Enterprise Risk Management and Supply Chain
Risk Management:
Lots of Talk, Not Much Walk
The Changing Roles and Responsibilities of
Risk Management
Enterprise risk management
Over the past decade, the idea of treating risk across an organization has gained traction, driven in part by well-publicized failures of corporate risk management (Barings Bank, Enron, Long-Term Capital Management, etc). According to a global survey of 316 financial services executives by the Economist Intelligence Unit on behalf of SAS, more than 70 percent of respondents believed that the losses
stemming from the recent credit crisis were largely due to failure to address risk management issues. In response to heightened interest in ERM, standards and procedures have been promulgated by
organizations such as the Treadway Commission and RIMS, Inc.
Despite the heightened focus on ERM, only about 16 percent of organizations participating in the survey have fully implemented ERM programs, while more than a quarter of survey respondents said their organizations not only do not have an ERM program, they have no plans to look into ERM in the immediate future. About 28 percent have partially implemented an ERM program and 24 percent said their companies are investigating ERM but have not yet begun to implement a program. (Exhibit 5)
16%
28%
24% 4%
28%
Exhibit 5 - Enterprise Risk Management Program Status
Have fully integrated an ERM program
Have partially integrated an ERM program
Have begun to investigate an ERM program
Do not have ERM program, but planning to Do not have ERM program and have no plans
Large companies are far more likely than small companies to have fully implemented ERM programs: respondents from 24 percent of companies with revenue greater than $1 billion said their companies have fully implemented programs as compared to 10 percent of respondents representing smaller companies. Thirty-four percent of companies with revenue less than $1 billion said they have no plans to implement ERM as compared to 20 percent of larger companies.
Nearly two-thirds of banks have fully or partially implemented ERM programs, far and away the largest percentage of any industry. Roughly half of telecommunications, nonbank financial, information
technology and energy firms have fully or partially implemented ERM programs. On the other end of the scale, only about 13 percent of professional services firms have fully or partially implement ERM
programs, and nearly 38 percent of professional services firms said they have no plans to implement a program.
The risk management department is responsible for directing the ERM program in one third of the organizations with fully or partially implemented ERM programs,, while an additional 28 percent of risk management departments are fully represented in ERM activities, though not directing the program. (Exhibit 6) Professional service firms are least likely to have a fully implemented ERM program, but risk management departments are most likely to direct the few ERM programs that have been implemented in that sector. On the other hand, risk managers only rarely direct the ERM programs in banking firms, the industry group most likely to have a fully implemented ERM program. Industries with complex and highly specialized ERM needs, such as banking, telecommunications and energy, are the least likely to have the risk management department directing the ERM program.
33%
28% 33%
4% 2%
Exhibit 6 - Risk Managers' Role in ERM
Responsible for directing ERM activities
Fully represented in ERM activities
Occasionally involved in ERM activities
Not a part of ERM activities
Other
Written comments provided further insights into the widely divergent attitudes towards ERM implementation and the roles of risk managers in ERM implementation and management:
“We evaluated using ERM and do not feel that an ERM program is valuable. However, we are using segments of ERM and business modeling to reduce and mitigate risk factors in the business enterprise.” “My company embraces a wide range of risk mitigation and avoidance activities at multiple levels throughout the organization. We do not have anything formally entitled ERM.”
“I have been pushing ERM concepts for years with no buy in from senior management. Now the BOD is pushing for it and it is falling under a different part of the company - will see if it goes anywhere.” “The firm is moving towards the implementation … of an ERM process. Risk Management is at the center of this movement.”
“ERM leadership is separate from operational (insurance/claims) risk management. Each reports to different senior managers.”
“Enterprise Risk Management "ERM" is more of a buzzword than an industry fact.” Supply chain risk management
Far-flung global networks of suppliers coupled with just-in-time inventory management have thrust supply chain issues to the forefront of risk management challenges for many organizations. Supply chain risk management (SCRM) is a complex discipline that encompasses hazards such as natural
catastrophes that can fell suppliers and disrupt transportation channels, macroeconomic conditions that can drive suppliers out of business or force unfavorable consolidations, and political risks that can lead
to poor business climates in countries where suppliers are located. Typically the SCRM process requires coordination among several units of a company and close cooperation with suppliers.
Excluding “Don’t Know” answers, about 18 percent of respondents ranked their SCRM programs in the “mature” phase, but almost exactly twice that number said that SCRM was not viewed as a concern. (Exhibit 7) Of course, not all industries have extensive supply chains. More than half of organizations in the government/nonprofit sector and the nonbank financial industry, for example, claimed that SCRM is not an issue, as compared to only about 10 percent of information technology companies. Smaller organizations were far more likely than larger ones to state that they are not concerned about SCRM.
37%
25% 21%
17%
Exhibit 7 - Supply Chain Risk Management Program
Not viewed as a concern Beginning phase Establishing phase Mature phase
Thirty-nine percent of information technology companies have mature SCRM programs in place followed closely by banks at 37 percent. Industries that seemingly have clear exposures to supply chain vulnerabilities such as consumer discretionary, consumer staples and industrials scored comparatively low as concerns the percentage of companies with mature SCRM programs, with 14 percent, 19 percent and 19 percent respectively.
While some SCRM issues fall squarely in risk managers’ areas of expertise, risk managers are rarely the first choice for running SCRM programs: of companies with fully or partially implemented SCRM programs, risk managers are responsible for directing SCRM activities only 7 percent of the time. Another 31 percent are fully represented in SCRM activities, though not running the program. Nearly one half are occasionally involved in SCRM activities and about 12 percent have no involvement. (Exhibit 8)
7%
31%
49% 12%
1%
Exhibit 8 - Risk Manager Role in SCRM
Responsible for directing SCRM activities Fully represented in SCRM activities Occasionally involved in SCRM activities Not a part of SCRM activities Other
The level of risk manager involvement in SCRM varies materially by industry. Of survey respondents in the banking, professional services and telecommunications industries, none have risk managers running SCRM programs. Relatively few entities in the government/risk management sector have supply chain risk management programs, but risk managers are more likely to head the few that are in place in that sector than they are to head SCRM programs in any other industry group. Risk managers are more likely to head SCRM programs in small companies than in large companies.
Conclusions
SCRM and, especially, ERM are topics that have sparked considerable discussion in the risk management community, but so far have had relatively little impact on most risk managers. Only about 15 percent of respondents have fully implemented ERM programs, and risk managers only occasionally have a
leadership role in those programs. A similar percentage of companies have “mature” SCRM programs in place, though the number varied widely by industry. Risk managers have a leadership role in only 7 percent of companies with SCRM programs in the “establishing” and “mature” phases.
____________________________________________________________________________________ This is the second paper of two part paper series. The first paper is titled “The Evolving Role of the Risk Manager (1980-2010).” The entire paper originally appeared as a chapter within the 2010 RIMS® Benchmark Survey™
