Cyber risk fails to make list of Asia’s top threats

It is the first time cyber risk has made the global Top 10 in the survey, coming in at ninth position. Interestingly, this was the same ranking it achieved in the latest StrategicRISK Asia Risk Report.

However, while Aon is yet to finalise its Asian survey report, StrategicRISK can reveal that cyber risk only makes number 24 in the Asia-specific data.

Senior vice president of risk management at Hong Kong-based telecommunications company PCCW, David Ralph, says that while nothing in the global risk ranking surprised him, “what I am surprised about is the significantly lower ranking given to cyber risk in Asia”.

“Possibly the disconnect is the same variance as highlighted between the different opinions of C-Suite versus risk managers at a global level, possibly exacerbated by the still embryonic nature of risk management in the region,” says Ralph.

InterContinental Hotels Group’s head of risk management for Asia Australasia Shuh Lin Tan was also surprised by cyber risk’s low Asian ranking.

“I am mindful that people in Asia are underestimating this risk, though on the other hand, if the organisations are not international, but local small/medium enterprises, the risk could have less of an impact,” she says.

Coy about cyber?

Head of enterprise risk management at Ascendas Irene Lye suggests that “the difference in opinion on cyber security between the Asia and the global survey could be arising from Asians [being] coy and preferring to manage it internally”.

Lye adds that such an approach will result in no cyber risk claims being made, while cyber insurance coverage remains uncommon in Asia.

Head of strategy and enterprise risk management at Singaporean multi-modal mass transit operator SMRT Corporation, Ryan Tan, theorises that the ranking discrepancy could be because high-profile cyber security events have not received extensive media coverage in Asia.

“Thus, solely Asia-based companies may not be fully cognisant of the potential impact from the ineffective mitigation of cyber risks,” he says.

Steve Tunstall, director of Tunstall Associates, puts it down to a “lack of appreciation by risk managers of exactly how important this area is”.

“It [cyber risk] only just got on the top list globally, so this process is showing it is still an emerging risk which may have less impact on markets expanding rapidly from, by some measures, a lower initial base,” says Tunstall.

Innovation and competition

Speaking more broadly about the findings in the Aon survey, Shuh Lin Tan says that the number eight risk in Asia, failure to innovate/meet customer needs, might be because of a failure to satisfy Generation Z’s demand for innovative product solutions.

“Some companies are already addressing this issue, so I am surprised this is now listed as a risk,” says Lin.

“It is probably just not happening fast enough. People tend to consider technology/product innovation but it may also mean innovation in conducting business, building relationships, building strong employee culture, hiring practices, and so on.”

Shuh Lin Tan was also surprised risks related to as climate change, food security and pandemics did not feature higher.

“It goes to show that risk maturity is not there yet, as people tend to forget storms, drought, and flooding,” she adds.

Ryan Tan says that the top risk in Asia, increasing competition, reflects the fact that companies will have to mitigate, and proactively address, intensifying competition across the region.

“Going forward, companies will have to clinically identify their own areas of comparative advantage, and in some cases to effectively mitigate this risk and effectively compete, they may need to increasingly consider a joint venture or strategic partnerships with other companies that can bring their own unique strengths and value-add to the table,” adds Tan.

Conducted in the fourth quarter of 2014, Aon’s survey gathered input from 1418 respondents at public and private companies of all sizes around the world.

Aon’s web-based survey addressed both qualitative and quantitative risk issues. Responding risk managers, CROs, CFOs, treasurers and others provided feedback and insight on their insurance and risk management choices, interests, and concerns.