Asking about the benefits of enterprise risk management (ERM) is similar to asking about the benefits of leading a healthy lifestyle. It may be more demanding at first to adopt good practices, but they eventually become second nature and provide many tangible benefits.

ERM protects value and creates value. It protects value by managing threats that can deplete assets, limit growth, reduce profitability and damage reputation. Conversely, ERM creates value by helping organizations improve their performance, including achieving their goals, strategies and objectives. Measuring the value of ERM is challenging because it involves trying to measure the effects of risks that did not occur, and trying to isolate the contribution of ERM from other sources of value creation. Doing so requires complex analyses that may not be very reliable.

A much easier way to understand the benefits of ERM is to consider examples what happens when risk management fails. For instance, the Deepwater Horizon oil spill resulted in losses exceeding $60 billion for British Petroleum. Lehman Brothers had a market value of more than $40 billion that entirely vanished as a result of its bankruptcy. Volkswagen reported $45 billion in costs directly associated with its emission scandal. Target lost more than $6 billion with its failed expansion into Canada. Boeing reported costs of approximately $20 billion from the crashes and grounding of its MAX 737 airplanes. The city of Detroit had $18 billion in debt and an annual deficit of $385 million when it declared bankruptcy. These organizations incurred staggering losses because they failed to manage risks. Many other examples of similar risk management failures could be mentioned.

The Fundamental Benefits of ERM

The fundamental benefits of ERM are the ability to achieve a collective understanding of organizational risks and make better decisions. With ERM, organizations design better approaches to identify, analyze and prioritize risks that affect performance and results. They develop integrated solutions that take into account the relationships and interdependencies of risks, and they allocate resources for risk management where they are most needed. ERM helps organizations develop a comprehensive view of all risks, not just the ones that are most obvious. For example, the possibility that a fire may occur at a manufacturing plant is obvious and usually well mitigated. However, the possibility that an organization may be dysfunctional is often not very well analyzed nor prevented. The costs are less visible, but they can be much more significant.

When trying to define and measure the fundamental benefits of ERM, it is useful to consider the outcomes that are sought. Risk management professionals should define these outcomes and develop objectives for achieving them. They should also develop indicators for measuring the achievement of the outcomes. Indicators can be developed by asking: How will we know if/when the outcome is achieved? and What kind of evidence do we need as proof that the outcome is achieved? Outcome statements are typically worded in a manner that reflects a desirable end state. Examples of risk management process and framework outcomes include the following:

.

The Limitations of ERM

While ERM has many benefits, it is important to remember that it also has limitations. For instance, ERM is not a substitute for ignorance, complacency, faulty judgment, reckless behavior and lack of ethics. These issues are highly problematic, especially when they are prevalent at senior executive levels. The accounting scandals of 2001-02, and the reckless investment behaviors that took place during the financial crisis of 2008-09 are examples of organizational failures that would have been difficult to prevent even if ERM practices were stronger. ERM can only be as good as the persons leading, supporting and participating in the effort. Quality individuals are essential for achieving the full potential of ERM, in the same manner as they are for organizational success in general.