Some ERM practices going stagnant, survey indicates

By Neil Amato

A majority of senior finance executives say that risk management is not an important strategic tool at their organizations, and most have not articulated their risk appetite in pursuit of objectives, according to a new survey.

Additionally, fewer than half of respondents believe that existing risk exposures are considered when evaluating new strategic initiatives. That’s according to a survey of 1,093 CFO-level members of the AICPAs’ business and industry group.

Just 25% of companies have a formal enterprise risk management (ERM) process in place, according to the survey, which was conducted by the ERM Initiative at North Carolina State University.

Companies are not as likely now, compared with a few years ago, to appoint a chief risk officer, one of several examples where ERM practices appear to have gone stagnant. In 2012, 38% of respondents said their companies had chief risk officers. In the most recent survey, conducted last fall, that number had fallen to 32%. The percentage is still higher than the first edition of the survey in 2009, when 18% of respondents said their companies had a chief risk officer.

Five takeaways

The survey’s authors offered several takeaways from the survey. Among them:

  • There appears to be a disconnect between the recognition of risk and the decision to invest more in structured risk oversight. Rapid changes are catching organizations off guard because few have robust ERM processes in place.
  • Executives indicate that they are receiving increased calls for greater engagement in risk oversight, but those pressures do not appear to be leading to significant year-over-year change in risk-management approaches.
  • About one-third of organizations update their understanding of risks annually, and an additional 24% update that understanding twice or four times a year. Also, nearly half have no formal updating process. “Given the nature of the ever-changing business environment, key stakeholders may wonder if the frequency of risk updates is sufficient,” the report said.
  • Most organizations do not provide any guidelines or scales by which management can assess risk probability or impact. The process used to prioritize risks is mostly ad hoc and “subject to the biases of an individual’s personal risk tolerances.”
  • While most view the risk landscape as increasing in complexity over time, the majority of organizations have provided no formal training or guidance on risk management for employees.

Regulatory changes and increased regulatory scrutiny was ranked as the top risk on the minds of board members and executives in a separate ERM Initiative survey, which was conducted by consulting firm Protiviti. Behind regulatory issues on the list were growth-restricting economic conditions and cyber-threats.

Neil Amato is a JofA senior editor.

SPONSORED REPORT

Why cybercriminals are targeting CPAs

This free report expands on the most commonly found scams, why education and specialized IT knowledge help to lessen security vulnerabilities, and why every firm should plan carefully for how it would respond to a breach.

PODCAST

How tax reform — and Excel — are changing the CPA Exam

Mike Decker, the vice president of examinations at the AICPA, discusses changes being made to the exam as a result of tax reform — and about how Excel will now be available for use on the test.