Only 7 percent of risk managers rate themselves at an “advanced”level in terms of implementing their enterprise risk managementprograms, while over one-third are really just getting started inERM, a survey by Aon revealed.

Aon's “2010 Global Enterprise RiskManagement Survey” was designed to discover the extent to whichERMhas been implemented successfully by more than 200 principalrisk professionals from organizations in Australia, the AsiaPacific, Middle East and Africa, Europe, and North America andLatin America.

It also spotlighted nine features of an advanced ERMprogram, while uncovering how organizations view themselves againstAon's five-stage ERMmaturity model.

The model defines a firm's ERM program implementation level on ascale ranging from “initial/lacking” and “basic” at the low end, to“defined” for average maturity, and “operational” and “advanced”for those at more sophisticated stages.

Only 7 percent of the professionals surveyed rated themselves atthe “advanced” level, while 58 percent reported ERM implementationat the “defined” or “operational” levels. Thirty-five percentcategorized the maturity of their ERM programs as “initial/lacking”and “basic.”

Consequently, Aon concluded that 93 percent of the organizationssurveyed have the opportunity to increase the impact of their ERMprograms.

The data identified nine hallmarks of top-performing ERMprograms:

o Board-level commitment to ERM is a critical frameworkfor successful decision making and driving value.

o A dedicated risk executive in a senior-levelposition, driving and facilitating the ERM process.

o An ERM culture that encourages fullengagement and accountability at all levels of theorganization.

o Engagement of stakeholders in risk management strategy development and policy setting.

o Transparency of risk communication.

o Integration of financial and operational riskinformation into decision-making.

o Use of sophisticated quantification methodsto understand risk and demonstrate added value through riskmanagement.

o Identification of new and emerging risksusing internal data as well as information from externalproviders.

o A move from focusing on risk avoidance andmitigation to leveraging risk and risk management optionsthat extract value.

“Board-level commitment”–the first hallmark of ERM successidentified in the survey (see infographic for the full list)–is akey factor in establishing and maintaining an appropriate riskculture and embedding ERM throughout the chain of command, Aonsaid. However, having board directors grasp the value of good riskmanagement practices and how to execute them takes time andcommitment, Aon noted.

Of the respondents considered to be at the “advanced” ERMmaturity stage, Aon reported, 100 percent said their boardsunderstand and support ERM objectives, versus only 4 percent oforganizations in the early stages of their programs.

As organizations move up the maturity scale, however, theyreported their boards are more able to grasp and support theconcepts of ERM, according to the survey.

The survey found the position of chief risk officer most oftencited as the leader of ERM efforts globally–more so for those withadvanced ERM efforts, at 50 percent. By sector, the study found, 42percent of respondents in financial services said the chief riskofficer is the ERM sponsor.

Of the 2010 respondents, 39 percent in the initial stages of ERMsaid they do not have an identified champion for ERM. Aon saidanecdotal evidence finds that ERM programs falter or fail withoutclear executive leadership.

The most cited barriers to ERM, according to the study, are:

o Lack of tangible benefits (40 percent).

o Lack of skills to imbed a program (34 percent).

o Lack of senior management sponsorship (31 percent).

o Lack of a clear implementation plan (28 percent).

o Failure to communicate the case for change (27 percent).

“The ERM journey is organic in nature and unique for eachorganization–it cannot be completed with a cookie-cutter approach,”Laura Taylor,global leader of ERM for Aon Global Risk Consulting, said in astatement.

“The objective is to have ERM rooted in an organization'sculture, management processes and strategy to enhance risk-baseddecision-making and add to their continuity and profitability,” sheadded.