Despite the promise of digital technology, data, and analytics, few organizations have utilized a data-driven approach to risk modeling. Research showed that only of organizations report using risk modeling,^[1] which means a significant number of companies are missing out on critical opportunities to systematically identify and assess risk, accelerate their response, strategize for the future, and improve their ability to manage complexity. Data and analytics are key to determining an organization’s true risk appetite and shifting to a more data-driven and analytical approach will also lead to better decision-making and provide better visibility into costs—so resources can be better and more strategically allocated across the risk portfolio.

New risks will continue to emerge, and data and analytics capabilities will become even more essential. Companies should get started now to incorporate these solutions and rethink the strategies that can fundamentally change the organization’s risk management function. There are four core areas where data-driven approaches can have both immediate and long-term improvement:

Defining the risk profile: Using data and analytics can help determine where an organization is over- or underinsured, where they can afford to take on more risk, and where it may make sense to look outside of the standard market for coverage. For instance, a data-driven lens can bring clarity to whether captive insurance is the right strategic move.

Benchmarking: Organizations need to better understand their exposure related to the total cost of risk through an analytical understanding of the market. Benchmarking rates and their peers’ activity can better position them to negotiate and identify areas of improvement. Benchmarking can also help compare a company to its competitors across a range of performance areas, such as risk management capabilities.

Cultivating a risk management program: Using the increasing availability of segment- and industry-specific risk insights can provide guidance for peer-to-peer comparisons, but those are only a part of the equation. No two companies are the same and therefore the approach to risk needs to be personalized for an organization’s specific goals and portfolio. Data and analytics can help an organization identify gaps in its risk management approach.

Expanding the role of the risk manager: The risks companies face are becoming more complex and unfolding at an unprecedented rate, and many of them, such as cyber, cut across functions of the organization. Risk managers need to position themselves more strategically and effectively across the organization to meet these increasing challenges. By employing data and analytics to understand the full landscape of risk in the larger business context, they will be positioned to make better decisions, articulate the impact on the organization, and play a greater role in helping the company meet its objectives.

Companies should start with these foundational steps:

Identify the appropriate digital investments. Collecting, storing and managing large volumes of data can be a challenge for many organizations, but making thoughtful investments in digital platforms can help. Sophisticated application programming interfaces are designed to keep data flowing among different software applications; these connections can bring together data feeds from various sources, helping risk managers analyze risks from different perspectives, understand how internal and external factors work together, and visualize different scenarios to cut through complexity. While companies of all sizes have struggled to extract more value from their data, working with thought leaders that understand the goals of the risk management strategy can help customize the technology platform.

Build analytics capabilities. One of the reasons many organizations fall behind on the promise of data and analytics is the continuing need to develop in-house talent. In a global McKinsey survey of leaders across geographies and industries, 43 percent reported that data analytics was a business area with the greatest need to fill skills gaps.^[2] To extract the most value from risk modeling, organizations and risk management functions should create a data-driven, analytics-savvy team and help their risk managers get up to speed. The most successful data-driven risk managers will be able to articulate what to measure, how, and when, and understand the impact different internal and external forces will have on an organization’s risk portfolio.

Bring risk and company leadership together. Today’s complex risks—global crises, reputational challenges, cybersecurity risk—have a powerful impact on the business as a whole. Risk management has a role to play in an organization’s overarching business strategy as they respond to these changes; and risk managers can also align their approach and analysis to a company’s overall business objectives. To do so successfully, risk and company leadership need to collaborate. A chief risk officer armed with data-driven insights will be a more valuable strategic partner to the rest of the c-suite, which can lead to improvements from bottom-line benefits to greater business resilience.

Many companies are incorporating data and analytics into their business functions and realizing the returns—but few are putting data to work in risk management. But the potential benefits, including a more dynamic and strategic approach to risk, are too big to ignore. Companies that take these steps now can help set themselves up for both short- and long-term value.

^{[1] 2019 Aon Global Risk Management Survey}

^{[2] Beyond hiring: How companies are reskilling to address talent gaps}