ERM, meh

It makes intuitive sense that you generally want your ability to manage problems to grow faster than the problems themselves. However, a new survey of senior finance leaders by the Association of International Certified Professional Accounts (AICPA) and North Carolina State University’s Enterprise Risk Management (ERM) Initiative suggests that’s not happening for finance departments.

The survey of 454 US CFOs and finance leaders found that 65% “agree that the volume and complexity of corporate risks have changed ‘mostly’ or ‘extensively’ over the last five years,” the professional finance and accounting organization reported. Yet only 34% of respondents think they have a handle on the problem, and “say their organizations have complete enterprise risk management (ERM) processes in place.”

That’s a significant gap in these disruptive times, as a range of risks from “geopolitical developments” to “disruptive technologies and AI” to “cyber and privacy threats" threaten to upend business models, according to the survey.

“Our study finds that organizations of all types and sizes continue to overlook an important reality that risks can emerge rapidly triggering a cascade of events that quickly derail the organization’s strategic goals,” Mark Beasley, a professor and director of the ERM Initiative at NC State, wrote in the study.

While one-third of companies with complete ERM processes in place seems relatively few, it used to be a lot fewer: Thirteen years ago, per the AICPA, it was just 9%.

The AICPA makes clear that one institutional goal is creating a sense of ERM as a bottom-line consideration: “Value in the business is beyond the balance sheet these days and along with providing protection for the business, embracing ERM supports the creation and preservation of value and the long-term viability of the business,” Ash Noah, the AICPA’s vice president and managing director of learning education and development, said.

The goal of ERM is to address the fact “that risks can emerge rapidly triggering a cascade of events that quickly derail the organization’s strategic goals,” according to Beasley, who added, “Organizations that invest in robust risk oversight processes that explicitly link risk insights to strategies increase their nimbleness and agility, which can provide huge strategic advantage if done so better than their competitors.”

It’s clear corporate officers have yet to buy in aggressively to this idea. Indeed, as the report notes, “Most executives do not believe their organization’s risk management processes provide strategic advantage.”