These are not easy times for insurance CEOs and their risk management functions as the risk environment continues to evolve. Based on KPMG International's recent survey, the executives are currently focused on three big risks: emerging technology risks, operational risks and regulatory risks. Besides, 45 percent of the insurance CEOs highlighted that the uncertainty of today's political landscape is having a greater impact on their organization than they had seen in years.

Most insurers are now working hard to improve their risk management capabilities. More than three-quarters of our respondents (76 percent) are spending `much more' time on scenario planning and 70 percent said that they are recruiting new skills and specialists to help them better understand the geopolitical risks. Futhermore, 70 percent of insurance CEOs plan to increase investment into their governance and risk functions over the next three years; almost a quarter (23 percent) suggest that this new investment will be `significant'.

More investment, improved capabilities and increased focus on scenario planning will certainly be important as risk managers fight to get their arms around a wider and more uncertain risk environment. However, our experience suggests that CEOs and their risk managers may have to go deeper and think differently if they hope to keep up with the pace of change and meet the needs of the organization.

Increasing the frequency and scope of scenario planning, for example, will certainly help insurers prepare for the risks that they know. It will also help decision-makers start to better understand the roles, responsibilities and reactions to undertake when unexpected risks arise. But that is just the first step. Once the scenarios are understood and developed, the next step is to convert the findings into a tactical action plan. Knowing what you want to do when faced with a particular situation is one thing. Knowing how you will do it is another thing altogether.

The commitment to hire more specialists and recruit new skills will help improve the capacity and capabilities of the risk management function. In today's analytical enterprise, the risk function desperately needs more data analytic capability and more resources capable to identify new risks and support growth.

Along with adding more bodies, risk management functions will also need to enable those resources to start focusing on more `high value' activities. This can be accomplished by leveraging new technologies and tools to automate many of their manual and repetitive tasks and processes.

To be fair, risk management functions have come a long way with automation over the past few years. But much more can - and should - be done.

Another way that risk managers could be better protecting themselves and their stakeholder is by shifting their role from being the `police' of the organization to focus more on being the `enablers' of the business. Rather than simply identifying and raising risks, they should be working with the business and stakeholders to find ways to make those risks more manageable.

Other than conducting scenario planning to uncover unexpected risks, they should also be looking for the unexpected opportunities that could emerge from the different scenarios. They could be using their technology to speed up processes in a way that hands flexibility back to the business rather than using it to simply speed up the identification of risks.

As the risk environment continues to change, so do the business and stakeholders' expectations. Risk management functions will need to find ways to dig deeper and to think differently about the way they serve the business and the value they return to customers and stakeholders.

The fact that CEOs are planning to increase investment into the risk function is good news. Now it's time for the risk function to use those new capabilities and resources to make a real step-change in the way they operate.