I often receive inquiries from companies who have launched an Enterprise Risk Management (ERM) initiative, but are unable to move beyond their initial risk assessment effort. The exact reasons differ by company, but generally they include limited linkage of large risks and influence of those risks on business performance and lack of business unit understanding of their accountabilities for risk management. In most cases, the cause of the impasse stems from an approach that is overly focused on risk identification and awareness rather than on using ERM to improve return on capital and earnings and cash flow stability.
In many companies, ERM efforts stem from a board request to better understand risk or an attempt by management to achieve a standard of “good practice.” Programs arising out of such mandates, though, are often undertaken without a clear understanding of objectives beyond the desire to “do something.” Boards often don’t clearly articulate what they want, and management does not know what they should be delivering or why, over both the short and long term. Unfortunately, ERM efforts with such beginnings are challenged from the start.