Boston

Private companies, despite being exempt from any governmentmandate, must be prepared to disclose details of their enterpriserisk management programs because of their dealings with publicfirms that must comply with SEC requirements, one leading brokeragewarns.

That assessment by officials fromMarsh was prompted by results from a survey of risk managersconducted by the insurance broker in conjunction with the Risk andInsurance Management Society, released during the RIMS Conferencehere.

The “7th Excellence In Risk Management” survey of 418respondents asked if their company was ready for new Securities andExchange Commission requirements regarding boards to disclose theirenterprise risk management preparations.

Of public companies that responded, 78 percent said they wereprepared for such disclosure, versus only 22 percent of privatelyheld companies and 32 percent of nonprofits.

During a panel discussion about the survey results, MatthewAllen, head of Marsh's enterprise risk practice, pointed out thatprivate companies and nonprofits have not prepared for ERMdisclosure because, unlike public firms, they are not required toreport by law.

However, practically speaking, because they have dealings withpublic companies, privately held firms will need to make reportingpreparations as well, he said.

The reason, he explained, is that private firms will be calledupon to detail how they will mitigate the material risk they posein their relationships with publicly owned counterparts,particularly in supply-chain situations, joint ventures, or thelike.

The emphasis on disclosure of ERM programs is being generated bycompliance with SEC Rule No. 33-9089. While the rules aretechnically limited to public companies, “what they [privatecompanies] need to understand is they still have to come intocompliance,” according to Mr. Allen.

Pamela Rogers, senior vice president with Marsh, noted that amajor benefit for companies is that by concentrating on compliance,they will have to build a “good framework” for enterprise riskmanagement, and that “can be beneficial to” all risk managers.

Outside of ERM disclosure, Ms. Rogers noted that one of themajor challenges coming out of the survey for risk managers is“lack of personnel resources dedicated to risk management.”

The survey found 44 percent of respondents identified this as amajor obstacle in elevating their risk management practices,followed by “other areas have greater priority” at 43 percent, and34 percent citing “demonstrating the value of risk managementprograms.”

She said one of the major reasons for this is the economicchallenges all corporations faced during the recession, as staffare among one of the first resources companies cut to savemoney.

To preserve their departments in the face of cost-cuttingpressures, risk managers need to emphasize the importance of theirdiscipline to their chief executives, which is essentiallyexplaining the importance of spending money to avoid losses, shesaid.

Deborah Luthi, director of enterprise risk management servicesfor Sacramento, Calif.-based Matheson Inc., as well as vicepresident of RIMS, noted that risk managers need to underscoretheir importance by demonstrating to senior management how muchthey would lose if they are unprepared and losses occur as aresult.

Brian Elowe, managing director for Marsh, noted generally thatconcerns for risk differ markedly among risk managers, chiefexecutives and finance departments.

Property risk was the number one concern among risk managers,but that area ranked third for chief executives and fourth amongfinance officials. Business interruption was the top concern amongfinance people, ranking second for risk managers and fifth forchief executives.

He said this is an indication that the interests of riskmanagers are not as well aligned as one might assume they should bewith other members of senior management.

Risk managers are most comfortable with the handling of hazardrisks, such as auto and property, Mr. Elowe noted, while strategicrisks (including political risk and enterprise risk) and financialrisk fall into the not-comfortable range.

The survey noted that climate change is the “most significantexception among hazard risks” as risk managers indicated they areleast comfortable with this exposure.

The survey report found that climate risk receives the leastattention “but also generates the most discomfort. In part, itremains a difficult risk for which to develop a management plan. Itis also a subject that continues to generate controversy.”