ERM reaches critical mass acceptance

A report based on the survey concludes that ERM is now recognised by a majority of organisations as a strategic business discipline but warns of disparities between ERM’s effectiveness and executive management expectations. While risk managers should be pleased with the progress made they must redouble their commitment to ERM programmes to address perceived shortfalls, it adds. The 2013 RIMS Enterprise Risk Management Survey of over 1,000 risk managers, insurance buyers and other risk professionals at US and Canadian-based companies is a follow up to 2009 and 2011 surveys on the same topic.hideProduced with Advisen Ltd, it sheds light on the current state of ERM and key trends. It focuses on how widely ERM is used, the risk manager’s role in its implementation, ERM programme drivers, the value, expectations and effectiveness of the discipline, strategies for measuring its maturity and risk reporting. “Results of the 2013 survey suggest that ERM, as noted in Everett Rogers’ (1962) research on innovation diffusion and market acceptance, has now reached critical mass (over 60%). This is the point in time within the adoption curve that the sheer number of adopters assures that continued adoption of the innovation becomes self-sustaining and creates further growth,” said RIMS and Advisen in the report. The 63% of respondents’ organisations that have fully or partially integrated ERM represents a rise from 54% when RIMS last carried out its ERM survey in 2011. The figure is up from 36% in 2009. The number of organisations that have a fully integrated ERM programme stands at 21% today, up 4% on 2011. 44% have a partially integrated ERM programme, up 5% on 2011. Of those organisations that do not have a full or partial ERM programme, nearly a fifth are either in the process of investigating, or planning to use ERM within the next year. This figure is down 6% on 2011, which RIMS says is due in part to the fact that an increasing number of organisations have in the meantime begun or completed implementation. With 83% of organisations having adopted, in the process of adopting or considering adopting ERM, the data points to enterprise risk management ‘continuing its upward trend as an accepted and mainstream discipline’, said RIMS. BECOMING VALUED “Although many organisations are still in the infancy of ERM implementation, it is clear that ERM, and the role of the risk professional, has become a valued part of corporate culture and business practices,” said RIMS Director of Strategic & Enterprise Risk Practice Carol Fox. Despite this encouraging news on ERM, few respondents characterised their programmes as fully mature. For example, nearly 60% said they are ad hoc, or in the initial stages, when addressing risk appetite management and performance management. And over 40% of respondents expressed dissatisfaction with elements of their organisations’ risk management practices. Among the practices with the lowest levels of satisfaction are organisational performance management tied to management’s effectiveness in handling risk issues, adoption rate of ERM practices throughout the organisation and alignment of risk management with strategic decision-making. The survey also suggests that risk management’s role in driving ERM implementation has plateaued following an upward trend over the last four years. Between the 2009 and 2011 survey there was a significant increase of 27% in the risk management department’s role in implementing ERM programmes. However, the 2013 survey finds that 56% of respondents claim risk management is the primary department responsible for directing ERM activities. This is down 3% on 2011 but still puts risk management way ahead of any other function in terms of involvement in ERM implementation. Finance departments and internal audit rank as the functions next most involved, at 12%. They are followed by ‘other’ on 9%, legal and compliance on 4% and strategy on 3%. “The emergence of finance on equal footing with internal audit may signify greater alignment with organisational needs for risk impact analysis to include more detailed financial metrics, such as potential outcomes on capital, liquidity and earnings,” said RIMS. In cases where the risk management department is not taking the lead role in ERM implementation it continues to be a substantial player. Only 3% of respondents said the department was not involved in ERM activities, and 68% reported full engagement. Boards continue to be the most common driver of ERM programmes, according to this year’s survey, but by less of a margin than in the past. 26% of respondents said board directive was the primary driver of ERM. This is down 7% on 2011 numbers. The second highest drivers are risk managers (17%), followed by regulatory requirements (14%), down a significant 18% on 2011 figures, and ‘other’ (12%). Grass root success of ERM and the impact of rating agencies dropped significantly as drivers of the discipline compared with 2011, to 3% from 11% and 5% from 9% respectively. The survey also asked respondents about the value of ERM programmes. A third found ERM’s primary value is increased risk awareness, followed by avoiding and/or mitigating risk (22%), increased certainty in meeting strategic and operational objectives (16%) and eliminating silos (13%). “These results may reflect an increased interest in ERM activities by executive management, including the board of directors, to obtain a more holistic view of organisational risk,” said the report’s authors. The survey suggests that executive management’s expectations for aligning risk appetite and strategic risk is not yet fully realised. This presents a significant opportunity for improvement, said RIMS. Indeed, 20% of the risk managers surveyed concede that they are least effective, or not at all, in linking risk management with corporate strategy and planning. Additionally, over 25% of respondents noted that they are least effective or not effective at all in clearly articulating risk appetite and tolerances. Only 10% or less indicated that they are highly effective in these two areas. On a more positive note the survey finds that ERM reporting is expanding to either the full board or a separate risk committee, rather than to the audit committee as has been historic practice. There was a fairly even split between those organisations that report to the full board (24%) and those to the audit committee (25%). Next came a separate risk committee (19%) with many of the remaining organisations reporting to other board committees. Only 3% of respondents said that no regular board review process is in place. In terms of how often the top risk executive reports to the board, 38% said annually, 17% twice a year, 10% as needed and 6% monthly. Worryingly, 4% indicated that the top risk executive did not report to the board or one of its committees. GETTING THERE... “In 2013, we find that ERM indeed has reached ‘critical mass’ as a management discipline with more than 60% of the respondents having fully or partially implemented ERM programmes. Risk managers act as motivators and, by a wide margin, continue to take primary responsibility for directing ERM activities, with 97% engaged in ERM activities in some way. Of note is the emergence of the finance department as an ERM leader, potentially signifying a demand for risk impact analyses to include more detailed financial metrics, such as risk outcomes on capital, liquidity and earnings,” said RIMS and Advisen in the report’s conclusion. “This year, we would like to conclude with an observation, a warning and a challenge,” continued the authors. “The observation: we risk professionals now have what we wished for—risk management, particularly enterprise risk management, is now recognised by a majority of organisations as a strategic business discipline across the full risk spectrum. Furthermore, it is considered a valued part of corporate culture and business practices at the board and executive levels. As risk professionals, we can be pleased with this progress. The warning: this survey revealed a number of misalignments between risk management effectiveness and executive management expectations. We can use these results to examine our own programmes, and recommit in delivering the expected value to our organisations. The challenge: the task of maturing risk practices to create value—as well as protect it—is not for the faint of heart. Often described as a journey, fully integrating ERM can be arduous. The good news is that the result is well worth the effort, as many organisations have already discovered,” they concluded. The 2013 RIMS Enterprise Risk Management Survey was conducted online for nine days in February. Invitations to participate were distributed via email to 13,075 risk managers, insurance buyers and other risk professionals. The survey was completed, at least in part, by 1,095 respondents, with a response rate of 8%.

ERM reaches critical mass acceptance

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles