The Theory and Practice of Corporate Risk Management*

Abstract

The financial crisis of 2008 and the resulting recession caught many companies unprepared and, in so doing, provided a stark reminder of the importance of effective risk management. While academic theory has long touted the benefits of risk management, companies have varied greatly in the ways and extent to which they put theory into practice.Drawing on a global survey of over 300 CFOs of non‐financial companies, the authors report that while most CFOs felt that their risk management programs have significant benefits, the risk management function in general needs more attention. A large percentage of the finance executives surveyed acknowledged that the most important corporate risks extend far beyond the CFO's direct reports, and that risk‐based thinking is not incorporated into everyday business activities or corporate strategies. A large majority of executives also said they were seeking a more widespread understanding of risk throughout their organizations—and many confessed their firms' inability, or lack of interest, in evaluating their own risk management functions. At the same time, the efforts of most companies to develop enterprise‐wide risk management (ERM) programs were said to fall well short of the comprehensive and highly coordinated programs envisioned by the proponents of such programs.Three areas of opportunity were clearly identified as having potential to improve corporate risk management in ways that increase firm value over an entire business cycle: Incorporate risk management thinking into the strategic planning process. Line executives, and not just technicians, need to be sensitive to risks, thereby building flexibility into the firm's business plan and its execution. Clearly define the objectives of the risk management function, in part by developing appropriate benchmarks. The risk management process should be subject to the same rigorous evaluation process that is used when measuring risks throughout the business. Instill a risk management culture throughout the organization. While an effective risk management function is necessary, only when employees at all levels of the company embrace risk management as part of their daily operations will the firm get maximum value from risk management.