How D&B Succeeds with ERM

I've been researching Dun & Bradstreet’s (D&B) enterprise risk management (ERM) initiative, which I'll report on in the December issue of the print magazine.

D&B's ERM initiative has achieved success – the privately held convenience store chain Wawa has used D&B’s program as a benchmark – thanks to the following qualities:
Specificity: Executive support is vital, agrees Dun & Bradstreet Chief Risk Officer Charles Pavlonis. Obtaining the support requires a highly specific description of what the ERM program is designed to accomplish. “Without that specificity,” he notes, “you can generate a lot of paper, charts and all that good stuff, but it will not be taken seriously because the value is not clear.”
Visibility: Pavlonis, his C-level colleagues and the board can see and respond to all of the risks across the enterprise thanks to an organizational structure in which the company’s four major risk areas (strategic, operational, reporting, financial reporting and compliance) all report into Pavlonis’ corporate risk management function. “If you can get one leader who pulls all of the disciplines together that is a major advantage,” Pavlonis says. “Our audit committee is a huge fan of what we’re doing... They can see the efficiency we operate with and how all of [our work] ties back to the enterprise risk assessment.”
Credibility: Rather than trying to do too much too soon, D&B’s corporate risk function started the full-fledged ERM program with a single initiative – bringing back in-house a previously outsourced internal audit (IA) function. The first operational audit the newly native IA function (an important component of the overall ERM structure) conducted produced insights the company did not have had prior to the move.
SOX Virtuosity: Before launching ERM, D&B wove its Sarbanes-Oxley compliance program into its day-to-day operational flow – something many companies have yet to accomplish. “Companies that are struggling year-to-year with Sarbanes-Oxley compliance," Pavlonis adds, "have a distraction that does not allow them to free resources to conduct the other risk assessments they need for ERM.”