The Future of Enterprise Risk Management
Source: Journal of Accountancy
In this article, Kenneth A. Merchant maintains that the enterprise risk management (ERM) processes currently used by most companies are inadequate and that poor risk management was “at the heart of the 2008-09 U.S. economic crisis.” Following are some of the problems with current ERM practices:
- They help identify and prioritize “bad risks,” but they do little to manage “good risks” or help companies keep their activities within their risk appetites.
- They're effective in predicting risk by extrapolating historical patterns, but they're of little help in anticipating unfamiliar risks or compensating for inherent human limitations and biases.
- They provide a subjective assessment of the likelihood and severity of certain risks, but they generally don't quantify these risks and compare them over time or benchmark them against a company's peers.
Merchant offers four suggestions for improving ERM:
- Manage good risks by using scenario planning, opportunity/threat analysis, and engaging independent advisors to provide objective input;
- Encourage people involved in risk management to “think outside the box”;
- Minimize cognitive bias by providing managers with checklists, training and other tools;
- Develop a more objective “risk scorecard” that provides an early warning system for emerging risks.
For the complete article, read “ERM: Where to go from here.”
From Journal of Accountancy, American Institute of Certified Public Accountants, September 2012, http://www.journalofaccountancy.com/Issues/2012/Sep.