The Enterprise Risk Management Imperative (Roundtable)

Enterprise risk management (ERM) isn't new; however, only a few organizations are practicing it at the highest possible level. But Sarbanes-Oxley and the introduction of a framework for defining ERM by The Committee of Sponsoring Organizations of the Treadway Commission (COSO) may be contributing to its advancement. Business Finance assembled a panel of risk management experts to examine key issues in ERM and offer suggestions for organizations that seek to embed this discipline in their business processes.

Business Finance: What internal and external pressures are driving companies to implement or expand enterprise risk management (ERM), and what are the specific impacts of those pressures?

William Spinard: One factor pushing ERM is the audit committee of the board. They realize that they may not have to know all of the risk management practices that are going on at the company, but they have to ensure that somebody knows them and that there's a process in place that covers all risk -- not just financial reporting risk.

Don Dixon: One external factor is pressure from the NYSE, which requires listed companies to discuss risk and disclose risk more actively than in the past. It's causing a lot of organizations to want to know more about ERM and what companies can do to meet new listing requirements.

Randall Buhlig: Rating agencies are another external factor pushing ERM. They are starting to look at risk management at corporations when assigning bond ratings. And I think we will see more of that over time.

Corey Gooch: Sarbanes-Oxley is a factor. The fact that the SEC talks about the COSO framework in the Sarbanes-Oxley regulations and the overall focus on internal controls and corporate governance are also important factors now in driving awareness about ERM.

Patricia Tilton: Another external factor driving ERM -- especially since Sarbanes-Oxley and the accounting scandals -- is the media impact and the related perception drivers of companies and their management, which can impact a company's reputation.

John W. Schaefer: Some factors driving ERM are industry-specific. For example, financial institutions and energy companies in particular have faced regulations that forced them to look at risk differently.