Transcript: Executive Perspectives on Top Risks for 2021 and 2030

Prepare for the future and embrace the megatrends, for the future may arrive sooner than you think. The pandemic experience has changed the world. The future of work looms large on the horizon. These are among a broad range of concerns and challenges on the minds of board members and C-suite executives around the world.

This is Kevin Donahue, Senior Director with Protiviti, welcoming you to a new edition of Powerful Insights. Protiviti and the NC State University ERM Initiative recently teamed to conduct their ninth annual risk survey of board members and C-suite executives worldwide. You can find our report, Executive Perspectives on Top Risks, at erm.ncsu.edu or protiviti.com/toprisks. This year, we introduced a new dimension to our global study, asking not only about risk issues on the horizon for 2021, but also over the next 10 years into 2030. The results are enlightening and reveal a number of notable themes that I had the pleasure to discuss with Dr. Mark Beasley and Protiviti Managing Director Jim DeLoach. Mark is the Director of the Enterprise Risk Management Initiative in the Poole College of Management at NC State University. Jim leads Protiviti’s Global Thought Leadership Program and is a member of the firm’s Solutions Leadership Team.

Jim, thanks for joining me today.

Glad to be here, Kevin.

And Mark, as always, it’s great to speak with you.

Thank you, Kevin. It’s always good to be with you too and Jim as well.

So, Mark, to get things started for us here, can you give us a rundown of this year’s study, how we conducted it and the timing and those sorts of things to inform our audience?

Sure. The exciting thing about this study is we’re in our ninth year of conducting this annual survey to get executives’ perspectives of what they see as the top risks on the horizon for their organisations, and generally, we’re always focusing on the next year, which is what we did this year by saying, what are the issues on the minds of executives for 2021. The exciting thing about this year is we also asked them about the long-term view, by looking at 2030. So, the really neat thing about this year is we’ve got perspectives not only about 2021 but 2030. We took a similar approach to the other eight years, in the sense that we focused on, in the prior years, 30 specific risk issues to get their perspectives on those, but given the current environment of the pandemic, particularly, and other issues happening in 2020, we really felt like we needed to expand that, and so we have, actually, six additional risk issues – a total of 36 risks this year – that we asked them to think about because we wanted to build in, stating the obvious, when we think about the pandemic impact.

We have three categories of risks: macroeconomic risk, strategic risk, operational risk, and again, building 30 of those 36 we’ve asked in prior years gives us the ability to compare across years. We particularly waited to launch the survey until after the US presidential and congressional elections that were in early November, because we wanted to make sure respondents had more information, particularly in light of that event, as they responded to their questions. So, they were really addressing these issues after the elections, so November and December, as they looked into 2021. And we feel like that gave us a more up-to-date perspective. So, we purposely delayed for that reason and I’m excited about that just given the timing and everything.

That’s great, Mark. Thanks for that rundown. What I thought I would do is walk through some of the major trends we saw come out of our study. Mark, as you said,  we have a wealth of results by industry, by geography, and certainly for the next 12 months and the next decade, but in looking in that, we’ve identified a number of themes. So, Jim, I’ll have you talk about this first one. There are a number of megatrends that we see companies having to prepare for, and a key thing is that the future may arrive sooner than companies think. What is some of our thinking around there based on the results from the study?

Thank you, Kevin, and like Mark said, we’re very excited at Protiviti with this latest survey, our ninth, with North Carolina State University’s Enterprise Risk Management Initiative and we’re excited about sharing these results with the marketplace. When COVID-19 hit, many digital leaders did not need to do a whole lot to pivot, as they were already future-ready and able to operate in a manner to survive and thrive in the pandemic’s new normal. So, this theme around embracing the megatrends and preparing for the future was illustrated by the ability of digital leaders to respond virtually overnight – making some adjustments of course, everybody had to do that – but they had all the tools, the technology, the people – they were ready to do it.

We hear a lot of talk about disruption being unpredictable, but there is nothing about 2020 that was not predictable. The market had been anticipating an airborne pandemic for many years. It may not have been on the radar of a lot of companies but it’s been there. I mean, think about it. With many risk management activities, companies talk about the risk, but unfortunately, the risk has to materialise before they really act and do something. So, in the case of COVID-19, the market has recognised it’s like a gray rhino charging on the horizon. The pandemic was inevitable. Think about it. We had SARS and Ebola, to name but a few. They weren’t airborne, but they’re not that far distant in the rearview mirror. And given the number of infectious viruses on the planet, overpopulation, large and dense cities, global travel … considering these and other factors, a pandemic is almost inevitable. And think about this: Dr. Fauci, who we all know here in the States, has advised six presidents and now has a seventh one he’s advising. He always told them that the one that keeps him up at night was an airborne pandemic, so this has been in the medical field for a long time. So the message is that companies cannot hold back the tide and prevent the future. They need to plan for it, and all businesses need to recognise the megatrends and where those trends will take the market in the future. The only uncertainty is how quickly these trends will materialise. So depending on the industry and the implications of these megatrends, you may be talking about transportation type issues, electrification, self-driving vehicles, drones, automation of all kinds, the expectations of consumers, employees, and investors that companies embrace net-zero carbon footprint targets, and flexibility and mobility for both employees and consumers, aging population, shrinking talent pools – it’s all there and much, much more. So, I could go on but the point I think, Mark, is that if a company’s future-ready, it will prosper. If its focus is only on the present, then the pace of change and the inevitable disruption as the megatrends play out could create potentially existential threats that can lead companies to ultimately lose in the market. It’s not a matter of if, it’s a matter of when, and the challenge is that getting future-ready may require some impact on the bottom line in the short-term.

Jim, I’m going to jump in here and just add, I agree with what you’ve said and I think what is interesting when you think about these megatrends, and particularly going back to the pandemic, being on the radar as you said, it was out there. We knew it’s possible but one of the things we’re hearing from organisations is there’s been a reluctance in the past to embrace what is viewed as a very low probability but pretty high event, particularly in scenario planning kind of exercises, that there’s a little bit of pushback of, “Mark, don’t waste my time talking about this pandemic, it ain’t going to happen to us,” and I think these megatrends, I think part of our message is we shouldn’t say, “It won’t happen,” that these megatrends could be longer term, may not be tomorrow issues, but if I play ignorant and say, “It’s not going to happen,” I could be in that category of those that don’t survive in the future and I think this is what we’re seeing play out when we think back to the pandemic in that risk radar list.

A really interesting observation. Today, as we record this podcast, GM announced that it set a 2035 target on all electric vehicles. It’s phasing out all fossil fuel burning tailpipe polluting vehicles. And what’s so fascinating about that targeting and making that commitment – which it did say was aspirational – is that 98% of its revenue comes from these fossil fuel tailpipe polluting vehicles, and all of its profits come from those vehicles. So this is a massive change but it really does appear that GM, based on its announcement today, is embracing the megatrend and the target of a net-zero carbon footprint, which is what everyone is expecting.

So, Mark, along those lines of thinking, I mean something that we saw in the results and certainly obvious about how you have talked about it, is the fact that this pandemic experience has changed the world. We know that but I guess looking at the business side and some of the results we saw, what are some changes that companies have seen and are embracing, building on some of the things Jim said?

Clearly, like you said, sort of stating the obvious, the pandemic has changed the world. We all know that, and I think that’s coming through in our top risks, particularly when you look at 2021. As I said at the beginning, we added some additional risks to bring in some concerns that could be tied to the pandemic. We felt like that was too critical to what's on the mind of executives, and sure enough, those are top of mind. The top three risks have sort of this pandemic feel to them in the sense of concerns about the pandemic have changed immediately for 2020, 2021, and potentially 2022 the way regulation is impacting how they can do business. So, we are seeing, “When can I bring people back? Do they have to wear masks, do they have to be vaccinated?” How do I even deal with the temporary regulations of getting through this pandemic these have definitely impacted how they can do business. So, for many that are people-centric products and services where they need to get to people, clearly that’s changed how they can deliver their products and that service, and so that was the number one concern was just how are emerging regulations to deal with the pandemic going to continue impacting how I do business.

Obviously, the economy, big concern, and what’s the long-term view of when will we see an economic sort of bouncing back and a stronger way. Thankfully, we’re better now than we were, say, at the beginning of March and April of last year, but just really concerns about economic conditions continuing to constrain growth is a concern. That was the number two concern, and then the third issue is just how might the entire pandemic just change customer demand. Which sort of gets to this megatrend of the pandemic, now that we’re almost getting to 11 months into it here in the US, and even beyond, when we think globally, which our survey is picking up perspectives from all around the globe. We’re almost a year into it and the thought of going back to the way it was is not probably the way we need to be thinking. I think the concern is the pandemic has had a long-term change on how we will be interfacing with our core customers and that pandemic impact is long-lasting, and so that is clearly on the minds of people. We’ve got to adjust now, 2021, but even when we look at the 2030 risks, when you really look at what they’re talking about there, there’s a lot about innovation, there’s a lot about embracing new technologies, changing how we deliver. Companies that were very strong digitally have done really well during the pandemic, in many cases, because they were already ready to deliver virtually. I think in the 2030 risks, we’re beginning to see some focus of, “Are we going to be digitally ready in 10 years? Are we going to be able to attract that talent to be able to do that?” Because I think they see this pandemic impact is long-lasting. It’s not, “Let’s get the vaccine and we go back to the way it was.” It’s probably not the way it was. It’s the new next normal that is on the horizon.

That is the key. We’re not turning the clock back and I think that during the pandemic, I don’t know, in my career, my business career, I have seen a situation where CEOs have had to operate under more stress in such a profoundly altered environment. Basically, Mark, to your point, it altered the way consumers and customers behave and their preferences, it created a complete paradigm change in the workplace, it collapsed fragile long-range supply chains, and I can't think of a single industry that it did not fundamentally change the dynamics. So, those changes are going to continue to ride forward and companies have got to embrace and adapt. One of the most unique things, I think, is how quickly people innovated, and that behavior of innovating in days and weeks versus months and years is going to have to continue, I think, Mark, to be competitive in that environment you were talking about. So, in essence, everybody’s going to have to get comfortable being uncomfortable.

Absolutely, yes. Which is not a fun thought but it’s reality.

Exactly.

These trends that you’ve been talking about, both of you discussed around the pandemic changing the world, are really interesting and they certainly lead to this whole concept of the future of work. This was a theme prior to the pandemic but the last 12 months have certainly been a catalyst to the way the workforce and necessary skills are changing. Jim, what are your thoughts on this? What did we see in the results that really call this out?

Kevin, I think this is a very important aspect and result of our study. Before the pandemic hit, you had McKinsey and World Economic Forum and others forecasting millions upon millions upon millions of job functions being displaced by artificial intelligence and other digital technologies, and also, creating a need for companies to upskill and reskill their employees in order to perform new job functions that these same technologies created. When you look at our results, the future of work was a top five result for 2021, but it also was the number one risk looking forward over the next decade, which creates what I believe to be one of, if not the, defining business challenge for the next decade. When the respondents to our survey looked out a decade, they expressed concern about the changing nature of work and what they would have to do in order to upskill or reskill and to be able to perform essential job functions. What this means is that companies that not only formulate how and where they may be skilled but are also intentional as to how they will execute their plan to do so and achieve the business outcomes they expect are most likely to have competitive advantage over the next decade. And Mark, I think on a macroeconomic scale, if the private sector is not successful in upgrading skills in the workplace, the effects are going to be huge if not catastrophic.

Yes. I agree because built into all of what you’re talking about is, when they look particularly towards 2030, I think they’re recognising we need to have a talent base that is able to reenvision what the future is, to be able to see that and anticipate that when we don’t know what it looks like today, and so that creativity and that flexibility and that agility in their talent base, I think they’re recognising we need some visionary type of people to help us see. To your point earlier when you were talking about GM’s announcement, that kind of embrace of we’ve got to go for it. It seems odd but we have got to have the courage to make that step.

Absolutely.

That’s fascinating to me personally, this idea that millions of jobs are going to be both displaced and created over the next decade, a huge challenge for companies. And Mark, I think this goes to the next topic I wanted to cover, which is culture, an innovative culture, and organisational resiliency. Given all of this, what are your thoughts on why those areas are such an imperative?

When I think about the resiliency of the organisation, I think in the pandemic experience, we’ve seen our operations turned on their head. So, we’ve had to quickly adjust and hope that we are being resilient and that we can continue operations, and I think coming through that experience, that they’re realising really preparing for organisational resilience is critical. We’ve heard from some about needing to rethink how to think about things like business continuity because it’s been sort of siloed, it’s not an enterprise level structure of how we govern our continuity because we realise we have got to think about our infrastructure to be able to be resilient. So, when you look at our top 10 risks for 2021, and then when you look at 2030, what is interesting is five of those 10 in each time period are of an operational nature. So, operations and they’re thinking through, “We have got to be thinking more about building robustness there,” at the same time, what we’ve been talking about, this agility and flexibility, because who knows when I might need to turn those on a dime again. But I think they’re realising that is important to them.

From a cultural perspective, it ties into some of the earlier points too, though, in that one of the interesting top risks in 2021 is this overall … our risk number nine is resistance to change our business model. I think getting at that, we just naturally like to hang on to what we understand and know, which would be yesterday’s normal. But as we were saying earlier, we’re not going back to yesterday. We’re moving forward and that’s going to require change. So when I think about the culture of our organisation, I think what we’re hearing from them is they’re really trying to think through, is our culture really supporting and embracing innovation and the willingness to be creative and to then change those core operations, but thinking about key things like sustaining our long-term talents, succession planning to make sure we have the people to lead it from a resiliency perspective, do we have the right culture to support that? And then we have some of the right process around core things - supply chain, logistics, customer retention, and loyalty issues - and all those I think are on the minds of really wanting to make sure that we are thinking through these from a continuity perspective where we will be resilient as we march into the future, particularly when you again come back to five of the 10 in 2030 are of an operational nature, so realising we need to think long-term as well.

You know, as I think about what you just said, Mark, and relating it back to Kevin’s lead in to this particular topic on the future of work, when you look back over the history of the human race and you look at the steam engine revolution, you look at the Industrial Revolution, you look at the dawn of the Information Age, we have not done a really good job of creating new jobs to replace displaced jobs simultaneously. We really have not done a very good job at that, and in some cases, you’re talking a disconnect of as much as two decades and that’s scary if I look at the future of work. It’s really to your point, Mark, it’s going to take a lot of foresight, planning, focus on our infrastructure. I think the authenticity of senior leadership is really important to creating that culture, Mark, that you were talking about, top talent with a digital IQ, effective utilisation of data analytics, which is a big point that came out of our study, a strong customer focus and a convincing commitment to diversity, equity, and inclusion at the top and across the organisation. These and other factors are going to be vital to building and sustaining the trust-based innovative culture that you were talking about, Mark, to navigate what’s going to be going on over the next 10 years.

And Jim, and Mark as well, I want a quick follow-up to that. Part of that culture is allowing some room for failure that maybe companies have not done as much of in the past, isn’t that right?

The mantra that we often here is “Fail fast.” So, you’re talking about bits and pieces of an overall vision, try new things, trial and error, an iterative process, try them and if you’re going to fail, fail fast and move on. Failure is inevitable in this new environment, which gets back to what we were saying: It’s important that everyone gets comfortable being uncomfortable.

Yes, and I was even thinking about the number 10 risk in 2021, the ability to be competitive with born digital kinds of operations. So if I’m not willing to fail, then I’m going to stick with my tried-and-true legacy system, and if I don’t pay attention, I’m going to be antiquated pretty quickly. So, I think failure, I’ve got to be willing to embrace it if I really want to compete with people who are much more innovative.

I think the point about failure is speed will be imperative in this environment, and speed of necessity results in being more willing to take risk. This was a risk survey, and the anomaly is that our findings are suggesting that potentially more companies need to take more risk in order to compete and thrive in this dynamic environment that we see over the next 10 years.

Let me transition to another topic. One of these elephants in the room that we can't forget amid the pandemic, amid the need for innovation, amid the need for resilience, the changes that are going to be happening in the next decade, we still have cybersecurity and information security and privacy rearing its ugly head. There have been a number of well-publicised incidents this year. So, Jim, what are your comments on this? We don’t expect these risks to go away for organisations, do we?

We certainly don’t. The whole transition to a remote workplace opened up more potential for cyberthreats and more exposure to data privacy, particularly on the human perimeter. So it’s been a real challenge and then companies are going to be reverting back to the workplace and there are likely to be hybrid models, people in the workplace, in the office, people who are working remotely, which creates more challenges. Our survey respondents indicated that cyber and privacy were both top 10 risks looking over the short-term and they both continue to be top 10 risks looking over the next 10 years. In fact, privacy is a top five risk short-term and long-term. Our study shows that these threats, to your point, Kevin, they’re not going away any time soon because cyber continues to be a moving target and data privacy concerns promise to become even more complex in the digital age as data privacy laws proliferate all over the globe.

Yes, and I think when you look at 2030 and just the focus there on embracing innovation, digital technologies, we’re just going to be that much more reliant on technology. So, I think to your point, Kevin, cyber is probably always in the top 10. It's hard to envision a time where it’s not going to be.

These have been great insights from both of you. I want to remind our listeners that the NC State University and Protiviti report, Executive Perspectives on Top Risks, can be found at erm.ncsu.edu or protiviti.com/toprisks. You can find our full report, executive summary, infographic, and much more. So, let me cover a final topic here, one that is always evident in our study, but there were some interesting changes we saw this year and it’s around regulatory risk. It’s always near the top in our study certainly in prior years but fell a little bit for the next 12 months. But Mark, it goes right back up for the next decade. What is that telling us?

Yes, I think it did fall but it’s still in the top 10 so that’s one thing to keep in mind, and what is number one, as I talked about early on, is more short-term regulatory concern about “how regulation is going to impact me” during this pandemic. So I think that regulatory concern is top of mind for 2021, just getting through the pandemic. But beyond that, we see regulatory concern moving back up into the top concerns – in fact, by 2030 it’s number two. So we’re looking at regulatory changes and increased perceptions of greater regulatory scrutiny over … business, and I think, Jim, you talked about that in that last conversation about cyber and data security and privacy. I think this is a good illustration of regulation. It’s not just a regulated industry like banking or insurance, it is broad regulation that affects all of us, data security being an example of that. Hiring practices, climate issues, and regulatory implications coming from that. I think when they look at the megatrends, they’re really looking at that representing areas where there could be more emerging regulation as we look into the future, dealing with social change issues and those kinds of things. So, I think there’s this broadened sense that the complexity of regulation and the need to ensure compliance is just expanding. It’s expanding into multiple prongs, which means it’s more complex and creates potential risk that is of concern, particularly elevated concern for 2030, as they look out.

The only thing I would add is that I think it’s intuitive that the longer business leaders look out, the more likely they see regulatory change and legislative changes that could potentially affect, to your point, Mark, the ability to do business, and I think everyone on the board expects tax increases to occur and that’s certainly very likely over the next several years with all the money being printed by governments all over the world. So, regulatory risk continues to be a top-of-mind issue, and longer-term, relatively speaking to other risks, it is an even more important issue to the business leaders.

Well, Mark, Jim, this has been a fantastic conversation. Thanks for joining me today.

Thanks for the opportunity. I appreciate it.

Thank you for listening today. I thought this was a great conversation with Mark and Jim, and really hope you enjoyed it. Again, you can find our report, Executive Perspectives on Top Risks for 2021 & 2030, at erm.ncsu.edu and at protiviti.com/toprisks. I also encourage you to subscribe to our Powerful Insights podcast series and to review us wherever you get your podcast content.