While many companies have adopted enterprise risk management, current ERM processes are “primitive,” according to an article in the Journal of Accountancy by Kenneth Merchant, chair of accountancy at UCLA.

Companies aren't good at weighing good risks and most cannot quantify their risk appetite. The basic problem is that humans are limited in their ability to conjecture about things that have yet to occur.

The article notes that while companies often quantify their risks according to likelihood, severity, and even velocity, few take those scores and use them to come up with an overall assessment of whether the company will meet its goals given its overall risks. Nor do they audit those scores, compare scores over time or benchmark their scores with those of other companies.

See the full story here.