Regulations such as the USA PATRIOT Act are forcing both public and private enterprises to address all types of risk - not just financial. Enterprises can avoid non-compliance fines and penalties by establishing an Enterprise Risk Management (ERM) framework. IT leaders must be prepared because executives will soon turn to them for technologies that support these frameworks.

What Is Enterprise Risk Management?

ERM is a governance framework instituted by a firm's Board of Directors and senior management to provide information to the Board of Directors and to the Audit Committee on significant risks. The goal of ERM is to track, quantify, and respond to all potential categories of risk across the entire enterprise and create strategic initiatives for mitigation.

ERM Drivers

The following market drivers mandate the adoption of ERM programs:

• Regulatory bodies are stressing the importance of ERM. In September 2004, the Committee of Sponsoring Organizations (COSO) introduced an "Enterprise Risk Management - Integrated Framework." This framework goes beyond Sarbanes-Oxley (SarbOx) and is becoming a new standard for risk management in U.S. enterprises of all sizes and in all industries. Likewise, various regulatory bodies across the world, such as the U.K. Financial Services Authority (FSA), the Ontario Superintendent of Financial Institutions (OSFI), and the Australian Prudential Regulation Authority (APRA), have introduced similar ERM frameworks.
• External risks. Events like the 9/11 attacks and recent natural disasters demonstrate the importance of an ERM program. Although enterprises don't have control over external risks, managing such risks through ERM can reduce their impact.
• Emerging business models. Market trends such as offshoring, outsourcing, and global supply chains create new risks that must be addressed in an enterprise-wide basis.
• Regulations beyond SarbOx. New regulations that go beyond the scope of SarbOx, such as the Basel II Accord and the USA PATRIOT Act, are driving the need to manage risk in broader terms. For example, the Basel II Accord addresses not just capital risk, but also operational and technology risks. It mandates that by year-end 2006, financial services companies must carry enough capital to offset the risk levels of the enterprises.
• Ineffectiveness of isolated risk efforts. Fragmented risk management efforts result in tactical rather than strategic responses to risk. A recent study of 100 companies by Deloitte & Touche found that 80% of companies that suffered the largest share value losses were exposed to multiple interconnected risks. These enterprises concentrated their efforts in managing only one type of risk and had too much exposure to others. An integrated ERM program resolves this issue by establishing mechanisms to mitigate risks created in one department that have an outcome in another.

ERM Benefits

In 2005, Mercer Oliver Wyman, a leading financial services and risk management consulting firm, sponsored an ERM study in a wide variety of industries across North America and Europe. Among 271 executives surveyed, over 90% of them are establishing or planning to establish ERM programs in their enterprises. Enterprises with ERM programs in place reported the following top three benefits:

• 86% of respondents reported better-informed decisions.
• 83% of respondents reported greater management consensus.
• 79% of respondents reported increased management accountability.

Other benefits attributed to ERM include the following:

• Enhanced reputation and transparency facilitate sustainability, and increase confidence on the part of the board of directors, the investors, regulators, employees, and customers. Ultimately, this results in stock price appreciation.
• An integrated view of the entity risks allows a more effective assessment of capital needs and improves the capital allocation process.

Bottom Line

SarbOx is just the beginning of the implementation of broader ERM programs. IT leaders that understand the business aspects of ERM will be in a better position to implement the proper technologies to support this crucial initiative.