Organisations slow to respond to ever-increasing risk

Business leaders around the world believe their organisations face increased risk with each passing year, yet most organisations aren't responding with enterprise risk management (ERM) tools at a rapid enough rate.

That slow response and the dangers and disadvantages created by it highlight the fifth edition of the Global State of Enterprise Risk Oversight survey, commissioned by the ERM Initiative in the Poole College of Management at North Carolina State University and AICPA & CIMA.

Sixty-one per cent of survey respondents in the Europe & UK region said the volume and complexity of risks have increased "mostly" or "extensively" in the past five years. Even so, just 31% described their organisation's risk management oversight as "mature" or "robust".

That finding comes one year after 62% said the volume and complexity of risks had increased in the past five years. In 2021, 29% described their organisation's risk management oversight as "mature" or "robust", suggesting that little progress has been made in the past year.

The Europe & UK region results were similar to the entire survey population, which consisted of 747 business executives across four core regions of the world.

"A big part of our goal with this is to really provide thought leadership to get people to think and evaluate and self-assess," co-author Mark Beasley recently said on the Journal of Accountancy podcast.

Beasley, CPA, Ph.D., is KPMG Professor and director of the ERM Initiative. He joined the podcast to discuss a US-only survey he co-authored earlier this year. The surveys ask many of the same questions, and two-thirds of the global survey respondents are US-based.

"Are we where we need to be in light of the volume and complexity of risks that we obviously are facing? Is our risk management at the level of maturity that we really need to get there?" Beasley continued. "We're not dictating any level at all. We're saying, just think about this."

Dangers

In the global survey, 60% of respondents in the Europe & UK region said their organisation had experienced an "operational surprise" over the past five years. Yet, just 33% described their company as having "complete ERM processes in place".

But, as the authors (Beasley and ERM Initiative Associate Director Bruce Branson, Ph.D.) wrote in the survey: "Respondents noted that several parties are asking for increased senior executive involvement in risk oversight, suggesting that the status quo is no longer acceptable."

Forty-two per cent of Europe & UK respondents said their organisation's board of directors is asking for increased senior executive involvement in risk oversight, with 41% hearing the same call from their CEO/president and 38% hearing the same from their audit committee.

However, 45% cited "insufficient resources" and 36% cited "competing priorities" as perceived barriers to effective ERM.

"I think people are still learning how to do this well," Beasley said on the podcast. "Businesses have managed risk for centuries. If they survived a period of time, they must be managing risk. But I think what they're realising is the way I'm managing risks now should not look like it did in 1990.

"The world is so different, and we need to advance our thinking. I think a lot of organisations are doing that, but I would say the concept of ERM is still in an early stage of maturity."

Disadvantages

Among Europe & UK respondents, 58% said their companies "mostly" or "extensively" consider risk exposures when evaluating possible new strategic initiatives. While more than half said risk is acknowledged in strategy sessions, just 13% said they believe their company's risk management process provides unique competitive advantage.

"What is puzzling is why respondents indicate at higher rates that management considers risk exposures when evaluating possible new strategic initiatives, but on an overall basis fewer percentages of respondents believe their risk management processes provide competitive advantage," the authors wrote. "It is uncertain why there is that kind of disconnect."

The disconnect is present in all four regions in the global survey, but in regions where strategic initiatives most often consider risk, those regions also most often recognise the opportunity for competitive advantage as a result.

Respondents from the US answered the questions similarly to their UK counterparts, with 47% saying their companies consider risk exposures when evaluating possible new strategic initiatives. Just 11% said their risk management process provides unique competitive advantage.

By contrast, in the Asia & Australasia region, where 66% said their companies consider risk exposures when evaluating possible new strategic initiatives, 40% said their risk management process provides unique competitive advantage. The responses were similar in Africa & Middle East (66% and 34%, respectively).

"Competitors with more sophisticated risk intelligence are in a better position that allows them to be more agile and nimble as they respond to shifts in risk conditions," the authors wrote. "Sooner or later, that may lead to significant market advantage for those with more robust risk information at hand." 

— To comment on this article or to suggest an idea for another article, contact Bryan Strickland at Bryan.Strickland@aicpa-cima.com.