Only 20% of insurers assess tech risks fully

50% of CROs are already using early-warning KPIs to monitor risks.

Whilst only 20% of insurers include data and technology risks in their regulatory assessments (Own Risk and Solvency Assessment, ORSA), 50% of CROs are already using early-warning KPIs to monitor these risks, according to McKinsey & Co.

The insurance industry faces growing pressure to adapt to a rapidly changing risk environment, requiring a more agile approach to assessing and responding to emerging threats.

Emerging risks such as cyber threats, climate change, and data security dominate the risk agenda. 

Conversely, despite 60% identifying climate risks as material, only 25% have implemented early-warning systems, the 2023–24 benchmarking survey by McKinsey revealed.

This mismatch highlights gaps in preparedness and underscores the need for stronger integration of risk tools into strategic decision-making.

The survey highlights a critical shortage of skilled professionals in areas such as cyber risk, data analytics, and nonlife underwriting. 

Over half of respondents report difficulties in attracting talent, a challenge exacerbated by the growing complexity of cyber threats.

Insurers face increasing costs from cyberattacks, including fines, business losses, and reputational damage. 

Effective risk management in this domain demands targeted reviews, scenario planning, and robust interconnectivity between data platforms.

Climate risk poses a unique challenge, with mounting natural disasters and investor demands pushing insurers to improve their analytics capabilities. However, preparedness varies significantly. 

Many insurers are focused on reporting and baseline emissions tracking but lag in exposure strategy and portfolio adaptation.

Responsibility for climate risk is divided, with some companies assigning it to the CRO and others to a chief sustainability officer.

Currently, fewer than half of insurers consistently involve CROs in strategic planning, and only 17% report meaningful changes to business unit decisions due to risk team input.