Risk experts gird for a potentially tumultuous 2023

One risk they see receding in prominence: the pandemic.

“There’s a general acceptance of ‘This is now the world where we live,’" said Kevin Bates, the group head of risk and insurance for Sydney-based real-estate company Lendlease and a board member of risk management association RIMS. “And I think that’s a positive thing."

Covid-related risk is the only major concern executives rank as less troubling than in 2021, said Jim DeLoach, managing director at the consulting firm Protiviti. The firm in December released the results of a survey of more than 1,300 C-suite executives and board members on their perspectives on risks, a study conducted with North Carolina State University.

Though Covid was seen as less worrisome than before, respondents rated the overall severity and magnitude of risks at the highest level Protiviti has observed in the 11 years the survey has been conducted, and the economy ranked as the second highest risk.

“There are myriad factors contributing to uncertain economic conditions that significantly restrict growth [and] opportunity, and impact margins," Mr. DeLoach said. “That was weighing on our participants’ minds."

Geopolitical turmoil—including the war in Ukraine and simmering tensions between China and Taiwan—has increased concerns about supply-chain risks and raised questions about whether companies should bring some of their operations closer to home, Mr. DeLoach said.

The role of risk professionals has ballooned since the onset of the Covid pandemic prompted many organizations to better plan for potential perils. Many are bracing for an uncertain future, said Kristen Jaconi, an associate professor of accounting at the USC Marshall School of Business and director of its risk management program.

“In December of 2021, I wouldn’t have said we were going to have the highest rate of inflation in 40 years, I wouldn’t have said that we would have the Ukraine conflict or an energy crisis in Europe," she said. “I think a lot of people may be holding their breath and saying ‘What is next?’"

Many organizations are also looking to 2023 with an eye to a perennial worry: cybersecurity.

“It’s the one that never falls out of the No. 1 or No. 2 spots, because it represents just such a big financial and reputational impact for organizations," said Brian Stafford, chief executive of Diligent Corp. The risk and compliance software company recently surveyed more than 450 senior risk, compliance and other professionals on their top perceived risks.

“Work from home definitely showed up in a lot of our conversations as…a bigger risk in terms of security," Mr. Stafford said, referring to the potential difficulties in keeping data locked down with employees dispersed.

Diligent found nearly half of respondents said they had experienced a cyberattack or a breach of their organizations’ computer systems in the past 12 months.

Apart from the immediate fallout from attacks, organizations also face ever-growing requirements to ensure they disclose attacks. Some 70% of global economic output in 2023 will fall under some kind of data regulation, according to a risk report from insurance company Allianz SE.

Those regulations range from Europe’s General Data Protection Regulation to myriad U.S. rules and laws mandating cyber breach disclosure.

The proliferation of regulations and disclosure requirements aren’t limited to the cyber sphere—generally, companies face a growing regulatory burden, another top concern. Nearly three-quarters of risk professionals Diligent surveyed said they were concerned about meeting regulatory demands.

“It’s just an ever-growing list," Mr. Stafford said.

Climate change is among the areas with a surging list of related regulations. The Securities and Exchange Commission, for example, in 2022 announced plans to require publicly traded companies to begin disclosing their climate related risks along with their emissions. The SEC has estimated the proposed rules will raise businesses’ annual costs to comply with its disclosure requirements from $3.9 billion to $10.2 billion.

The additional disclosures also can provide more fuel for lawsuits. Climate-change-related litigation has begun proliferating around the world, according to Allianz’s report. Though about three-quarters of climate-change-related lawsuits were filed in the U.S. in 2021, the most recent year with complete data, cases were seen for the first time in Italy, Denmark and Papua New Guinea, Allianz said.

More than three-quarters of companies fear they won’t achieve their sustainability-related goals or meet regulator, investor and other stakeholder expectations, according to a study of 439 S&P 500 companies’ annual reports conducted by Deloitte and the Peter Arkley Institute for Risk Management at USC Marshall School of Business.

There are always, though, unknown unknowns, or at least, risks that aren’t currently top of mind but may be looming. USC Marshall’s Ms. Jaconi cautioned there are some inherent difficulties in any effort to look forward, including for risk professionals, because of the tendency to focus on the most noticeable risks.

In 2019, for example, few counted infectious disease as among their top concerns, but that changed in 2020 for obvious reasons. Hurricanes and wildfires can rank high on year-end risk surveys because they tend to occur near the time when surveys are distributed, Ms. Jaconi said.

“It’s the recency—what’s in their mind," she said. “Often we’re using this availability bias or this shortcut."

Being aware of that bias and involving multiple people in decision-making can help counter it, she added.

“Unfortunately, humans bring a lot of biases into their decision making, including decision-making about risk," Ms. Jaconi said. “Being aware of cognitive biases can be important."