Many firms unprepared.

• Author: Heffes, Ellen M.
• Position: RISK MANAGEMENT - Survey - Brief article

A new report indicates that few organizations are formally prepared to manage their risk, even in the wake of the recession that was brought about by poor risk management at financial institutions and leading banks.

The 2008 ERM Benchmarking Survey conducted by The Institute of Internal Auditors Research Foundation (IIARF) found that of 240 organizations recently polled, only 40 percent have implemented a formal enterprise-risk-management program.

In fact, 14 percent of chief audit executives who responded to the survey said they've recommended implementing a risk-management process to their management and yet they still lack a program.

As indicated by survey results, the No. 1 guiding framework for formal and informal risk-management processes is The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management--Integrated Framework.

Among the other key findings:

* Approximately 68 percent of organizations report they have a risk-management philosophy in place.

* Key risk-management...