Businesses are putting themselves in danger by neglecting or avoiding formal risk management processes, according to a new study by the Enterprise Risk Management Initiative at North Carolina State University on behalf of the Chartered Institute of Management Accountants (CIMA).
The report’s authors consulted more than 1,300 executives worldwide, and found that 70 percent felt their risk management process was not “mature”. Just 40 percent are satisfied with the reporting of information about top risk exposures to senior management.
Gillian Lees, CIMA’s head of research and development, said: “When we ask our members to list their current topics of focus, ‘better risk management’ is always near the top. The wider business world needs to hear this call. As we near a decade from a global crash triggered by poor understanding of risks, it’s depressing to see how little has changed. This is the equivalent of not bothering to lock your house after a burglary. Identifying possible threats to a business is essential for securing the firm’s future. Adapting to future risks and changes can give a company a competitive advantage. Failing to do either means sleepwalking towards disaster.”
The report looked at enterprise risk management (ERM), a commonly-accepted framework to identify and prepare for future threats to an organization’s core business model and strategic plan. Unfortunately, ERM take-up was poor around the world, with only 35 percent of organizations claiming to have a formal ERM system in place. 80 percent of firms have not invested in risk management training for executives in the last few years.
“Several things need to happen. Organizations need to develop formal risk management structures that are integrated with their strategies so that they are better informed to identify their most pressing risks to the business’ success. There needs to be a clear way for risk management information to be passed upwards to those leading the strategies of the business so they can increase the business’ agility in navigating challenges that may impact strategic success. Finally, boards need to wake up the challenge, either by establishing risk management committees or by appointing a board director responsible for this area to ensure they are adequately informed about key strategic risk information,” said Mark Beasley, one of the papers’ authors.
Lees added, “For business to succeed it’s essential that leaders make decisions to create and preserve value for the short, medium and long-term. Decision makers need to ‘join the dots’, bringing together the information they need, in the way they need it to understand cost, risk and value.”