Companies—in particular, in industries outside the financial sector—navigated the risk management challenges of the COVID-19 pandemic and the Ukraine conflict with varied outcomes. Some emerged strengthened and renewed, while others faltered. What strategies did top-performing companies employ to manage these challenges effectively, and what insights can others learn from them?

BCG's Global ESG, Compliance, and Risk Report 2023 delves into these questions. The report assesses the status of risk management, drawing insights from a comprehensive survey of senior executives across industries globally. It further outlines actionable steps that businesses can implement to bridge the gap between risk management aspirations and achievements.

The report has three main conclusions:

1. Companies that had proactively cultivated mature risk management emerged from these crises thankful that they had done so. Their experience with such unpredictable and highly volatile events was notably smoother than that of competitors without equally mature risk management strategies. The disparity was stark: 71% of companies with mature risk management agreed that these capabilities helped mitigate the many potential negative outcomes from these crises, while only 37% with less robust risk management concurred. Clearly, investing in risk management yielded significant dividends during critical moments.

2. Our study also pinpoints what mature risk management means in practice. Effective risk management during intense crises rests on a crucial interplay: a strong strategic foundation in combination with effective operative implementation. The corporate center first sets the overall strategy. Then, the various business units and subsidiaries bring it to life, firmly integrating risk management within the entire organization’s culture and daily processes. In companies with mature risk management, the corporate center and the outlying units and entities cooperate closely and constantly.

In fact, 58% of top performers cited the central strategic risk management team as a success factor during crises. Other key factors were embedding risk management into strategy and planning processes (46%) and data and analytics (also 46%). The latter finding underscores that data analysis, together with artificial intelligence (AI) and generative AI in particular, are essential elements of advanced risk management.

3. Both starters and leaders in risk management face distinct challenges. Starters can gain insights from the path taken by leaders but must first solidify foundational elements, such as obtaining senior management's endorsement to prioritize risk management. Leaders, given their advanced risk management capabilities, have the burden of maintaining more developed frameworks and processes. While starters primarily focus internally within their organization, leaders are also attuned to the external environment and its emerging risks, such as the rapid growth of regulatory scrutiny.

It is imperative for starters to elevate their risk management maturity to fully harness the benefits outlined in our study. The report explains how they can make that happen.