Th

e f

utu

re

of r

isk

New

game, new

rulesdeloitte.com

2 The risk landscape is changing fast. Every day’s headlines bring new

rem

inders that the future is on its way,

and sometim

es it feels like new risks and

response strategies are around every corner. The outlines of new

opportunities and new

challenges for risk leaders—indeed, all organizational leaders—

are already visible.

So what should leaders prepare for?

This report profiles 10 trends that have the potential to significantly alter the risk landscape for com

panies around the w

orld and change how they respond

to and manage risk.

What you’ll see is that risk’s onset and

consequences, and the entire nature of the risk discipline, are evolving. The good new

s? The strategic conversation around risk is changing too. For leaders today, risk can be used as a tool to create value and achieve higher levels of perform

ance. It’s no longer som

ething to only fear, m

inimize, and avoid.

Explore the drivers, opportunities, threats, and real-w

orld examples for each trend.

And ask yourself: will your organization be

able to harness these trends to be even stronger, m

ore resilient?

Contact us to d

iscu

ss h

ow

yo

u c

an

be

tter p

re

pa

re

for w

ha

t’s a

he

ad

.

We

ca

n h

elp

yo

u id

en

tify w

ays fo

r y

ou

r o

rg

an

iza

tion

to m

an

ag

e r

isk,

cre

ate

va

lue

, an

d u

ltima

tely

po

we

r y

ou

r p

erfo

rm

an

ce

.

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

1 |

Co

gn

itiv

e t

ech

no

log

ies a

ug

me

nt

hu

ma

n d

ecis

ion

-ma

kin

g

Driven by developm

ents in artificial intelligence (AI) and easy access to huge am

ounts of data, smart system

s will assist,

and at times even replace, hum

an-led risk managem

ent.

Ho

w a

re

org

an

iza

tio

ns

’ re

sp

on

se

s t

o r

isk

ch

an

gin

g?

Ho

w a

re

co

nse

qu

en

ce

s o

f r

isk

fo

r o

rg

an

iza

tio

ns c

ha

ng

ing

?

Ho

w is

th

e o

nsla

ug

ht o

f r

isk

ch

an

gin

g?

6 |

Inn

ov

atio

n le

ad

s, r

eg

ula

tio

n f

ollo

ws

The marketplace w

ill reward organizations that take on

strategic, high-risk innovations—even if they fall outside the

scope of existing regulations.

2 |

Co

ntro

ls b

eco

me

pe

rv

asiv

e

In a sensor-enabled, hyper-connected environment,

organizations will deploy pervasive controls as part of their

products, services, and business models to m

onitor and m

anage risk in real time.

7 |

Ris

k b

eco

me

s a

pe

rfo

rm

an

ce

en

ab

ler

As risks become m

ore measurable and tangible,

organizations will be better able to determ

ine an accurate upside value for risk—

and encourage an appropriate level of risk-taking.

3 |

Be

ha

vio

ra

l scie

nce

info

rm

s r

isk

insig

hts

Advances in behavioral sciences will fuel efforts to

understand risk perceptions, influence risk behaviors, and im

prove risk-related decision-making.

8 |

Th

e n

etw

ork

ed

eco

no

my

de

ma

nd

s

co

llec

tiv

e r

isk

ma

na

ge

me

nt

As businesses engage more deeply w

ith a large number of

external stakeholders, including “crowds,” they w

ill rely more

heavily on them to identify, m

anage, and reduce risks together.

4 |

Vig

ilan

ce

an

d r

esilie

nce

co

mp

lem

en

t

pre

ve

ntio

n a

s le

ad

ing

pra

ctic

es

Organizations are realizing that 100 percent risk prevention

is not feasible, so investment in vigilance (detecting risk

events as they happen) and resilience (containing and reducing the im

pact of risk events) will increase.

9 |

Dis

ru

ptio

n d

om

ina

te

s t

he

ex

ecu

tiv

e a

ge

nd

a

The constant threat of disruption resulting from em

erging technologies, business m

odel transformations, and

ecosystem changes w

ill force executives to make significant

strategic choices to drive organizational success.

5 |

Ris

k t

ra

nsfe

r b

ro

ad

en

s in

sco

pe

an

d a

pp

lica

tio

n

Risk transfer instruments, such as insurance, contracts,

and novel financial instruments, w

ill increasingly be used by organizations to protect them

from a w

ider range of risks – cyberattacks, clim

ate change, geopolitical risks, terrorism,

business disruptions, and more.

10

| R

ep

uta

tio

n r

isk

s a

cce

lera

te

an

d a

mp

lify

To survive in a hyper-connected world dom

inated by m

obile devices, social media, and evolving expectations

from society, leaders w

ill proactively address accelerated, am

plified risks to their organizations’ reputations.

3

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Advancements in cognitive technologies, artificial intelligence, and data analytics are helping organizations go

be

yo

nd

tra

ditio

na

l wa

ys o

f ma

na

gin

g r

isk

s b

y u

sin

g s

ma

rt m

ach

ine

s to

de

tect, p

re

dic

t, a

nd

pre

ve

nt r

isk

s in

hig

h-

ris

k s

itua

tion

s. A

uto

no

mic

co

mp

utin

g c

om

bin

es a

uto

ma

tion

an

d c

og

nitiv

e te

ch

no

log

ies to

ma

ke

syste

ms s

elf-

ma

na

gin

g—

an

d p

ote

ntia

lly s

elf-d

efe

nd

ing

an

d s

elf-h

ea

ling

ag

ain

st r

isk

s.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Massive grow

th in the volume of data

available to organizations

Emergence of new

and advanced AI-based algorithm

s

Expanding pool of data science talent

Adoption of behavioral analytics* in risk m

anagement

* Behavioral analytics is the tracking, collection, and assessm

ent of user data and activities using monitoring

systems to understand interactions and dynam

ics betw

een different elements.

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Identify use cases that are well-suited for

cognitive technology solutions: Where the

risk area is critical, large amounts of data are

available, and current solutions aren’t effective

•Use visualization to analyze and com

municate

information in a hum

an-friendly way to enable

rational decision-making

•Upskill em

ployees so that they are able to m

ore effectively use cognitive technologies to extract insights from

data

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Diffi

culty in implem

enting complex

cognitive tools •O

verhyped technologies unable to deliver on prom

ises •Lack of trust and assurance m

echanisms for AI

•Inability to source the right data •H

uman backlash against autom

ated decision-m

aking •U

nintended consequences of m

istaken predictions

Cognitive technologies augment

human decision-m

aking

Warw

ick Analytics’ early warning and

prevention system looks hours, days, and

months ahead to try to predict w

hen and how

products in the field (such as aircraft and vehicles) w

ill require maintenance.

Identifying the root causes of failure helps engineers take corrective action, such as rem

anufacturing and redesigning products. Econom

ic benefits can include enhanced effi

ciency of plant or production line, reduced energy bills, and increased product life cycle. 1

Hong Kong-based venture capital firm

D

eep Knowledge Ventures has appointed

a software algorithm

, “VITAL,” to its Board of D

irectors. Just like other mem

bers of the board, VITAL gets to vote on w

hether the firm

should make an investm

ent in a specific com

pany or not. It makes its decisions by

scanning prospective companies’ financing,

clinical trials, intellectual property, and previous funding rounds. 2

Nexgate is a provider of D

eep Social Linguistic Analysis (D

SLA) technology and natural language processing (N

LP) based social m

edia risk managem

ent tools. Its m

ajor solutions scan social networks to try to

discover and track an organization’s accounts; detect fraudulent social m

edia accounts, unauthorized changes, and anom

alous behavior on social account profiles; reduce potential liability from

inadvertent posting of sensitive data; and dem

onstrate com

pliance with m

ore than 35 standards and industry regulations. 3

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

4

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

5

Sm

art d

evic

es (a

lso

kn

ow

n a

s th

e In

tern

et o

f Th

ing

s) e

qu

ipp

ed

with

a v

arie

ty o

f se

nso

rs, c

om

mu

nic

atio

ns, a

nd

co

mp

utin

g c

ap

ab

ilities s

erve

as r

isk m

on

itorin

g a

nd

en

force

me

nt p

oin

ts. T

his

pre

se

nts a

n o

pp

ortu

nit

y fo

r

org

an

iza

tion

s to

de

tect r

isk e

ve

nts, d

eriv

e c

ru

cia

l ris

k in

sig

hts, a

nd

eve

n t

ake

imm

ed

iate

actio

ns in

the

en

vir

on

me

nt.

Th

e r

esu

lt? R

ea

l-time

, pe

rva

siv

e, d

yn

am

ic r

isk m

an

ag

em

en

t.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Declining cost, decreasing size, and

increasing connectivity of sensors

Increasing investments in the

Internet of Things

Grow

ing adoption of workplace w

earables

Advancements in sensor technology

Advancements in analytics

Businesses operating as netw

orked ecosystems

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Enhance operations and improve risk-related

decision-making by integrating pervasive risk

controls in areas such as internal audit, supply chain m

anagement, finance, cybersecurity,

and controls testing

•Reduce cyber security and fraud risk by using sensor-enabled devices to im

plement context-

aware identity access capabilities

•Improve traceability across the supply chain,

especially in security-sensitive industries such as food production and pharm

aceuticals

•Automate com

pliance monitoring and

reporting by embedding risk controls into

business technologies

•Manage risks introduced by custom

ers by analyzing custom

er behavior through real-tim

e data feeds

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Heightened exposure to cyber risks as

business processes rely more heavily on the

Internet of Things

•Greater availability of data revealing risks in

areas that were form

erly considered safe, resulting in new

obligations to manage those

risks or increased liability

•Rising privacy concerns from em

ployees, custom

ers, and business partners because of pervasive m

onitoring

•Increased difficulty of filtering relevant

information from

the noise, given the vast am

ount of data generated

Controls become pervasive

Saia, a US-based freight com

pany, has worked

with Intel to deploy sensors into its truck fleet

to track maintenance needs, driver safety,

fuel usage, and other metrics in real tim

e. Through real-tim

e process intelligence, this initiative has led to a 6 percent increase in fuel effi

ciency, which translated to $15 m

illion in savings for Saia. In addition to achieving cost savings, Saia has been able to track m

aintenance needs, driver safety, and fuel usage, as w

ell as other metrics, in real tim

e. 4

Fujitsu has developed wearable tags that

can detect whether users have changed

location or posture, have fallen down, or are

experiencing high heat. With the help of these

tags, employers can—

in real time—

monitor

employees’ w

orking conditions or detect if they are carrying a heavy load or standing in a place w

here they might fall. The aim

is to reduce the risks of injury at the w

orkplace. 5

Singapore-based TrustSphere, whose clients

include financial services firms, specializes

in trying to uncover the relationships that an em

ployee has through digital interactions—attem

pting to reduce the risks of illegal collusion and internal fraud. 6

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Behavioral science is the study of human behavior through system

atic research and scientific methods, draw

ing fr

om

psych

olo

gy, n

eu

ro

scie

nce

, co

gn

itive

scie

nce

, an

d th

e s

ocia

l scie

nce

s. T

he

re

is in

cre

asin

g d

em

an

d fo

r th

ese

sk

ills

in th

e b

usin

ess w

orld

—in

clu

din

g r

isk o

rg

an

iza

tion

s. W

ha

t driv

es r

isk

y b

eh

avio

r? H

ow

do

co

gn

itive

bia

se

s le

ad

pe

op

le

to wrongly assess risk? H

ow can risky behaviors be detected and m

odified? These are the types of questions leading o

rg

an

iza

tion

s a

re

loo

kin

g to

an

sw

er w

ith b

eh

avio

ra

l scie

nce

. In fa

ct, s

om

e F

ortu

ne

50

0 c

om

pa

nie

s to

da

y e

ve

n h

ave

a

Chief Behavioral Offi

cer at the C-suite level.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Increasing interdisciplinary research across fields such as cognitive science, psychology, econom

ics, and neuroscience

Renewed interest in m

aking technology products intuitive for usage

Grow

ing popularity of behavioral econom

ics to inform decision-m

aking

Early successes in comm

ercializing gam

ification

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•“Design interventions” to help executives

overcome the influence of cognitive biases in

decision-making

•Improved system

s for monitoring high-risk

individuals in sensitive roles

•More effective risk, forensics, and financial

transaction-related business processes

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Risk of regulatory action in case of perceived m

isuse of behavioral interventions

•Backlash from em

ployees and executives w

ho see behavioral interventions as an im

pingement of free w

ill

•Slow (or no) return on investm

ents in organizing com

plex behavioral interventions

Behavioral science informs risk insights

Fujitsu has built a platform that uses

psychological profiling to ramp up com

puter security in the w

orkplace. This enterprise tool aim

s to identify workers w

ho are most

vulnerable to cyberattacks and also gives advice on how

to sidestep them, based

on their behavior while checking and

sending emails, and brow

sing the web.

This was developed after consulting social

psychology experts and surveying more

than 2,000 Japanese users, half of whom

had experienced attacks, to determ

ine which

traits make som

e users more vulnerable

to viruses, scams, and data leaks. 7

Mi3 Security (form

erly MetaIntell), a cloud-

based mobile risk m

anagement com

pany, recently brought onboard a behavioral science expert as a technical solutions and business advisor in the offi

ce of the CEO. 8

Hand hygiene com

pany DebM

ed offers an electronic hand hygiene com

pliance m

onitoring system that seeks to m

easure the com

pliance level of an entire unit instead of individual perform

ance. It predicts expected hand hygiene opportunities by taking into account unique conditions of each hospital unit, such as census and nurse-to-patient ratio. This aim

s to promote a spirit of

collaboration and accountability while also

providing actionable feedback for the group w

ithout singling out individuals. 9

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

6

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Ris

k p

re

ve

ntio

n m

eth

od

s c

an

ne

ve

r b

e fo

olp

ro

of, a

nd

incre

asin

g in

ve

stm

en

t in p

re

ve

nta

tive

ap

pro

ach

es o

fte

n y

ield

s

only marginal benefit along w

ith unwelcom

e side effects such as slow

ing innovation. Organizations are expanding

the

ir a

pp

ro

ach

es to

focu

s o

n v

igila

nce

(de

tectin

g p

atte

rn

s th

at m

ay in

dic

ate

or e

ve

n p

re

dic

t ris

k e

ve

nts) a

nd

resilience (the capacity to rapidly contain and reduce the impact of risk events) as w

ell. We can expect activities like

the

se

to r

ise

in im

po

rta

nce

: mo

nito

rin

g e

me

rg

ing

thre

ats, id

en

tifyin

g a

no

ma

lies in

bu

sin

ess p

ro

ce

sse

s, m

an

ag

ing

sto

pp

ag

es fr

om

thir

d-p

arty v

en

do

rs, a

nd

pre

pa

rin

g fo

r r

isk-r

ela

ted

wo

rk

pla

ce

dis

ru

ptio

ns.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Grow

ing recognition of inability to elim

inate risks altogether

Rapid advancements in data analytics,

machine learning, and AI capabilities

Greater sharing of inform

ation among

organizations as a result of the netw

orked economy

Rising threat of nation states investing significant resources into disruptive activities

Rise in macro risks such as clim

ate change, natural disasters, political unrest, and m

ore

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Assess and prioritize risks to determine w

here to invest in vigilance and resilience

•Identify and test cutting-edge, comm

ercially available tools focused on vigilance and resilience

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Inability to detect significant threats due to lack of data, tools, or expertise

•Ineffective resilience efforts due to com

plex interdependent operating structures or lack of agility

Vigilance and resilience complem

ent prevention as leading practices

Cytora aims to provide real-tim

e structured data on supply chain, operational, and geographic disruptions across m

ultiple categories of risk, including factory fires and explosions, labor strikes, terrorism

incidents, industrial accidents, and natural disasters for supply chain risk and corporate risk m

anagement. Alerts received w

ithin five m

inutes of an event breaking online seek to give organizations the opportunity to try to m

itigate risks early and keep costs low. 10

Verafin focuses on providing solutions in the fraud detection and anti-m

oney laundering space based on AI-enabled algorithm

s and a m

ore holistic view of banking transactions

with diverse data points. Its latest product

strives to enable cross-institutional analysis to detect suspicious activity across m

ultiple institutions. 11

Zeean, an open source project, taps the crow

d to map the flow

of materials across

the world. U

sing this database, Zeean then attem

pts to help organizations analyze the econom

ic impact of isolated events

(for example, clim

atic catastrophes) on global supply chains through pow

erful visualizations, w

orking to help organizations and governm

ents achieve supply chain resilience in a cost-effective m

anner. 12

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

7

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Risk transfer instruments such as insurance and contracts aren’t new

, but expect them to play a bigger role

in the face of “mega-im

pact” risk events like climate change, political unrest, terrorism

, and cyberattacks. In the past, few

considered hedging against such risks. Soon, it may becom

e comm

onplace as comm

ercial third-party insurance, risk-sharing agreem

ents, captive in-house insurance, and other tools continue their ascent. Financial industry innovation is also generating novel financial instrum

ents that transfer and monetize risk.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Grow

ing instances of “mega-im

pact” events such as cyberattacks, political unrest, and clim

ate change—and their

growing financial and reputational im

pact

Increasing globalization and the rise of a netw

orked economy leading to

cascading risks

Persistent inability of organizations to com

pletely eliminate risks through

preventive controls

Rising cost pressure on organizations to look for cost-effective w

ays to transfer risks

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Evaluate risk transfer instruments as an

option to achieve business continuity and m

ore predictable performance

•Establish risk-sensing mechanism

s to identify em

erging risks and determine if instrum

ents could be used effectively to transfer key risks

•Develop clear and stringent risk-sharing

clauses in all partner contracts, and consider collective insurance w

ith partners to address shared risks

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Potential for conflict, litigation, and disputes w

ith customers, partners, and suppliers over

risk-sharing agreements

•Inability to determine the appropriate

insurance premium

for various risks

•Becoming “over-insured” or purchasing

insurance in noncritical areas

Risk transfer broadens in scope and application

Some of the largest m

edical device m

anufacturers like Boston Scientific, M

edtronic, and St. Jude Medical are

negotiating experimental deals w

ith hospitals to take on perform

ance-based financial risk for their im

plants. Such risk-sharing agreem

ents are structured in a variety of w

ays. Some agreem

ents may stipulate that

the manufacturer return a percentage of

the device’s price if it does not meet certain

performance goals or fails w

ithin a set period of tim

e. Under other agreem

ents, a hospital pays m

ore for a device that fulfills a m

anufacturer’s quality and economic claim

s. 13

Willis SECU

RENET aim

s to assist organizations facing terrorism

risks, and those that are penalized by exorbitant rates of terrorism

insurance, with the

development of captive insurance entities.

It can help them in every stage of captive

formation, including feasibility analysis,

domicile selection, developm

ent of underw

riting parameters, and

maintaining com

munication w

ith state insurance departm

ents. 14

BitSight Security Ratings seeks to provide objective, data-driven, daily ratings of an organization’s security perform

ance through continuous m

onitoring. It works to help

insurers look at historical data, compare an

organization against industry peers, and m

ake informed underw

riting decisions. It also helps identify and alert applicants of potential threats in their netw

orks. This aims to enable

insurers to get insight into past and current cybersecurity risk levels. 15

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

8

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

9

As the pace of innovation quickens across diverse industry sectors, it is becoming m

ore difficult for

re

gu

latio

ns to

ke

ep

up

. Me

an

wh

ile, m

an

y b

usin

esse

s a

nd

oth

er o

rg

an

iza

tion

s a

re

ta

kin

g o

n h

igh

-ris

k

innovations as a strategy—even w

hen they fall outside the scope of existing regulations—and reaping

the

re

wa

rd

s. In

cre

asin

gly

, the

ra

pid

pa

ce

of in

no

va

tion

is d

riv

ing

the

re

gu

lato

ry a

ge

nd

a.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Rapid pace of proliferation of innovations

Grow

ing adoption of new business m

odels, such as sharing-based, freem

ium, and

subscription-based, leading to increased diversity of com

petitors

Industry convergence and blurring of m

arket boundaries

Deliberate restraint on the part of

regulators in order to allow innovations

to gain steam

Grow

ing consumer activism

and em

powerm

ent

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Reduce regulatory risks by educating regulators and harnessing custom

er and public support

•Work w

ith the industry ecosystem to establish

self-regulatory framew

orks

•Clarify the organization’s risk appetite when

evaluating projects that lie outside the realm of

current regulations

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Losses due to investments in projects that

operate in legal gray areas that subsequently becom

e prohibited

•Fast-moving disruptive organizations can

rapidly gain market share from

incumbents

before regulations are even put in place

•Negative publicity from

lobbying efforts against disruptive startups

Innovation leads, regulation follows

Companies such as G

oogle are investing in building autonom

ous cars ahead of a regulatory fram

ework, driving regulators to

strategically balance their priorities around prom

oting innovation and ensuring public safety. 16

Sharing economy-based businesses, such

as Airbnb and Uber, are grow

ing rapidly by breaking aw

ay from traditional industry

norms and established assum

ptions built into regulations. 17

Telemedicine, provided by com

panies such as Teladoc, enables doctors to offer prim

ary care services over videoconference. W

hile telem

edicine has been heralded as a way to

increase health care access, it has required the renegotiation of relationships betw

een insurers, physicians, and regulators, w

ith many states not allow

ing reim

bursements for video visits despite

a shortage of doctors. 18

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

In the past, risk managem

ent was often an exercise in fear and avoidance, w

ith organizations focused primarily on

completing necessary, com

pliance-driven activities. But that’s changing. Many leaders are now

viewing risks in term

s of their potential to drive perform

ance and value. As risks become m

ore measurable and tangible, organizations w

ill be better able to determ

ine an accurate upside value for risk—and encourage a desired level of risk-taking behavior

in a bid to balance risks and rewards.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Focus on innovation and experimentation

is creating a culture in which failure is

being viewed as a necessary step to

success rather than something to be

avoided at all costs

Analytics capabilities are helping leaders link risk to perform

ance

New

workplace technologies such as

wearables, im

age recognition, and AI are im

proving risk sensing and m

onitoring capabilities

Disruptive new

business models are

driving the need for increased risk-taking

Decentralization is creating flat

organizations where em

ployees are em

powered and rew

arded for taking on risks them

selves

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Use risk dashboards, visualizations, and

scenario analysis to empow

er leaders with

data to make risk-inform

ed decisions

•Recognize and reward intelligent

risk-taking

•Foster a risk-intelligent culture and em

power em

ployees at every level to take on inform

ed risks

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Exposure to risks beyond desired risk appetite

•Potential reputation damage and regulatory

actions as a result of taking on excessive risk

•Inability to correlate performance w

ith risk due to lack of appropriate tools

Risk becomes a perform

ance enabler

Adobe’s Kickbox Innovation Workshop

encourages innovation and risk-taking by providing the participating em

ployees with

seed money ($1,000 prepaid credit card),

a step-by-step startup guide, and a 45-day period to experim

ent with and

validate new ideas. 19

Chief Financial Offi

cers are using risk dashboards for driving strategic decision-m

aking, such as weighing M

&A possibilities,

developing new product lines, planning

market entry strategy, and deciding on capital

allocation. 20

Advertising agency Grey gives out the H

eroic Failure Aw

ard that honors new, unproven

ideas that were failures in the m

arket, thus rew

arding and encouraging risk-taking among

employees. 21

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

10

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Businesses and other organizations are more connected to one another, and “crow

ds,” than ever before. They share data, technology, and m

uch more. As a result, they also share m

ore risks. Increasingly, they are managing risk in a m

anner that reflects this new

reality—transform

ing their risk processes through more open, collaborative approaches that rise to the

challenges of a networked econom

y and working to identify, m

anage, and reduce risk together.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Businesses operating as networked

ecosystems are leading to m

ore dependence on external stakeholders

Crowd-driven and sharing-based initiatives

are gaining more acceptance am

ong stakeholders such as custom

ers, em

ployees, business partners, vendors, and suppliers—

leading to new collaborative

business models

Governm

ents and organizations alike are m

oving toward radical transparency

The increasingly ratings-driven culture m

eans that sellers, customers, and

products are all reviewed w

ith increasing frequency—

supplying businesses with data

for risk analysis

Globally distributed business m

odels leave brands m

ore vulnerable to physical and virtual risks around the w

orld

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Use collaborative practices like gam

ified crow

dsourcing to reduce the cost of risk m

anagement and im

prove its effectiveness

•Form alliances w

ith risk experts, researchers, and academ

ia to stay abreast of the latest threats and m

itigation approaches

•Adopt an ecosystem-led approach for risk

managem

ent by forming industryw

ide partnerships and consortium

s

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Potential for incurring legal costs, regulatory action, and reputation dam

age if sensitive inform

ation is leaked through partners or data-sharing portals

•Results may be m

anipulated if bad actors deliberately feed inaccurate data to skew

the models

The networked econom

y demands

collective risk managem

ent

United Airlines is seeking to harness the pow

er of the crow

d to improve security of its softw

are through a “bug bounty” program

that will aw

ard m

iles to people for finding vulnerabilities. With

this program, the com

pany is following the

steps of technology corporations like Google,

Facebook, and Microsoft, w

hich have their own

bug bounty programs. These program

s engage independent researchers, experts, and hackers to find potentially dangerous security flaw

s for a reward. 22

ThreatExchange, a social data exchange platform

by Facebook, is being used by security professionals and researchers across the w

orld to share cyber threat inform

ation. 23

Wikistrat, the crow

dsourced consulting organization, uses interactive role-playing gam

es that leverage a crowd of experts from

all over the w

orld for strategic forecasting. W

ikistrat’s open source platform provides

access to vetted crowdsourced expertise to

address complex client issues and risks and to

develop effective action plans. 24

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

11

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Business leaders are increasingly focusing on risks that threaten to disrupt the fundamental assum

ptions of their organization’s strategies. Prioritizing such risks has becom

e increasingly crucial—these risks cannot be handled in typical

organizational silos, and they can destroy sources of value creation for the business. Yet, they also have the potential to form

the basis of game-changing m

oves for an organization, if handled well. D

isruptions in the forms of em

erging technologies, business m

odel transformations, and ecosystem

changes will force executives to m

ake significant strategic choices to drive organizational success.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Globally distributed business m

odels are increasing dependencies on stakeholders across geographies, m

aking brands more

vulnerable to geopolitical risks

Grow

ing connections between

businesses are expanding the sources of potential disruption

Advancements in social, m

obile, analytics, and cloud-enabled em

erging technologies are creating opportunities for startups to disrupt incum

bents

Traditional industries are converging to create new

markets

Business model innovation (such as

sharing-based, freemium

, and subscription-based) is driving organizations to constantly reinvent them

selves

Customers are increasingly expecting m

ore personalized products and services

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Continuously monitor the changes in

the environment to determ

ine which could

be truly disruptive

•Revisit the approach to corporate strategy developm

ent to introduce more agility,

adaptability, and responsiveness to em

erging threats

•Identify organizational blind spots, built-in institutional challenges, and personal biases of senior m

anagement that can get in the

way of action

•Employ tools and techniques such as

real-time m

onitoring, scenario planning, stress testing, w

ar-gaming, and sim

ulations to drive higher levels of sophistication in m

anaging risk

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•New

startups and cross-industry players can catch organizations off-guard if they don’t have strategic threat m

onitoring and identification m

echanisms in place

•Senior managem

ent can become

overwhelm

ed by the sheer volume of com

plex, real-tim

e data, leading to ambiguity and

indecision

•Innovation can be stifled by the organization’s core business assum

ptions or structural lim

itations

Disruption dom

inates the executive agenda

Media com

panies such as HBO

that were

under the threat of disruption by online stream

ing players have now reinvented their

strategies by adapting to the fast-changing business environm

ent. They have embraced

online streaming and have introduced a host

of related offerings, thus posing competition

to existing streaming content providers. 25

3D printing is transform

ing the health care sector, w

ith many incum

bents adopting 3D

printing for manufacturing m

edical implants,

dental products, and bio-printed tissues.

To counter the growing threat of car sharing

companies like Zipcar, G

erman autom

aker D

aimler has launched its ow

n car sharing service called car2go. Through car2go, D

aimler aim

s to disrupt the disruptors like Zipcar not by copying their business m

odels but by creating its own unique value

proposition – a “roving” model in w

hich its cars have no fixed spaces and can be parked anyw

here to end a trip. 26

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

12

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

13

In today’s hyper-connected world dom

inated by mobile devices, social m

edia, and evolving expectations from society,

information can spread like w

ildfire. This convergence of mobile and social m

edia is intensifying the impact of reputation

risks for organizations and is driving them to fundam

entally rethink their approaches to risk managem

ent and proactively address these accelerated, am

plified risks.

Wh

at f

orce

s a

re

driv

ing

th

is t

re

nd

?

Social media is creating a m

ore connected, netw

orked world w

here information is

rapidly amplified

Disruptive m

obile technologies are ushering in a new

era of hyper-availability in w

hich people are always available

and connected

An upsurge of socially conscious consum

ers, and growing consum

er activism

, is putting pressure on businesses to be socially responsible and transparent

New

multichannel m

arketing strategies built on social platform

s allow for greater

interactivity for consumers and less

control for brands

Globally distributed business m

odels are increasingly dependent on third parties and other stakeholders

Wh

at a

re

th

e o

pp

ortu

nit

ies?

•Develop new

capabilities for proactive brand-related crisis m

anagement

•Continually scan media sources w

ith technology-enabled intelligence capabilities to m

onitor reputation risk

•Initiate targeted campaigns and develop an

external ambassador program

to nurture external brand advocates

•Foster a more risk-intelligent culture w

ith tools, resources, and training opportunities to help em

ployees see the reputation implications of

their actions

Wh

at a

re

po

te

ntia

l th

re

ats a

nd

pit

fa

lls?

•Personal online activity of employees

can cause reputational damage to

the organization

•Organizations m

ay be forced to respond to risk events in haste w

ithout fully investigating the situation

Reputation risks accelerate and amplify

A media conglom

erate fired its head of com

munications for an offensive personal

social media post—

which w

ent viral in a m

atter of hours—in an effort to prevent

further damage to its reputation.

Websites like Ripoff Report and Scam

book offer online platform

s for consumers to

post complaints. Ripoff Report receives

more than a m

illion visits a week and

generates several million dollars of revenues

a year from firm

s that pay to resolve custom

er complaints. 27

Food safety incidents can cause significant reputation loss and revenue im

pact for food and beverage com

panies. The impact on a

company’s reputation is often intensified due

to the negative attention received through social m

edia channels. Brands that are not prepared to respond to crisis face further scrutiny for m

oving too slowly

when incidents occur.

Wh

ere

is t

his

tre

nd

alr

ea

dy

in p

lay

?

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

14

Na

nc

y A

lbin

so

n

Ma

na

gin

g D

ire

cto

r

De

loit

te

& T

ou

ch

e L

LP

nalbinson@deloitte.com

+1 973 602 4523

Nancy is a m

anaging director at Deloitte &

Touche LLP and leads D

eloitte Advisory’s Innovation Program.  She

guides the business in establishing innovation strategies, identifying em

erging client needs, overseeing a portfolio of strategic investm

ents from validation to com

mercialization,

and building a culture of innovation.

Ya

ng

Ch

u

Se

nio

r M

an

ag

er

De

loit

te

& T

ou

ch

e L

LP

yangchu@deloitte.com

+1 415 783 4060

Yang Chu is a senior manager at D

eloitte & Touche LLP. She is a

specialist in strategic, financial, operational, technological, and regulatory risk and focuses on exploring em

erging trends for opportunities and threats for clients and for D

eloitte.

Me

gh

na

Pa

nw

ar

Ma

na

ge

r

De

loit

te

& T

ou

ch

e L

LP

mpanw

ar@deloitte.com

Priy

an

ka

Priy

ad

arsh

ini

Se

nio

r C

on

su

lta

nt

De

loit

te

& T

ou

ch

e L

LP

ppriyadarshini@deloitte.com

Ta

nm

ay

Ta

pa

se

Se

nio

r C

on

su

lta

nt

De

loit

te

& T

ou

ch

e L

LP

ttapase@deloitte.com

An

dre

w B

lau

Ma

na

gin

g D

ire

cto

r

De

loit

te

& T

ou

ch

e L

LP

ablau@deloitte.com

+1 415 932 5416

Andrew Blau is a D

eloitte Advisory managing director at

Deloitte &

Touche LLP. He leads Strategic Risk Solutions,

which helps clients spot, assess, and m

anage critical long-term

risks.

Contact the authors

Contributors

Th

e f

utu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

15

1. W

arwick Analytics, “Industries – M

anufacturing,” https://warw

ickanalytics.com/industry/m

anufacturing.2.

Rob Wile, “A venture capital firm

just named an algorithm

to its board of directors – here’s what it actually does,” Business Insider, M

ay 13, 2014,http://ww

w.businessinsider.in/A-Venture-

Capital-Firm-Just-N

amed-An-Algorithm

-To-Its-Board-Of-D

irectors-Heres-W

hat-It-Actually-Does/articleshow

/35075291.cms.

3. N

exgate, “Nexgate – O

verview,” http://nexgate.com

/solutions/overview/; “LinkedIn selects Proofpoint’s N

exgate division for Certified Compliance Partner Program

,” Nexgate, January 14,

2015, http://nexgate.com/blog/page/4/.

4. Erica E. Philips, “Internet of Things reaches into the trucking business,” The W

all Street Journal, April 29, 2015, http://ww

w.w

sj.com/articles/internet-of-things-reaches-into-the-trucking-

business-1430342965; “How

IoT is transforming the logistics industry,” M

ubaloo Innovation Lab, May 15, 2015, http://innovation.m

ubaloo.com/new

s/iot-logistics/.5.

Tim H

ornyak, “Fujitsu pushes wearable IoT tags that detect falls, heat stress,” PC W

orld, May 13, 2015, http://w

ww

.pcworld.com

/article/2921972/fujitsu-pushes-wearable-iot-tags-that-

detect-falls-heat-stress.html.

6. Vidya Ranganathan, “Banks chase trading cheats w

ith ‘fuzzy’ surveillance,” Reuters, Novem

ber 18, 2014, http://ww

w.reuters.com

/article/markets-surveillance-idU

SL3N0T23N

220141118.7.

Tim H

ornyak, “Fujitsu psychology tool profiles users for risk of cyberattacks,” Computerw

orld, January 21, 2015, http://ww

w.com

puterworld.com

/article/2873638/fujitsu-psychology-tool-profiles-users-for-risk-of-cyberattacks.htm

l; Mike W

heatley, “Fujitsu uses psychological profiling to defend against cyberattacks,” SiliconANG

LE, January 26, 2015, http://siliconangle.com/

blog/2015/01/26/fujitsu-uses-psychological-profiling-to-defend-against-cyberattacks/; “Fighting back against the threat of new cyber-attacks w

ith the power of ICT,” Fujitsu Journal, M

ay 29, 2015, http://journal.jp.fujitsu.com

/en/2015/05/29/01/.8.

“Renowned cyber intelligence and behavioral science expert D

r. Terry Gudaitis joins M

etalntell,” Business Wire, M

ay 06, 2014, http://ww

w.businessw

ire.com/new

s/hom

e/20140506005752/en/Renowned-Cyber-Intelligence-Behavioral-Science-Expert-D

r.#.VVQqiPm

qpBc.9.

Debm

ed, “About us,” http://debmed.com

/about/.10. Cytora, “Cytora data products,” http://w

ww

.cytora.com/products.htm

l. 11. Verafin, “Verafin – H

ome,” http://verafin.com

/?nabt=1. 12. “Zeean, “Zeean – H

ome,” https://zeean.net/.

13. Jaime Lee, “D

evicemakers explore risk contracts w

ith hospitals,” Modern H

ealthcare, Decem

ber 06, 2014, http://ww

w.m

odernhealthcare.com/article/20141206/M

AGAZIN

E/312069964. 14. “U

sing captives for terrorism solutions,” W

illis SecureNet, April 19, 2011, http://w

ww

.willis.com

/documents/publications/Services/Political_Risk/48701_

UsingCaptivesForTerrorism

Insurance.pdf. 15. BitSight, “Security ratings for cyber insurance,” https://w

ww

.bitsighttech.com/security-ratings-cyber-insurance.

16. “California isn’t ready for driverless cars,” Los Angeles Times, D

ecember 28, 2014, http://w

ww

.latimes.com

/opinion/editorials/la-ed-driverless-cars-20141228-story.html; Rob Toew

s, “The federal governm

ent must act to ensure that the autonom

ous vehicle revolution takes place in the U.S.,” Tech Crunch, January 17, 2016, https://techcrunch.com

/2016/01/17/the-federal-governm

ent-must-act-to-ensure-that-the-autonom

ous-vehicle-revolution-takes-place-in-the-u-s/; Quinten Plum

mer, “G

oogle asks feds to fast track regulations for self-driving cars,” Tech Tim

es, March 20, 2016, http://w

ww

.techtimes.com

/articles/142482/20160320/google-asks-feds-to-fast-track-regulations-for-self-driving-cars.htm.

17. Joe Harpaz, “Airbnb disrupts hotel econom

y, sends regulators scrambling,” Forbes, M

ay 07, 2014, http://ww

w.forbes.com

/sites/joeharpaz/2014/05/07/airbnb-disrupts-hotel-economy-

sends-regulators-scrambling/#4c5c71da726d; Bruce Chew

, Don D

erosby, Eamonn Kelly, Bill M

iracky, “Regulating ecosystems”, D

eloitte University Press, April 15, 2015, http://

dupress.com/articles/regulatory-fram

ework-business-ecosystem

s-business-trends/; Finn Poschmann, “Taxation and regulation in the era of U

ber and Airbnb present new hurdles for

government,” Financial Post, April 01, 2015, http://business.financialpost.com

/fp-comm

ent/taxation-and-regulation-in-the-era-of-uber-and-airbnb-present-new-hurdles-for-governm

ent. 18. Jayne O

’ Donnell, “Video visits blocked despite doctor shortage,” U

SA Today, Decem

ber 07, 2014, http://ww

w.usatoday.com

/story/news/nation/2014/12/07/telem

edicine-state-laws-

rural-hospitals-specialists/70094828/; Lauren Silverman, “Texas puts brakes on telem

edicine – and Teladoc cries foul,” NPR, June 02, 2015, http://w

ww

.npr.org/sections/health-shots/2015/06/02/408513139/texas-put-brakes-on-telem

edicine-and-teladoc-cries-foul.19. M

aggie Zhang, “Adobe Kickbox gives employees $1000 credit cards and freedom

to pursue ideas,” Forbes, August 19, 2015, http://ww

w.forbes.com

/sites/mzhang/2015/08/19/adobe-

kickbox-gives-employees-1000-credit-cards-and-freedom

-to-pursue-ideas/#292d4ebc3c39. 20. Frank Friedm

an, Chuck Saia, “How

dashboards can help CFOs m

anage risk,” Deloitte Insights (The W

all Street Journal), April 28, 2015, http://deloitte.wsj.com

/cfo/2015/04/28/how-

dashboards-can-help-cfos-manage-risk/.

21. Gw

en Moran, “Fostering greater creativity by celebrating failure,” Fast Com

pany, April 04, 2014, http://ww

w.fastcom

pany.com/3028594/bottom

-line/a-real-life-mad-m

an-on-fighting-fear-for-greater-creativity.

22. Rob Price, “United Airlines w

ill let you fly free if you find bugs in its software,” Business Insider, M

ay 15, 2015, http://ww

w.businessinsider.com

/united-airlines-bug-bounty-free-air-miles-

flight-security-vulnerability-2015-5; “The bounty programs of G

oogle, Facebook, Microsoft…

Which tech giant offers the juiciest rew

ards to hackers,” Panda Security, June 23, 2014, http://w

ww

.pandasecurity.com/m

ediacenter/security/bounty-programs-google-facebook-m

icrosoft/. 23. Rex Santus, “Facebook’s ThreatExchange is a social platform

for sharing cybersecurity threats,” Mashable, February 11, 2015, http://m

ashable.com/2015/02/11/threatexchange-

facebook/#.gadARfyimq5.

24. “Wikistrat launches analytics w

argame harnessing the pow

er of crowdsourced forecasts,” W

ikistrat, July 07, 2015, http://ww

w.w

ikistrat.com/w

ikistrat-launches-analytical-wargam

e-harnessing-the-pow

er-of-crowdsourced-forecasts/.

25. Emily Steel, “N

etflix, Amazon and H

ulu no longer find themselves upstarts in online stream

ing,” The New

York Times, M

arch 24, 2015, http://ww

w.nytim

es.com/2015/03/25/business/

media/netflix-am

azon-and-hulu-no-longer-find-themselves-tvs-upstarts.htm

l?_r=2. 26. Thom

as Bartman, “Confronting a new

-market disruption Part 3 – Car2G

o,” The Forum at H

arvard Business School, Novem

ber 19, 2015, https://medium

.com/bsse-gets-social-m

edia/confronting-a-new

-market-disruption-part-3-car2go-7e01398fb458#.d55zkhxib.

27. Adam Tanner, “Love it or hate it, Ripoff report is in expansion m

ode,” Forbes, May 09, 2013, http://w

ww

.forbes.com/sites/adam

tanner/2013/05/09/love-it-or-hate-it-ripoffreport-is-in-expansion-m

ode/#722e789f33dd.

FootnotesT

he

fu

tu

re

of r

isk

| N

ew

ga

me

, ne

w r

ule

s

Th

is p

ub

lica

tion

co

nta

ins g

en

era

l info

rm

atio

n o

nly

an

d D

elo

itte is

no

t,

by means of this publication, rendering accounting, business, financial,

investment, legal, tax, or other professional advice or services. This

pu

blic

atio

n is

no

t a s

ub

stitu

te fo

r s

uch

pro

fessio

na

l ad

vic

e o

r s

ervic

es,

no

r s

ho

uld

it be

use

d a

s a

ba

sis

for a

ny d

ecis

ion

or a

ctio

n th

at m

ay

affect your business. Before m

aking any decision or taking any action that m

ay affect your business, you should consult a qualified

pro

fessio

na

l ad

vis

or. D

elo

itte s

ha

ll no

t be

re

sp

on

sib

le fo

r a

ny lo

ss

su

sta

ine

d b

y a

ny p

erso

n w

ho

re

lies o

n th

is p

ub

lica

tion

.

Ab

ou

t D

elo

itte

De

loitte

re

fers to

on

e o

r m

ore

of D

elo

itte T

ou

ch

e T

oh

ma

tsu

Lim

ited

,

a U

K p

riv

ate

co

mp

an

y lim

ited

by g

ua

ra

nte

e (“D

TT

L”), its

ne

two

rk

of mem

ber firms, and their related entities. D

TTL and each of its m

ember firm

s are legally separate and independent entities. DTTL

(als

o r

efe

rre

d to

as “D

elo

itte G

lob

al”) d

oe

s n

ot p

ro

vid

e s

ervic

es to

clie

nts

. Ple

ase

se

e w

ww

.de

loitte

.co

m/a

bo

ut fo

r a

de

taile

d d

escrip

tion

of DTTL and its m

ember firm

s. Please see ww

w.deloitte.com

/us/about fo

r a

de

taile

d d

escrip

tion

of th

e le

ga

l str

uctu

re

of D

elo

itte L

LP

an

d

its s

ub

sid

iarie

s. C

erta

in s

ervic

es m

ay n

ot b

e a

va

ilab

le to

atte

st c

lien

ts

un

de

r th

e r

ule

s a

nd

re

gu

latio

ns o

f pu

blic

acco

un

ting

.

Co

pyrig

ht ©

20

16

De

loitte

De

ve

lop

me

nt L

LC

. All r

igh

ts r

ese

rve

d.