Today I am going to review a new survey and then suggest a better way to survey and assess the effectiveness of risk management.
The CPA firm of Baker Tilly and the Institute of Internal Auditors’ Internal Audit Foundation have published a whitepaper, Enhanced Enterprise Risk Management and Strategic Decision-Making.
While I am not sure they asked all the right questions, some of the results are insightful, as were some of the overall comments. For example:
Enterprise risk management has come a long way, yet many organizations still struggle to turn risk intelligence into strategic advantage.
Deloitte asked a more insightful question, seeing whether executives believe risk management helps them develop and then execute on their business strategies. Just 13% (a number that has been consistent over the years) said that it does it very well.
The IIA whitepaper relies on an earlier study by the ERM Initiative at North Carolina State University in reporting that “The percentage of organizations claiming to have complete ERM processes in place jumped from 9% in 2010 to 34% in 2023”. However, that study only asked for a self-assessment by practitioners (i.e., not management or the board, the customers) of “ERM maturity”, and it is difficult to believe that 34% of organizations have anything like effective…
