Deloitte’s Global risk management survey, 10th edition assesses the industry’s risk management practices and the challenges it faces in this turbulent period. It includes responses from 77 financial services institutions around the world. This 10th edition survey assesses the industry’s risk management practices and the challenges it faces in this turbulent period. It includes responses from 77 financial services institutions around the world that conduct business in a range of financial sections and with aggregate assets of US$13.6 trillion. The survey findings are based on the responses of 77 financial institutions from around the world and across multiple financial services sectors, representing a total of $13.6 trillion in aggregate assets. In today’s financial services environment risk management is becoming more important than ever; financial institutions confront a variety of trends that have introduced greater uncertainty than ever before into the future direction of the business and regulatory environment. http://deloi.tt/2Dg1Zg0

1. Insights from the
Global Risk
Management Survey,
10th Edition
Heightened uncertainty signals
new challenges ahead
Evolution of risk management and the role of the CRO
Over the 20 years that Deloitte has conducted its Global risk
management survey series, regulatory requirements and
expectations for risk management have broadened to cover
a wider range of issues and also become more stringent. Risk
management programs have become almost universally adopted,
and many have expanded capabilities. Boards of directors are
more involved in risk management and more institutions
employ a senior-level CRO position.
​While many organizations continue to enhance their risk management practices worldwide, this year’s survey revealed
that leaders are focused on the regulatory impact of recent geopolitical shifts and questioning what’s coming next.
Key findings
The rapidly changing environment suggests that risk
management programs may need to increase their ability
to anticipate and respond flexibly to new regulatory
and business developments and to emerging risks, for
example, by employing predictive analytics tools.
Cyber Risk is the risk rated most likely to
increase in importance over next two years
Newer and less mature risk types are the
most challenging to manage
ERM programs have become prevalent
In 2016,
73%of
the institutions
surveyed reported
an ERM program
in place
up from
69%
in 2014
and
double of
just 35%
in 2006
CRO role has increased in seniority with more senior
reporting structure
In 2016,
75%of
respondents
said that the CRO
reports to the
CEO
In 2016,
52%of
respondents said
the CRO directly
reported to
the Board of
Directors
up from
32%
in 2002
up from
32%
in 2002
Board Risk Committee use more widespread
In 2016,
63%of
the institutions
surveyed
up from
51%
in 2014
and
43%
in 2012
CRO position has become nearly universal
In 2016,
92%of
institutions
surveyed had
a CRO
up from
65%
in 2002
41%
consider Cyber Risk
amongst the top three
risk types for the
institution over the
next two years
Cyber
attacks
have increased
by 50%1
in the
second quarter of 2016
compared to the second
quarter of 2015
Only 27%rated their
institution effective in
managing cyber-security risk
from third party relationships
Top issues in managing Cyber Risk cited as extremely or very
challenging included:
• Hiring or acquiring skilled talent (58%)
• Getting actionable, real-time threat intelligence (57%)
Cybersecurity
Regulatory compliance
Credit
Strategic
Operational
41%
36%
32%
32%
26%
Risk types that respondents thought would most increase
in importance in the next two years
Risk systems and IT
Spiraling costs of compliance
79%
of respondents said that
regulatory reform had
resulted in an increased
cost of compliance, of which
59%
of respondents were
extremely or very concerned
about growing costs of doing
business due to tighter
standards or regulations
56%
were concerned about
growing costs of
required documentation
and evidence of program
compliance
Two issues frequently cited as extremely or
very high in priority for risk management programs
over the next two years concerned IT and data and included:
1. Enhancing risk information
systems and technology
infrastructure (cited by
78%)
2. Enhancing the quality,
availability and timeliness
of risk data (cited by
72%)
of the respondents said
that it is extremely or
very challenging to
define risk appetite for
newer risk types such as
reputational risk (49%),
strategic risk (48%),
model risk (48%), and
cybersecurity risk (46%)
Over 46%
of the respondents rated
their institution highly at
managing model risk
Only 40%
Only
37%
of the respondents rated
their institution highly at
managing third party risk
of the respondents rated
their institution highly at
managing data integrity risk
Only
32%
of the respondents rated
their institution highly at
managing geopolitical risk
Only
28%
1. ThreatMetrix, Cybercrime report, Q2, 2016; Maria Korolov, “Banks get attacked four times more than other industries,” CSO, June 23, 2015
Edward Hida
Partner | Deloitte Risk and Financial Advisory
Deloitte & Touche LLP
+1 212 436 4854 | ehida@deloitte.com
About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its
network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent
entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one
or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their
respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting.
Please see www.deloitte.com/about to learn more about our global network of member firms.
Copyright © 2017 Deloitte Development LLC. All rights reserved. | DUPress.com