Part I of this article by Phil Renaud shares leading research from more than 500 risk management practitioners across a broad cross-section of industries.
Each year we fund more than $100,000 of leading-edge risk research and we conduct one of the industry’s premier enterprise risk management surveys, polling more than 500 risk management practitioners across a broad cross-section of industries.
The purpose of this three-part article is to share the results of our fifth annual 2019 survey on enterprise risk management. This survey sought to understand how governance and culture influence the corporate risk management function. Specifically, the survey was comprised of 18 questions – some with multiple parts – that focused on five key areas: Organizational Structure and Tone at the Top, Integration of Risk Management into Decision Making, Scope of Risk Management, Risk Management Process, and Human Resources View of Risk Management. We received responses from risk executives at 551 companies which spanned a wide range in terms of size and revenue (e.g., 36% had total revenue less than 100 million and 18 % had total revenue of more than 10 billion). Further, 40% of respondents worked at public companies and nearly 20% were employed by financial firms.
This first article shares our research on how companies are building risk management capacity, especially through some measure of outsourcing. The first key finding was that approximately 30% of companies planned to increase the size of their risk management team, compared to the 2018 figure of 18% growth. This increase is largely within companies that are either privately held or not operating within the financial sector.
The second key finding is Corporate America is looking outside the company walls to grow the internal risk function by adding subject matter expertise through outsourcing. While only a small percentage (3% on average) expect to outsource the entire risk management function, 29% of respondents expected to outsource as much as 50% of risk management responsibilities. Furthermore, a large swath of non-financial firms (40%) expect to outsource some and or all of the function.
What is behind these trends? Is it a question of having insufficient expertise and skills among current internal staff?
Getting answers will be a source of ongoing study at the Risk Institute. We are keen to learn whether this is a matter of an aging workforce and the desire to retain knowledge by having “boomers” serve as consultants or in a part-time capacity. We also want to study how distance impacts the effectiveness of outside expertise. Are outsourced risk management experts limited by not living within the business day-to-day? How much do so-called “water cooler” talks matter? We will look at some of these issues in the next two parts of this essay.