Global study shows risk oversight maturity in US firms may be lagging firms in other regions
A recent global study of business leaders shows that organizations of all types around the world face a seemingly ever-increasing array of risks that may significantly affect their strategic success, said Mark Beasley, Deloitte Professor of Enterprise Risk Management and director of the Enterprise Risk Management Initiative at the North Carolina State University Poole College of Management. But, U.S. firms may be less mature in their risk oversight compared to firms in other parts of the world.
“Many firms are working to enhance their understanding and management of emerging risks by embracing an enterprise-wide risk oversight process, commonly referred to as enterprise risk management (ERM),” Beasley said. “Surprisingly, responses from U.S. organizations suggest that processes related to understanding and monitoring emerging risks may be less developed relative to responses from organizations based in Europe, Asia and Australasia, and Africa and the Middle East.”
The ERM Initiative conducted the study in collaboration with Chartered Global Management Accountant (CGMA), a joint venture of the American Institute of Certified Public Accountants (AICPA) based in the U.S. and the Chartered Institute of Management Accountants (CIMA) based in the U.K.
Nearly 1,400 leaders of small to mid-sized businesses across four core regions of the world responded to the online survey, providing insight about the differences and similarities in the current state of enterprise risk management practices around the globe. A range of industries is represented in the study, with most of the respondents reporting annual revenues of $500 million or below.
Results are summarized in the report, “Global State of Enterprise Risk Oversight 2nd Edition: Analysis of the Challenges and Opportunities for Improvement,” now available online at the ERM Initiative and CGMA websites.
Given the rapid pace of change in the global business environment, more organizations are realizing that status quo risk management will likely lead to significant missed strategic opportunities, Beasley said. Those that embrace the reality that risk oversight and value creation are related are the likely winners, he said.. Investment in enhanced enterprise risk oversight strengthens their resilience, agility and quality of decision making when navigating the complex risk landscape on the horizon.
Following are key findings from the study.
- Organizations around the world face a similar volume and complexity of risks – no region is uniquely different in that perception. Surprisingly, an overwhelming majority of management respondents in all regions of the world believe their current risk oversight processes are relatively immature.
- About one-third of organizations in Europe, Asia and Australasia, and Africa and the Middle East believe they have complete enterprise risk management in place, as compared to 24 percent in the U.S.
- Around 60 percent of organizations in Europe, Asia and Australasia, and Africa and the Middle East describe their ERM process as systematic, robust, and repeatable; 29 percent of U.S. organizations describe their processes in that manner.
- Less than 30 percent view their risk management process as providing competitive advantage.
- Seventy percent or more of boards in all regions of the world outside the U.S. are formally assigning risk oversight responsibilities to a board committee. Surprisingly, only 46 percent of U.S. boards are doing so.
- Few organizations (about 20 percent) integrate risk management activities with performance compensation and most (about 80 percent) have not invested in risk management training for executives.
- Across most dimensions, enterprise risk oversight in U.S. organizations is lagging in its maturity relative to organizations in other regions of the world.
Calls for Action
The report’s findings indicate that the level of enterprise-wide risk oversight has real room for improvement. Much of the evidence in the report suggests that non-U.S. organizations may be further down the path than U.S. ones. However, there are notable opportunities for improvement for all organizations around the globe. The report highlights a number of calls for action, including the following:
Boards and senior executives may benefit from an honest assessment of the efficacy of the organization’s current approach to risk oversight.
- Organizations have managed risks for decades often by having business functions manage specific types of risks with little coordination among those functions. Business leaders may want to consider the extent to which critical risks may occur and not be detected by silo managers.
- Because organizations understand the importance of taking risks to generate returns, executives should consider whether their risk oversight efforts are providing valuable input to the strategic planning process.
- For enterprise risk oversight to be a strategic tool, most organizations realize that risk management needs to move from a casual, ad hoc way of thinking to a structured and explicit set of risk identification, assessment and monitoring processes. The board and senior management may need to evaluate whether they have the right leadership structure to provide the needed guidance to ensure risk oversight is integrated effectively with the strategy of the organization.
