRO is fully involved in strategic decision-making with veto or escalation rights. But only a third are actively mitigating risks prior to commitment, and 17 percent report having no active risk mitigation at all.

Next Steps

For insurers looking to enhance the risk function and integrate it more fully into daily decision-making, we recommend fully implementing the four best practices. They should elevate the risk function to the strategic agenda, give the CRO a seat at the table with appropriate touchpoints. Reconsider the risk function operating model in terms of lines of defense to ensure proper governance and efficient interactions with business units. Ensure the risk function has adequate resources in terms of talent and analytics capabilities. Use the risk function as a source of competitive edge by considering postmortem analyses and involving it in financial planning and strategy building.

Today's evolving risk landscape requires a new, more forceful approach to assessing and responding to risk. While corporate leadership involves the risk function, the transition to a true thought partner is ongoing. CROs need authority, resources, and support to reorganize and build capabilities, influencing business decisions. Elevating the risk function will transform it from a control function to a strategic advantage for business growth.