Big Gap Still Exists Between Perceived ERM Importance and Its Adoption

Even though enterprise risk management (ERM) is seen as a growing need for organizations globally, companies are still struggling to implement the practice enterprise-wide, according to an industry study.

Zurich's “Risk Management in a Time of Global Uncertainty,” conducted in collaboration with Harvard Business Review Analytic Services, finds that while global companies are intensifying their focus on ERM in the wake of the 2008 financial crisis and recession, most corporate leaders believe their companies have a long way to go in building an effective, risk-aware culture.

The study found that more than two-thirds of 1,419 business executives say risk management has become somewhat or significantly more important over the past three years.

Broken down, study results showed that recovery from the recession was a greater concern in North America than in other parts of the world, Angelia Herrin, editor for special projects and research for Harvard Business Review, said in a Jan. 20 webinar. In Europe, she adds, the top concern was diseases and pandemics.

When companies were asked how good they believe they are at managing their risks, “we were a little surprised at the results, to be honest,” says Herrin. “We found that about 39 percent believed their companies were 'really proactive' in risk management.”

Thirty-seven percent said they were “reactive,” and 24 percent described themselves as “basic,” she notes, adding that “only one in 10 told us they believe their executive management was highly effective in creating a strong, risk-aware culture.”

Mike Kerner, CEO of Zurich Global Corporate North America, says the study points out the “three lines of defense” in risk management: line management, risk management and audit. It also recognizes the need for tremendous support from the board and senior management “in order to have an effective ERM process.

“There is an old adage that when multiple people are responsible for something, effectively no one is responsible,” adds Kerner. The survey points out the need for “very clear roles and responsibilities by all the parties involved in the risk-management process, to make sure that complex risks can be understood and be covered.”