In the recent Report on the Current State of Enterprise Risk Oversight: 2nd Edition,[1] 47.5% of survey respondents described their organization’s risk culture as either “strongly risk-averse” or “risk-averse.” Yet despite this tendency toward caution, 48.7% of respondents characterized the sophistication of their risk oversight processes as being “immature to minimally mature.” Why this dichotomy? The same survey also established that the top reasons companies do not embrace an enterprise risk management (ERM) approach to risk oversight are competing priorities, insufficient resources and — perhaps most importantly — a lack of perceived value.

As discussed in a previous column, many executives have become inured to the risk of loss and no longer consider it to be sufficient justification by itself for investment of scarce resources, despite the recent signs of improvement in the U.S. economy. The challenge for GRC executives advocating implementation of or improvements to ERM is to look beyond risk and make the case that an efficient and effective ERM program can create a positive, tangible impact on the top or bottom line.

GRC executives preparing to make the value case for ERM may wish to begin by refreshing their understanding of the company’s key strategic objectives and looking at ways that leveraging existing ERM programs or other existing risk management efforts can advance those objectives. Look next at what modest improvements could deliver significant short-term value, and use these improvements to anchor a broader case to implement or enhance the company’s ERM process. Let the outcomes of these efforts form the basis for a discussion with key decision-makers about initiatives and investments to be championed in the coming quarter and year.

This story is available in full at corporatecomlianceinsights.com.