Ever since the financial crisis of 2008, when risk managers on Wall Street watched helplessly as their businesses melted down, increasing attention has been paid to enterprise risk management. Many companies have since launched new ERM programs or poured more resources into existing ones, prodded in part by increasing regulatory and rating-agency scrutiny of corporate risk management.
It’s no surprise that many ERM programs — which take a holistic view of a company’s myriad risks, identifying the material ones and devising ways to tame them — are focused on risk avoidance. But if some risk managers dream of black swans and fat tails, others have visions of lower costs and market share. At a growing number of nonfinancial companies, like Lego, Safeway and General Motors, enterprise risk management is a means of creating value and competitive advantage.
“Historically, risk departments have often been seen as the department that says no, brought in at the end of a decision process to validate a course of action,” says Steve Culp, managing director of Accenture Management Consulting’s risk management group. “But if you believe you need to innovate to grow, you must also understand that you need risk with you from the beginning, to understand what new challenges will come and how you can best mitigate those.”
Taking the “Right Risks”
In a 2010 study of risk management, Aswath Damodaran, a professor of finance at New York University’s Stern School of Business, breaks risk down into three categories: risks that firms can pass through to investors, risks they can avoid or hedge, and risks they can exploit more effectively than their competitors can. “Successful firms, over time, can attribute their successes not to avoiding risk but to seeking out and taking the ‘right risks,’” writes Damodaran.
He adds, “Risk taking that increases potential upside [risk] while minimizing or reducing downside risk can provide the best of both worlds: higher cash flows and lower discount rates.”
To ensure that the “right risks” are taken, ERM and strategy should be aligned, say experts. For example, says Culp, a company might want to enter China with the goal of having 30% of its revenues come from there in five years. But it stands a good chance of failing unless it understands the risks involved with entering that market — concerning tools, technology, staffing, competitors, changing customer needs and so on.
“If everyone is on the same page, they can maximize the potential value of enterprise risk management: to increase firm value,” says Kristina Narvaez, president of ERM Strategies, a consultancy. She cites Zurich Insurance Group and the University of California system as organizations that have leveraged ERM to create value. In its 2011/2012 annual report, the university’s Office of Risk Services reported that ERM had reduced its cost of risk by a whopping $493 million since 2003, a measure that includes self-insured losses, premiums, claims administration, and loss control and loss prevention expenses.