APAC insurance CROs lag peers on operational risk preparedness

Cybersecurity remains the leading risk in the region, cited by 62% of APAC CROs. 

Chief Risk Officers (CROs) in Asia-Pacific (APAC) insurance firms are navigating one of the most complex risk environments in recent years, with cybersecurity, conduct, and operational risks emerging as top concerns, according to the latest EY-IIF Global Insurance Risk Management Survey.

Cybersecurity remains the leading risk in the region, cited by 62% of APAC CROs. 

This reflects growing exposure to digital threats amidst geopolitical tensions, increased digitisation, and the volume of sensitive data held by insurers.

Conduct risk has become a particularly significant issue in APAC, with 46% of CROs highlighting it as a priority. 

This is in sharp contrast to 5% in EMEIA and 7% in the Americas. 

The regional divergence is being driven by intensified regulatory scrutiny in markets such as Australia, Hong Kong, and Indonesia, where authorities are focusing on customer fairness, product suitability, and sales practices.

Operational resilience was cited by 31% of APAC CROs, compared to 16% in EMEIA and 7% in the Americas. 

The increased focus stems from regulatory developments such as Australia’s CPS 230, and greater dependence on third- and fourth-party service providers. 

Regulators are also paying closer attention to insurers’ ability to maintain continuity across their operations.

Compliance risk, cited by 31% of respondents in APAC, remains a persistent concern as insurers prepare for stricter capital and solvency requirements and enhanced data protection regulations.

Looking ahead, CROs in APAC expect cyber, regulatory, and geopolitical risks to remain high priorities over the next three years.

Tze Ping Chng, EY Asia-Pacific Consulting Insurance Sector leader, noted that CROs are operating in an increasingly complex environment shaped by regulatory divergence, geopolitical instability, and rapid technology adoption. 

He said the regional differences in conduct and operational risks underscore the need for insurers to remain agile and enhance their compliance and risk functions.