As India progresses toward becoming a developed nation under the Viksit Bharat 2047 program, it maintains rapid economic growth. This progress, amid a complex risk environment, presents both opportunities and challenges for Indian industries.  A strong risk culture will enable an organisation to confidently pursue its objectives by taking calculated risks and effectively managing potential threats and hazards.

India Risk Report 2024 by ICICI Lombard and IRM India highlights the crucial need for embedding a risk culture into organizational strategies. The report emphasises a simple A-B-C approach for understanding the “Risk Culture” of an organization. Attitudes of individuals and groups shape their Behaviours. Over time, these repeated behaviours form the Culture, which in turn influences the attitudes and behaviours within the organisation.

This report is a timely reminder of the importance of proactive risk management. It assesses the self-evaluation of processes and cultural standing within Indian enterprises, based on a comprehensive survey of risk perceptions, management practices, and cultural aspects. It equips businesses with actionable insights to navigate the complex risk landscape and unlock opportunities for sustainable growth.

The comprehensive study, combining primary and secondary research, incorporates valuable insights from business and risk leaders across various fields. This report aims to enhance our collective understanding and management of risks while promoting a resilient organizational culture grounded in effective risk practices. It examines risk disclosures from over 500 Indian companies and more than 50 global companies, based on their annual reports for years 2022 and 2023. The quantity and quality of these disclosures provide insights into the prevailing risk culture within these organizations.

Key Findings:

1.    Risk Maturity: Mature organizations ensure that all employees can identify risks within their areas of responsibility. According to survey responses, there has been a marked improvement in this aspect compared to the previous year. Still 42% of organizations still expect the Board or the Risk department to identify risks.

2.    Risk Culture: Measuring risk culture presents unique challenges due to its intangible and subjective nature. Despite this complexity, our research team has developed a risk culture scoring system (0–100) to benchmark organizational resilience. Our findings indicate that only 16% of businesses score above 60, with a mere 6% achieving scores between 80-100.

3.    Top Risks: Cybersecurity, technology, and talent shortages have emerged as pressing concerns across all sectors. As businesses increase their reliance on digital platforms, the risk of cyberattacks has grown significantly, while the challenge of hiring and retaining skilled talent continues to escalate

4.    Mid-size companies: This year's report also emphasizes the importance of risk in mid-sized enterprises, which form the foundation of the Indian economy and account for nearly one-third of India's GDP and half of our total exports. Overall, mid-sized companies have shown significant evolution over the past few years.

5.    Expert analysis from 10 industry leaders and 5 risk experts: Our expert contributors and key external stakeholders, who have accumulated years of experience navigating complex risk landscapes across diverse fields, provide these strategies, offering a comprehensive perspective on achieving sustainable growth and managing complex risk landscapes.

Sandeep Goradia, Chief - Corporate Solutions Business at ICICI Lombard, states "Risk perception across industries is evolving at an unprecedented pace. Sectors that were once considered risk-averse are now confronting new and complex challenges, driven by the increasingly dynamic and interconnected nature of the global risk landscape. The rise of cybersecurity threats, coupled with talent shortages and economic uncertainties, has transformed risk management from a strategic consideration to an operational imperative. In today’s environment, organizations must adopt a forward-thinking approach to anticipate and navigate these emerging threats. Insurance plays a pivotal role in this framework, offering both financial protection and a strategic buffer against unforeseen disruptions. Our collaboration with IRM enables us to deliver in-depth insights and actionable strategies that not only address immediate risks but also foster long-term resilience. By integrating risk management into the core of their operations, businesses can not only safeguard their future but also capitalize on opportunities that arise even in volatile conditions."

Hersh Shah, CEO, IRM India Affiliate and India’s Youngest Enterprise Risk Expert, said “As India charts its course towards becoming a developed nation under the Viksit Bharat 2047 initiative, it finds itself at the intersection of immense opportunities and intricate challenges. The dynamic landscape of business and risk demands a new level of agility and foresight. It is within this context that we present the second edition of our report, "Building Resilience: A Comprehensive Analysis of Risk Culture in India’s Corporate Sector,” with ICICI Lombard. The second edition delves deeper into the essence of risk culture, a crucial yet often overlooked facet of organisational health. Our commitment to understanding and enhancing risk culture stems from its profound impact on an organisation's ability to prepare for evolving scenarios, navigate uncertainties, and leverage opportunities effectively.”

 Key Takeaways:

  • Top Risks in Focus: Cybersecurity threats and talent shortages are becoming key concerns across sectors. As businesses increasingly rely on digital platforms, cyberattacks have escalated, presenting a critical risk. Furthermore, many organizations are finding it difficult to source and retain skilled talent, a trend likely to intensify as the labor market becomes more competitive.
  • Changing Perception of Risk: The report reveals a shift in how some sectors perceive risk. BFSI and Services were low-risk last year and are seen as riskier as they face complex challenges like macroeconomic pressures and cybersecurity, whereas Energy/Utilities and Pharma, which were high-risk last year, are beginning to address risks related to digital transformation. However, Manufacturing and Distribution is at the same lower level both years, so it’s a constant.
  • Risk identification: As per the trends, we see that risk identification among all employees rose by 6% from 26% in 2023 to 32% in 2024, which indicates increased ownership and responsibility. Identifying "black swan" and "gray rhino" events (that refer to unexpected and foreseeable catastrophes, respectively) is now being looked at as a significant contributor to an organisation’s success.
  • Risk Management and Insurance: Furthermore, the report highlights that businesses are increasingly turning to loss control solutions and insurance to mitigate key risks. For cybersecurity, over 47% of respondents have adopted loss control measures, while an equal percentage have chosen insurance to manage their exposure. Technology risk is mitigated by 71% of organizations through loss control efforts, while 66% manage legal and regulatory risks. Fire hazards remain the most insured risk, with 70% of businesses covered. However, there is a significant gap in managing climate change risk, as 37.5% of companies still lack any form of risk solution, indicating an area where further insurance and risk management efforts are required.
  • Strengthening Risk Culture: A key theme in the report is the importance of fostering a strong risk culture within organizations. The survey shows that many businesses are still struggling to instil a culture where risk management is part of everyday decision-making. Companies across sectors must prioritize building a risk-aware workforce to improve their overall resilience.
  • Risk Disclosures: The dedicated chapter on risk disclosure analyzed 521 listed Indian companies reveals that only 3% of respondents maintained consistent risk disclosure over two years, serving as a wake-up call for Indian organizations. Effective risk disclosure requires a top-down approach, where the tone is set at the top, and the board is held responsible for driving risk culture throughout the organization.

While solid risk management processes and advanced technology are essential for risk management, a strong risk culture is also critical. This culture must empower everyone in the company to recognize, identify, and manage risks.

The self-assessment of risk culture, combined with the risk disclosure analysis, highlights the urgent need to enhance risk culture within organizations. This research will benefit industry risk leaders and all Indian enterprise stakeholders. It will help them identify the key areas that require attention to become risk-intelligent and risk-ready, enabling them to confidently pursue ambitious goals.