Top Business Risks for 2023 - by Rajeswar
Top Business Risk Areas for 2023
The overall risk landscape of the past few years has proven complex, but the resilience shown by businesses is remarkable. The plans developed, implemented, and executed during the pandemic and in its wake are now far more resilient. However, 2023 will carry several risks requiring plenty of preparation and proactive and reactive threat management. "Rethinking resilience is a key theme that underlies a diverse set of risks facing organizations in 2023," said Leslee McKnight of Gartner. The research or survey-based reports on 2023 risks from Gartner, ECIIA, Audit Board, Big 4 audit firms, etc., are cited.
Cybersecurity, IT governance, and data security will be the number one risk in 2023. Ransomware has been a significant threat in 2022, but the nature of cyberattacks is changing. Relatively new hackers now take advantage of sophisticated ransomware as an opportunity. More ominously, "killware" attacks targeting critical infrastructure and threatening lives are prevalent. Cyber and data breaches impact the quality and availability of products and services, trustworthiness and reputation, and financial stability and existence. Hackers seek entry via their less protected third-party suppliers or cloud-enabled systems. IT governance is essential for digital capability and for protecting data assets.
Human capital, diversity, and talent management is the second-highest business risk. The succession challenges and ability to recruit and retain top talent in the tightening market may limit the ability to achieve business goals. The pandemic has accelerated skills shortages with hard-to-fill gaps for crucial projects, such as digitalization – a process to alleviate such deficiencies in the future. Businesses must tackle wage inflation, skill shortages, and the need to offer better psychological support to staff. That entails retooling their organizational culture
ESG (Environmental, Social, and Governance) reporting is in its infancy, but the requirements will be broader and all-encompassing. Therefore, a lack of preparedness could be a threat. Organizations should ensure governance structures to provide reliable information on ESG risks and opportunities. Define ESG disclosures and metrics and identify the data to be captured and curated to comply with local ESG regulations on time.
Knowing threats or risks is only one part of the story. What is important is how to mitigate the same for successful business conduct and sustainability.
Assess key risk areas for the circumstances likely to arise in 2023 and ensure that governance, risk management, and control efforts are coupled to risks.
Focus on systemic risks that create vulnerabilities and ensure risk management provides oversight of such risks. Systemic risk is the risk that a company- or industry-level risk could trigger a huge collapse. Systemic risk is harder to quantify and harder to predict. Management's risk appetite should be updated to provide clarity in decision-making.
Monitor whether an effective and timely mechanism exists to spread information on new cyber threats, countermeasures, and advice throughout the business. Ensure cyber and data controls and policies, including access rights, are correctly implemented, and facilitate breach simulation and tabletop exercises to strengthen defenses and remediation measures. With adequate insurance protection difficult to quantify or purchase, businesses must do all they can to mitigate such risks with their own resources.
Evaluating whether human resource strategies align with the business plans and whether they are suitable when attracting and retaining employees. Assess workforce planning and future skill demand, talent acquisition, and retention strategies. These should include succession planning, capability management, remuneration benchmarking, well-being programs, and training and development. Develop talent metrics that are consistent with relevant business risks.
Understand ESG risks, and support the design and development of robust governance frameworks and control environments.
Risk mitigation plans should be flexible and adaptable and able to dynamically meet the organization's essential needs and solutions. These guidelines are no longer a luxury but necessary If an organization wants to survive and grow.
*******************
Sundaresan Rajeswar
Board Member, Contact Person, Chief Advisor & Past President
Member of Global Advocacy Advisory 2021-25
Global Internal Audit Beacon Award 2022
DOHA CHAPTER
'(+974)-44621384 /È (+974)-55549296
P. O. Box: 570, Doha, Qatar
https://institutes.theiia.org/sites/qatar