From threat to opportunity

PwC’s Global Risk Survey 2023

PwC's Global Risk Survey
  • Report
  • 15 Minute Read

How a tech tipping point is fueling reinvention, resilience and growth

If we don’t take risk, we don’t progress. Taking risk intelligently is the only way organisations can reinvent and transform to survive, create value and prosper in this time of uncertainty, while building resilience to protect value in the face of complex, ever-changing risk.

PwC’s Global Risk Survey 2023 reveals how leading organisations are changing the way they see risk by embracing the transformative power of technology and data in pursuit of opportunity and value creation. 

The research—which surveyed 3,910 business and risk leaders, from the boardroom and C-suite, across tech, operations and finance, as well as risk and audit—also highlights how technology is playing an increasingly important role in helping organisations protect value by mitigating and managing downside risk more effectively.

The transition to new energy sources is seen as the biggest opportunity among external disruptors, cited by 54% of respondents (For Türkiye 64%), closely followed by changes in customer demand and preference (47%) (For Türkiye 35%). By contrast, supply chain disruption is the main external factor seen as more of a risk than opportunity, cited by 42% of respondents. For Türkiye, this rate remains low (29%) compared to global data.

The transition to new energy sources is seen as the biggest opportunity among external disruptors, cited by 54% of respondents, closely followed by changes in customer demand and preference (47%). By contrast, supply chain disruption is the main external factor seen as more of a risk than opportunity, cited by 42% of respondents.

Industry sector also has an impact on whether organisations sit at the value protection or value creation end of the risk appetite scale. Those in faster moving sectors, such as retail and tech, are more likely to embrace risk and seek opportunity, while those in regulatory driven sectors such as government and pharmaceuticals are more likely to prioritise compliance and focus on risk avoidance. Different functions within the organisation also have different perspectives on risk, with finance roles more likely than others to say their organisation is focused on risk avoidance over a high risk appetite.

62%

of organisations predominantly seek to uncover opportunities within risks. This rate is significantly lower (29%) for Türkiye than the global average. Looking at the results from Türkiye, it is understood that the risk management approaches of organizations are focused more on value protection rather than value creation. Türkiye's results point out that when managing risk, the priority of organizations is regulatory adherence and their risk management approach is primarily focused on risk avoidance.

60%

of organisations see GenAI as mostly or fully an opportunity rather than risk. This figure is %55 for Türkiye.

57%

of organisations say preparing for technology investments is the single biggest motivating factor to review their risk landscape

Q. For each of the statements below, please indicate on the sliding scale which best describes your organisation. Q. To what extent do you currently see the following technology disruptors as a risk versus an opportunity for your organisation? Q. Which, if any, of the following situations / occasions trigger a review of your organisation's risk landscape? Base: All respondents=3910 Source: PwC's Global Risk Survey 2023

Crucially, our survey reveals a top performing 5% of organisations spread across all industry sectors—identified in the research as Risk Pioneers—who are forging ahead in the pursuit of opportunity. Underpinned by strategic enterprise-wide resilience and guided by a human-led, tech-powered approach, these pioneers are significantly more likely than other organisations to be upskilling internal teams and making greater use of advanced analytics, predictive modelling, cybersecurity tools and cloud to navigate risk. And they are more likely to see emerging technologies such as GenAI as an opportunity rather than a risk.

As a result, this leading group is better aligning the navigation of risk with business strategy to achieve a greater range of outcomes and value—from more robust regulatory compliance and streamlined reporting to enhanced customer trust and identifying new commercial opportunities.

Five key findings

Our survey highlights five compelling findings for leaders. Each is explored further in this report, focusing on why they matter to organisations and their stakeholders, the value they create, and practical ways to use technology and data in new ways to navigate risk.

1. How technology is reshaping perceptions of risk

Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience.

2. The need for a human-led, tech-powered approach to risk

We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach—revealing four illustrative risk archetypes and a top-performing group of Risk Pioneers.

3. How Risk Pioneers are leading the way

Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.

4. Closing the gap—Five ways you can be a risk pioneer

Five key actions for organisations to ensure they are resilient and equipped to survive, create value and prosper amid uncertainty and complex, ever-changing risk.

5. Are you ready to change the way you see risk? The key questions leaders must answer first

The journey to taking risk more intelligently—powered by technology and through the lens of reinvention, opportunity and growth—requires leaders to start with these four key questions

How technology is reshaping perceptions of risk

Technology is playing an increasingly significant role in shaping an organisation’s exposure to risk, their appetite for taking risk in pursuit of new opportunities, and the tools they are using to mitigate it and build resilience. 

Only inflation ranks higher than cyber (the top tech-related threat) in terms of the risks respondents feel most exposed to, while other digital and tech risks are almost on a par with macroeconomic volatility. A third of CEO respondents in our survey say they feel highly or extremely exposed to cyber risk, and those leaders primarily responsible for managing risk ranked cyber risk above inflation. However, these risks are not putting organisations off investing in technology with around half planning to invest in cybersecurity tools and AI, machine learning and automation technologies. Nearly half of participants from Türkiye have the same perspective. Looking at the responses from Turkey, inflation (68%) and macroeconomic volatility (61%) risks are by far ahead of cyber risks (19%)  & digital and tech risks (13%).

But our survey shows such tech-related risks, from cyber attack to costly—and potentially brand damaging—mistakes in deploying technology are not putting organisations off investing in technology. The appetite for innovation and new technology is encouraging organisations onto the front foot. They are proactively assessing and mitigating these risks to transform and to manage their costs, support growth and ultimately build their resilience.

Preparing for technology investments, from cloud to emerging technologies such as GenAI, is the single biggest motivating factor for an organisation to review its risk landscape—cited by 57% of respondents overall (For Türkiye 32%), and 62% of respondents from large organisations with revenues of USD$5bn or more. That is higher than organisations being triggered into a review by a risk event (50%) or entering new markets (46%), marking a step-change in where and why risks are assessed.  According to the responses given by participants from Türkiye, organizational strategy development, a risk event and periodic reviews are seen as more prominent motivating factors, contrary to global results.

Technology disruptors are also much more likely to be seen as opportunities than risks compared to other external non-tech disruptors. For example, 60% of respondents  (For Türkiye 55%) see GenAI as an opportunity compared to just 35% (For Türkiye 10%) who see changes in regulation as an opportunity and 28%  (For Türkiye 14%) who see supply chain disruption as an opportunity. Given their position at the forefront of exploring and implementing emerging tech across their organisations, the results also show respondents in operations and tech roles are more likely than all the other job roles and functions to see GenAI as an opportunity over risk. According to the responses from Türkiye, the external non-tech disruptor that is most seen as an opportunity rather than a risk is the transition to new energy sources.

This enthusiasm for GenAI echoes separate PwC research, the Global Digital Trust Insights Survey, which found 77% of respondents stating that GenAI will help their organisation develop new lines of business over the next three years, while our Global Workforce Hopes and Fears Survey of more than 50,000 workers reveals employees see more positive than negative impacts from AI on their roles, despite headlines about AI-fueled job losses.

The need for a human-led, tech-powered approach to risk

We have analysed risk appetite and preference for value creation versus value protection among our respondents and plotted this against the maturity of an organisation's human-led, tech-powered approach. This reveals four illustrative risk archetypes. And when we then looked at those organisations achieving the greatest range of outcomes, we identified a small distinct group of top-performing Risk Pioneers leading the way.

The Risk Archetypes

Click each archetype below to learn more.

Open innovators quadrant

Innovator

28%Spread across most industries and culturally predisposed to the pursuit of value creation over value protection but rely primarily on their human insights and culture of innovation to achieve it. More than three-quarters (77%) have a high appetite for risk and 88% seek to uncover opportunity in risk over regulatory adherence. They are more likely to have a proactive approach to taking risk and building resilience. However, they are also more likely to be using basic technology and data tools for managing risk, which lack comprehensive integration. And their enterprise tech strategy is less likely to include investment in tech specifically to build resilience and manage risk.

Read more Close this quadrant Back to Risk Archetypes
Open disruptors quadrant

Disruptor

20%Focused more on value creation than value protection, are more advanced in the use of technology to achieve it, and are more likely to have fully integrated their use of technology and data in risk management and be using advanced and predictive risk management capabilities to identify and evaluate potential risks. This archetype is spread across most industries, apart from a significantly lower representation of organisations from government and public services. More than three-quarters have a high appetite for risk and 89% seek to uncover opportunity in risk over regulatory adherence. They have a proactive approach to building resilience to unexpected disruptive events.

Read more Close this quadrant Back to Risk Archetypes
Open pragmatists quadrant

Pragmatist

27%Culturally focused more on value protection and less advanced in their strategic use of technology. Government and public services organisations are more likely to be present in this archetype. Three quarters (76%) focus on risk avoidance over opportunity and 71% prioritise regulatory adherence when managing risk. This archetype is more likely to be using basic technology and data tools for navigating risk, lacking comprehensive integration. And they are less likely to be using tools such as advanced analytics or predictive modelling, real-time monitoring, data visualisation and cloud to identify and evaluate potential risks.

Read more Close this quadrant Back to Risk Archetypes
Open defender quadrant

Defender

20%Advanced in their use of technology and are more likely to have fully integrated their use of technology and data in risk management with regular updates and improvements—they are using it primarily for value protection rather than a strategic pursuit of value creation. Spread across all industries, almost two-thirds prioritise regulatory adherence over opportunity when managing risk and they are more likely to have low risk strategies.

Read more Close this quadrant Back to Risk Archetypes
Human-led
Tech-powered
Value Creation
Value Protection
Human-led
Tech-powered

Our risk archetype quadrant is an illustrative starting point to help benchmark your approach to risk

It should not be assumed the more reactive and protection focused nature of some of the archetypes within this quadrant signals a lack of ambition or intent to shift towards value creation. In turbulent economic conditions and disruptions that have affected some industries more than others, those organisations may be constrained in their ability to invest in the talent and technology needed, or may feel exposed to risks so significantly that value protection is seen as the best and only outcome currently.

How Risk Pioneers are leading the way

Risk Pioneers are blazing a trail in reframing risk as a value creation opportunity for their organisations. This top performing 5% of organisations, built on enterprise-wide resilience and driven by a balanced human-led, tech-powered approach to risk, are already achieving more successful outcomes than others.

As the chart below shows, Risk Pioneers are consistently outperforming other organisations through their approach to risk, particularly in value creation outcomes such as identifying new commercial opportunities and improving financial performance.
 

The gap between Risk Pioneers and overall survey respondents for outcomes achieved to improve their approach to navigating risk
  • Total
  • Risk Pioneers
  • Greatest performance premium
    Q. Which, if any, of the following has your organisation achieved in the last 12 months to improve its approach to risk?
    Base: All respondents=3910 Source: PwC's Global Risk Survey 2023
    Status Risk pioneers All
    Enhanced customer trust and confidence 89% 40%
    Identification of new commercial opportunities 84% 32%
    Improved financial performance due to effective risk mitigation 84% 32%
    More robust compliance with regulatory standards 81% 40%
    Better alignment of risk management with business strategy 80% 31%
    Increased accuracy in risk forecasting 79% 29%
    Building competitive advantage 79% 31%
    Expansion into new markets 78% 28%
    Enhanced response time to emerging risks 77% 28%
    Streamlined risk reporting and communication 76% 32%
    Greater integration of risk management across business functions 76% 30%
    Improved identification and tracking of potential risks 75% 31%
    Improved resilience to external shocks or crises 75% 28%
    The key characteristics of Risk Pioneers

    Our survey shows a fairly even spread of Risk Pioneers across most industries. They are particularly prevalent in financial services, retail and consumer, technology, media and telecoms, and from organisations with revenue of USD$5bn or more. Respondents are more likely than the survey average to be CEOs and the board (34%) and their organisation is more likely to have seen revenue increase in the past six to nine months and be expecting it to increase again in the next 12 months. Almost three-quarters (73%) of Risk Pioneers also have an enterprise-wide technology strategy and roadmap, which includes investment in technology specifically to drive resilience and/or manage risk—compared to 53% of overall survey respondents.

    Outcomes achieved
    • 1.8x more likely to say they are very confident of balancing growth with managing risk

    • 1.8x more likely to see GenAI as fully an opportunity than risk

    • 1.6x more likely to proactively take risk to create opportunities versus prioritising safe or low risk strategies

    • 1.4x more likely to prioritise building resilience to unexpected disruptive events versus prioritising stability and continuity when trigger events occur

    • More likely to view their own risk appetite (30%), their CEO’s (31%) and their board’s (26%) as eager/hungry, indicating closer leadership alignment on taking risk

    How they achieved them
    • 2.7x more likely to be using advanced and predictive risk management capabilities together with cutting-edge technology and data to navigate risk

    • Less likely to say legacy technologies have impacted their organisation’s ability to manage and respond to risk.

    • 2.6x more likely to have improved financial performance due to effective risk mitigation 

    • 2x more likely to have achieved more robust compliance with regulatory standards

    • Significantly more likely for the risk function of pioneers to be already demonstrating strategic behaviours such as challenging senior management on strategy and risk appetite, guiding the business through complex change such as mergers and acquisitions (M&A), and bringing risk insights to the board for better oversight.

    These leading Risk Pioneer behaviours and outcomes reveal a clear gap that organisations need to address if they want to make more effective use of tech and create opportunity and value out of risk. Around two-fifths of all organisations have improved their approach to managing risk to enhance customer trust and improve compliance with regulation. But fewer than a third of organisations have achieved successful outcomes across other key areas, highlighting the opportunity to achieve better outcomes from their risk strategy and to provide strategic value. 

    Closing the gap—Five ways you can be a risk pioneer

    1. Match tech ambition with action

    There is clear ambition among most organisations to take a more tech-powered approach to risk, seen by their intention to invest in AI, machine learning, automation, cybersecurity and cloud. But many respondents are still at relatively early stages of maturity in their use of technology and data for managing risk. Just one in ten organisations are already using advanced and predictive analytics, cutting-edge tech and data for managing risk and are continuously refining and innovating.

    14%

    Are exploring or have just started using technology and data for risk management (This rate is 6% for Türkiye)

    24%

    Are using basic technology and data tools for risk management but lack comprehensive integration (This rate is 32% for Türkiye)

    24%

    Have established technology and data procedures for risk management, but they are not fully optimised (This rate is 32% for Türkiye)

    Q. Which of the following statements best describes your organisation’s approach to using technology and data for risk management?
    Base: All respondents=3910 Source: PwC's Global Risk Survey 2023

    Risk pioneers, organisations with USD$5bn+ revenue and technology companies are more likely to be at the advanced stage of implementation, while respondents in the government and public services sector are more likely to be just starting to use technology and data to manage risk. Those organisations more advanced in implementation are using on average a greater number of technologies to navigate risk—4.6 versus 2.5 overall.

    Existing legacy technology investments—often becoming more complex through years of mergers, acquisitions, restructuring and consolidation—are also impacting the ability of organisations to manage and navigate risk.

    The biggest legacy tech challenges for risk

    41%

    Poor data integration and management limits a holistic view of risks (This rate is 42% for Türkiye)

    39%

    High maintenance costs (This rate is 32% for Türkiye)

    37%

    Increased risk of operational failure (This rate is 29% for Türkiye)

    36%

    Increased security vulnerabilities (This rate is 26% for Türkiye)

    Q. In what ways, if any, have legacy technologies impacted your organisation’s ability to manage and respond to risk?
    Base: All respondents=3910 Source: PwC's Global Risk Survey 2023

    There also appear to be differences between those in tech and operations and those in risk and audit when it comes to the perception of how mature their organisation’s use of tech and data to navigate risk is. For example, 68% of tech respondents and 63% of operations respondents say their organisation is using advanced analytics or predictive modelling to identify and evaluate potential risks to a large or very large extent. But this compares with just 49% of risk executives and 15% of audit respondents who agree with that statement.

    Despite these challenges, as the Risk Pioneers are demonstrating, the opportunity for early advantage is still available to those bold enough to move quickly, and embrace emerging technology at speed.

    2. Put purpose at the heart of your risk strategy

    An approach to risk led by a clear and authentic purpose can help organisations be more resilient and guide which risks to embrace or avoid. It ensures the whole organisation understands the direction and ambition for the future, and helps build trust with stakeholders—from employees and customers to investors and regulators.

    Purpose provides a vital strategic lens on whether a risk is more threat or opportunity, particularly around issues such as climate change, sustainability, ethical supply chains and the responsible use of emerging tech, such as GenAI. Yet only around a third (32%) of respondents  (For Türkiye 19%) say they strongly agree that their organisation uses purpose and vision for the future to make decisions about risk.

    Working with your employees and wider stakeholders, such as investors, regulators and non-executive directors, to set a clear and authentic purpose builds the right risk mindset, which then feeds into the risk frameworks and metrics that will help build resilience and deliver sustainable outcomes.

    3. Fix the leadership disconnect

    Most organisations (91%) are confident they can balance growth ambitions with managing risk effectively (For Türkiye %84) , 40% of executives are very confident their organisation can balance growth with managing risk effectively (For Türkiye %32), and a further 51% are somewhat confident (For Türkiye %52). While only 1% of the participants globally answered "not very confident", it is noteworthy that this rate is 16% in Turkey.

    There are differences when we analyse responses across different job roles and functions. For example, half of CEO and board respondents are very confident of balancing growth and risk compared to just 34% of operations leaders and 30% of audit leaders. And only just over a fifth of risk executives say their own risk appetite matches that of their CEO and board. This result is valid for Türkiye, CEO and board respondents are more confident (%91) compared to operations, finance and audit leaders.

    However, there is misalignment between economic buyer groups, with 50% of CEO/Board ‘very confident’ compared to 34% of Operations and 30% of Audit leaders. Furthermore, only 22% of executives stated that their own risk appetite matched exactly with that of their CEO and Board. Looking at Turkey's data, it is concluded that there is a significant difference between the Board and CEO levels in terms of risk appetite (willingness to take risks), and that the risk appetite of CEOs is significantly higher.

    There is also misalignment on the perception of the strategic value the risk function provides, with CEOs less likely than risk executive survey respondents to agree the risk function is demonstrating behaviours such as bringing risk insights to the board for better oversight, guiding the business through complex change and challenging senior management. 

    For example, 60% of risk executives say they are already demonstrating providing insights on new and emerging risks to senior management versus 54% of respondents from the wider business—CEOs, the board, operations, tech and finance.

    This disconnect is also evident in PwC’s Global Internal Audit Study 2023, with business leaders stating they want more early and proactive strategic engagement with Internal Audit. Despite that expectation, only around a fifth of executives ranked strategic thinking and the ability to challenge constructively as key strengths of Internal Audit. And almost half (49%) said Internal Audit does not have strong alignment with other lines on key risks and challenges.

    We see far greater alignment between the CEO/board and risk among the top performing Risk Pioneers. Almost a third (32%) of Risk Pioneers stated that their own risk appetite matched exactly that of their CEO and board, compared to just 22% of overall respondents.

    This leadership disconnect needs to be resolved if risk management is to amount to more than value protection and a reactive response to threats. Fostering greater collaboration between the risk function, leadership and the wider business and having more strategic conversations earlier in the process are key if organisations are to find opportunities where competitors may still see risk. 

    4. Build a foundation of strategic resilience

    There is a link between resilience investments and achieving risk management outcomes, with better performing organisations more likely to have invested across more resilience initiatives in the last 12 months.

    Although around half of organisations have invested in specific resilience initiatives, these remain in isolated pockets with just 7% have invested across the board in more strategic and proactive enterprise-wide resilience.

    The top three resilience initiatives organisations plan to invest in over the next 12 months

    35%

    (For Türkiye, this figure is 29%) Establishing a resilience team with members from functions like business continuity, cyber, crisis management and risk management

    35%

    (For Türkiye, this figure is 23%) Expanding our network of key suppliers as part of our business continuity plans

    34%

    (For Türkiye, this figure is 29%) Building back-up production facilities to ensure the continuity of our production in the event of a disaster impacting some of our facilities. Looking at Turkey’s data, the top resilience initiative (42%) organisations plan to invest in over the next 12 months is upskilling their people so that key roles can be covered by back-up personnel if the incumbents are out of work for an extended period of time.

    Q. Which, if any, of the following resilience investments have your organisation made in the last 12 months or are planning to in the next 12 months?
    Base: All respondents=3910 Source: PwC's Global Risk Survey 2023

    Our survey shows relatively strong investment currently in resilience initiatives such as investing in digital communication and remote sharing to enable remote working in a crisis, upgrading critical systems to be more resilient against cyber attacks and establishing protocols with major tech providers to coordinate incident responses. But there is room for improvement in initiatives such as establishing a cross-functional resilience team, expanding your network of key suppliers as part of business continuity plans and building back-up production facilities.

    5. Create a culture where diverse and bold thinkers can thrive

    Ambitions of making risk a strategic player that helps organisations to take on risk with confidence and unlock new opportunities and sources of value must be matched with the development of skills and capabilities.

    Yet only 31% of organisations say they strongly agree that upskilling teams to be better prepared for potential risks or that providing employees with the right skills to better enable them to solve complex problems are a priority. For Türkiye, this figure is even lower, %13. 

    Another key growth mindset behaviour evident in top performing organisations is detoxifying failure through a ‘safe to fail’ culture, where employees feel they can experiment and adapt to different circumstances and events. Yet only a quarter of respondents said they strongly agree their organisation has a safe to fail culture, compared to half of Risk Pioneers.

    Organisations will need to recognise the whole organisation has a role to play in navigating risk, from increasing collaboration internally and externally across supply chains and ecosystems, to challenging their risk appetite and collectively building resilience. This presents the opportunity for a new role for risk teams where there will be a more strategic use for their insights and experience.

    Are you ready to change the way you see risk? The key questions leaders must answer first

    The journey to taking risk more intelligently—powered by technology and through the lens of reinvention, opportunity and growth—requires leaders to start with these four key questions:

    1. Are you clear on how GenAI will disrupt your sector and do you have a plan to ensure your organisation emerges as one of the winners? 
    2. Do you have sight of the threats on the horizon? Using this insight, do you have alignment between the risks you need to take to create business value and the practical measures you have in place to respond to shocks and surprises and mitigate risk?
    3. Have you invested appropriately in building your organisation's resilience to disruption, removing critical points of failure and developing your capabilities to swifty respond to risk events as they occur? 
    4. Does technology underpin how you assess, manage and take risk, or are you still using manual approaches and spreadsheets? 

    Organisations can no longer afford to rely on a reactive approach to risk that focuses primarily on avoidance. Nearly 40% of CEOs respondents think their company will no longer be economically viable a decade from now if it continues on its current path. From climate and geopolitical risk to macroeconomic volatility and the disruptive power of technology, organisations must change and reframe the way they see risk to build resilience and unlock opportunity. 

    The ability to adapt, change and reinvent at pace amid this constant change and uncertainty is vital for survival and sustainable growth. Harnessing the power of technology and data in new ways, combined with building more diverse multi-disciplinary capabilities across the organisation, will be critical to turning risk into that enabler of change and growth.

    Take PwC’s Global Risk Survey 2023 with you

    Sign up to get the full report of how Risk Pioneers are leading the way and building resilience—and five ways you can follow

    About the survey

    The PwC Global Risk Survey 2023 is based on 3,910 responses from business and risk management leaders (CEO, board, risk management, operations, technology, finance, audit) across 67 territories providing their views on the status and direction of risk in their organisation.

    Survey responses are from a range of industry sectors and organisation sizes, with over a quarter from USD$5bn+ organisations.

    PwC Research, PwC’s global Centre of Excellence for market research and insight, conducted this survey.

    Contact us

    Oktay Aktolun

    Oktay Aktolun

    Risk Assurance Services Leader, PwC Türkiye

    Tel: +90 212 326 6468

    Evren Sezer

    Evren Sezer

    Risk Assurance Services Partner, PwC Türkiye

    Tel: +90 212 326 6468

    Tuğçe Aydoğan

    Tuğçe Aydoğan

    Risk Assurance Services, Director, PwC Türkiye

    Tel: +90 312 457 4501

    Follow us