Risk managers struggle with too few staff: Report

Top challenges for risk managers include a lack of personnel and working at organizations where other areas receive a higher priority than risk management, according to a report on strategic risk management.

The lack of staff dedicated to risk management ranked highest on a respondents' list of challenges to improving the practice of risk management in their organizations, with 44% citing that lack as a challenge, according to “Excellence in Risk Management VII: Elevating the Practice of Strategic Risk Management.” The report—a joint project of Marsh Inc. and the Risk & Insurance Management Society Inc.—is slated to be released at RIMS' annual conference in Boston today.

Having other areas with greater priority than risk management was cited as a challenge by 43% of the respondents. Demonstrating the value of risk management ranked third, at 34%. Lack of financial resources dedicated to risk management, and senior management commitment rounded out the Top 5, cited by 33% and 32% respectively.

“I think it's significant that almost half—43%—identified as a significant barrier that other areas are taking priority,” said Pam Rogers, a Minneapolis-based Marsh senior vp. Risk managers should understand what those other areas are and their concerns, which could open up opportunities for risk managers, she said.

“It is an opportunity for risk managers to link into what are those areas of concerns,” said Deborah Luthi, RIMS vp and director-enterprise risk management at Sacramento, Calif.-based Matheson Inc. Doing so would allow risk managers to be innovative within their organizations, she said.

The survey also found that the percentage of respondents saying they had a formal enterprise risk management program increased to 28% in 2010, up from 9% in 2009 and only 4% in 2006. But 53% of respondents who said they had no formal enterprise risk management program spiked in 2010, continuing a five-year trend. That compares with 35% in 2009 and only 27% in 2006. The remaining 19% said they were building or implementing ERM.

Ms. Rogers said the survey showed “a clear indication that companies realize they need an organized approach to risk,” but are “not necessarily doing that in what the industry has dubbed the ERM framework.”

Respondents indicated that risk management in most organizations does not have a significant impact on setting the organization's business strategy. In fact, only 24% of the respondents replied that risk management has a significant impact on setting business strategy, while 62% said it has some impact, and the remaining 13% said it had no impact.

When asked, “What barriers are in place that may prevent your senior management and board of directors from fully understanding the risk landscape of your organization?,” 40% of the respondents cited “siloed approaches to risk management” as a barrier. Thirty-six percent cited lack of education and awareness of concepts such as enterprise or strategic risk management, and 34% pointed to inadequate representation of the risk management function at the board and executive level.

Ms. Rogers said risk managers have a “real skill set” in building partnerships, and they have an opportunity to capitalize on that ability. They can bring an organized framework for dealing with risk to senior executives, said Ms. Rogers. In the absence of anyone else in the organization providing that, risk managers in organizations without ERM may find an open door to bring that to the table.

“Where there's murkiness and lack of understanding, risk mangers have to open that door and walk in,” said Ms. Luthi.

The survey, which was conducted online during the first quarter, was based on the responses of 418 respondents. Forty percent represented public companies, 35% private, 15% nonprofits and 10% governments. Three-quarters described their job function as risk manager, 15% C-Suite, 7% finance and the remainder “other.”