Part of what we’re looking at is what’s the objective of risk management in your company? How does that impact which practices you’re going to put in and what the implications are? One simple way to think about risk management is that all we’re trying to do is avoid risks or at least mitigate them if they happen. That’s only looking at the downside of risk. But if you really believe that there’s a risk/return tradeoff, is the only way to make higher returns to take on more risk? You can also use risk management to increase the value of the firm. Let’s take on the right risks. Let’s figure out where I have multiple risks in the firm, how they interact with each other — such that I don’t take one that has a big impact somewhere else.
So when you take companies that really see risk management as a value-enhancing objective as opposed to just a cost-minimization one, a way to avoid a problem — how does that impact the practices you actually put in, and which ones are more effective? And ultimately, how does that impact firm performance? Some of our initial results suggest that it makes a huge difference. The firms that have looked at this as a value-enhancing objective as opposed to just a way to minimize cost or avoid the downside are really the ones that are seeing any kind of real financial gain, as opposed to just minimizing costs from enterprise risk management practices.