The finding, he said, “raised a flag that as risk managers we need to step up to the plate and keep ERM up.”

Pamela G. Rogers, senior vice president, risk consulting practice with Marsh, said this may be reflecting a major hurdle with implementing ERM–the difficulty of getting it established in an organization, particularly during the first year.

“It's difficult, cumbersome and can be expensive,” she said. “Firms tend to get frustrated. But once they're along the path in an ERM process, they find good results.”

She added that solid ERM processes don't happen overnight, and usually take a year or so to implement. However, “Once they get over the hump, there is satisfaction with the program.”

It's helpful to reaffirm to others in the company that this difficult period is part of the process. In fact, she said, one survey question asks where those doing ERM are investing most. The number-one response, she said, “was education for people who wanted to keep ERM going, so it speaks to that point.”

Another survey finding was that about two-thirds of chief financial officers classify their firms as traditional, whereas only one-third of the risk managers do. Traditional approaches to risk management are risk identification, loss control, claims analysis and insurance.

“There's a gap there. There's something to be learned by the risk managers there,” Ms. Rogers said. “So we look at what skills they need to move more towards strategic–and how do they get that message across and sell themselves to senior management?”

This is one of the reasons RIMS began development of its career path program–the “Professional Growth Model”–this year, released at the conference, “to get people specific information and advice about how you actually become strategic and what skills you need,” she said.

According to Marsh, 52 percent of traditional firms aspire to become strategic, and 73 percent of progressive firms have similar goals.

While it appears that the percentage of firms with a likelihood of implementing an ERM-type process might plateau at 60-65 percent of firms, Ms. Rogers said there is still a great amount of interest in how to do an ERM program.

“That's because of these two-thirds, most of them are along the path,” she said. “Many are still in the planning phase, some are just partially implemented.

Focusing on firms that have no plans to implement ERM, Ms. Rogers highlighted differences in the reasons risk managers and CFOs gave for this. While 58 percent of risk managers said “other areas have greater priority in the company,” more than half of CFOs said they lacked the personnel resources to do it.

“What does this mean–that the C-suite is not viewing the risk manager as being the resource to do it?” she asked. “Does this mean they don't have enough heads, or they don't have the right heads?”

This presents “another red flag for the risk managers,” she said.

Rounding out three categories of risk sophistication, Marsh reported that 49 percent of firms said their level of risk sophistication is progressive. Progressive approaches add alternative risk financing, business continuity planning, total cost of risk measurement and education to traditional tools.

The study, the fifth annual RIMS/Marsh collaboration, includes sections devoted to new topics this year, including the incidence and handling of high impact/low probability risk, and management of supply-chain issues. (See NU Online News Service for results in these areas.)