Corporates still fall down on ERM

A lack of support from senior management is the main thing that stops businesses properly implementing enterprise risk management (ERM), according to sister title StrategicRISK’s latest reader poll. The 100-person web survey also identified “unclear ownership and responsibility for implementation” as well as “lack of tangible benefits” as other significant barriers to successful ERM execution.

Unsurprisingly in the current cost climate, the respondents added that a lack of capital to invest in risk management was also negatively affecting their ERM efforts. The study was designed to give a snapshot of how ERM is being implemented across organisations so that risk managers can benchmark their efforts with peers.

A third of the respondents indicated that their ERM programmes were sufficiently mature that they could identify, measure, manage, report and monitor their major risks, adding that their policies and techniques had also been clearly defined. A quarter of the respondents described their ERM programmes as slightly less mature – in other words, they had limited capabilities to identify, assess, manage and monitor their main risks. And fewer still (19%) were in the initial stages of ERM.

Only a handful of respondents had ERM programmes that were either consistently applied at an operational level (10%) or at an advanced level (13%). This indicates that risk managers still have some way to go to fully embed ERM within their organisations.

Encouragingly, over half (57%) had identified their organisation’s risk appetite, defined as the sum of assets that the organisation is willing to put at risk in pursuit of its corporate objectives.

Although many of the risk management standards state that organisations should understand their risk appetite, the application of the concept remains difficult. Successfully identifying an organisation’s risk appetite is an essential part of effective risk management.

Making an impact

Even more positively, almost three-quarters (70%) of the survey participants said that their ERM programme does improve business decision-making.

Over a quarter (28%) said that their ERM programme also has a “significant” influence on their organisation’s strategic planning. More than one in 10 (15%) said that it has a “very significant” impact on strategic planning. But, equally, a similar proportion (14%) said that it has “very little” influence. The biggest proportion of respondents (36%) said that ERM only “partially” influences their strategic planning.

In a connected finding, ERM is only moderately successful at helping organisations achieve their objectives, according to almost half (46%) of the respondents. Over a quarter (28%) reported isolated success with this. Only 20% of respondents said that their ERM programme is “very successful” at helping them achieve their commercial objectives.

Only a small number (10%) of the respondents said that their organisation (including all its employees and senior management) “entirely” understands the objectives of ERM. Around a fifth (21%) said their organisation understands the ERM objectives “significantly”.

The biggest proportion (64%), however, said that their organisation only “partially” understands the overall objectives of ERM. Complementing this finding, over half of the respondents (54%) said they were only partially successful embedding ERM into the corporate culture so that everyone in the organisation clearly understands their risk accountabilities. This goes to show that embedding a risk culture is an ongoing challenge for many firms. Just 17% of the respondents said that they had achieved this “entirely or significantly”, indicating that at least some firms are confident about their risk management cultures.

Company champions

The biggest ‘prime sponsor’ of ERM is the chief financial officer, according to our survey. Next in line is the chief executive, followed by a risk management director, and then the board. Neither the company treasurer nor the internal audit department are popular sponsors of ERM, according to this group of respondents.

Overall, the findings of our survey indicate that there is work to be done in terms of establishing ERM as standard business practice. Encouragingly, though, the survey shows that many organisations are past the initial stages of ERM programme development and a number of organisations have already been successful in embedding a culture of risk management and influencing strategic decisions through the use of ERM.

Click on related file 'Risk survey, in association with Ace'' on the left to view the graphs accompanying the original feature in StrategicRISK.