New survey points to growing acceptance of formal risk management. But there’s still a ways to go.
If there is one lesson companies learned during the economic crisis it’s that managing risks can play a critical role in their survival. But risk management is still in its infancy in some regards, according to a new survey from Economist Intelligence Unit, which was sponsored by the ACE Group and KPMG.
To be sure, companies today worldwide continue to implement risk management processes and features into their day-to-day operations. This is revealed in the increased interest of The NeuGroup’s own Corporate ERM Group (ERM), which will enter its fourth year of existence in 2011.
Yet according to the EIU/ACE survey as well as surveys of ERM, risk management has a long way to go in terms of perception and getting adequate resources. “Examples of companies that take a genuinely strategic approach to their risk management remain few and far between,” EIU/ACE said of its survey results. “Communication between risk functions and the broader business can sometimes be fragmented, while an enterprise-wide culture and awareness of risk can be difficult to achieve.”
The EIU/ACE survey revealed that less than 50 percent of companies “involve their risk functions formally” in major strategic decisions like evaluating new market investments or M&A opportunities.
Results differed somewhat in the ERM survey. When asked whether ERM was a formal component in the strategic and financial planning processes of your company, only about 43 respondents said they “always” involved, but another 21 percent said they were “mostly” involved.
A temporary focus?
One of the concerns revealed in the EIU/ACE survey results was that since the bulk of risk management focus developed during the financial crisis, this focus would abate as conditions improved. A little over 50 percent of respondents in the survey said risk management has increased in authority as a result of the crisis, with a similar number of respondents fearing that the authority of risk management will inevitably decline when the good times return.
While there was no correlating question in the ERM survey, members were asked if being part of the ERM function was temporary. Just over 57 percent said it was too soon to tell whether this was the case (which may in itself point to the transitory nature of the group), while 21.4 percent said it was not the case and 14.3 said it was. But one thing risk managers can do to make managing risk ubiquitous is to promote ERM across the company and try to embed a risk-based culture into the business. This will likely help the long-run prospects of the function. Ways in which the ERM members are doing this is by getting upper management buy-in and support, leveraging recent regulatory requirements and holding risk workshops and training. This was echoed in the EIU/ACE survey, which showed that a company’s board “plays a crucial role in setting the tone from the top and instilling a broader culture of risk awareness in the business.”
Having that culture of risk awareness will be critical in the coming years, which so far look like they will come to be known as a veritable regulatory epoch. Governments and courts (legal and public opinion) and shareholders won’t treat kindly companies that put profits ahead of adequately covered risks.