Some ERM practices going stagnant, survey indicates

A majority of senior finance executives say that risk management is not an important strategic tool at their organisations, and most have not articulated their risk appetite in pursuit of objectives, according to a new survey.

Additionally, fewer than half of respondents believe that existing risk exposures are considered when evaluating new strategic initiatives. That’s according to a survey of 1,093 CFO-level members of the American Institute of CPAs’ business and industry group.

Just 25% of companies have a formal enterprise risk-management (ERM) process in place, according to the survey, which was conducted by the ERM Initiative at North Carolina State University.

Companies are not as likely now, compared with a few years ago, to appoint a chief risk officer, one of several examples where ERM practices appear to have gone stagnant. In 2012, 38% of respondents said their companies had chief risk officers. In the most recent survey, conducted last autumn, that number had fallen to 32%. The percentage is still higher than the first edition of the survey in 2009, when 18% of respondents said their companies had a chief risk officer.

Five takeaways

The survey’s authors offered several takeaways from the survey. Among them:

• There appears to be a disconnect between the recognition of risk and the decision to invest more in structured risk oversight. Rapid changes are catching organisations off guard because few have robust ERM processes in place.
• Executives indicate that they are receiving increased calls for greater engagement in risk oversight, but those pressures do not appear to be leading to significant year-over-year change in risk-management approaches.
• About one-third of organisations update their understanding of risks annually, and an additional 24% update that understanding twice or four times a year. Also, nearly half have no formal updating process. “Given the nature of the ever-changing business environment, key stakeholders may wonder if the frequency of risk updates is sufficient,” the report said.
• Most organisations do not provide any guidelines or scales by which management can assess risk probability or impact. The process used to prioritise risks is mostly ad hoc and “subject to the biases of an individual’s personal risk tolerances.”
• While most view the risk landscape as increasing in complexity over time, the majority of organisations have provided no formal training or guidance on risk management for employees.

Regulatory changes and increased regulatory scrutiny was ranked as the top risk on the minds of board members and executives in a separate ERM Initiative survey, which was conducted by consulting firm Protiviti. Behind regulatory issues on the list were growth-restricting economic conditions and cyber-threats.

Related CGMA Magazine content:

“Six Ways Not-For-Profits Can Get Value From Risk Management”: Many not-for-profits lack the resources to implement a holistic approach to risk across the enterprise. So it’s no surprise that they often lag behind public companies in implementation of enterprise risk management.

“Five Key Defences Against Risk”: Maintaining a healthy tension between entrepreneurial risk and protection of enterprise value is a challenging task for risk management and internal control. Organisations can use five lines of defence to achieve the appropriate tension.

—Neil Amato (namato@aicpa.org) is a CGMA Magazine senior editor.