She explained that “More than anything,” the survey is a “message of hope because companies that have done this well are going to be in a better position competitively–and have a better competitive advantage–because they have a better way of thinking about risk that's consistent across the organization.”

A correlation between ERM and better business performance is proven by the study, she said. “Interestingly, when a project manager went back and looked at companies that scored high, they actually did possess higher credit ratings,” she explained. “Low scoring companies typically possess lower credit ratings. This should show senior leadership that there is a value in ERM.”

She added that there are key affirmations with the study. “The organizations with ERM have a concrete advantage in risk management competency,” she noted, adding that a full “93 percent of organizations with formalized ERM programs make better risk informed decisions.”

However, she noted, “The “ah-ha” was that the organizations with ERM still fall significantly short of achieving a managed or better level of risk maturity. “

Based on guidelines, Ms. Fox said, only 4 percent with ERM programs reported they have achieved a managed or better level of risk management competency in all of the risk competencies that are in the maturity model.

“That was a surprise,” she said.

Why? Because ERM isn't as easily embedded in an organization “as people might think. It takes a lot of work to get it embedded into all of the business areas,” she said. “It's more than just doing a risk list, it's about managing those risks,” she explained.

The result, Ms. Fox observed, is that a number of organizations have a false sense of security, “meaning that while they may feel they have embedded their programs they may not have. They may be very leading-edge and doing some great things, but in terms of encompassing the entire enterprise or having owners for those risks, it's not as comprehensive as they might believe.”

She noted also that many risk managers are “in the same boat. Truly practicing ERM takes time, it doesn't happen overnight.”

In an ERM program, she said, there are always emerging risks to deal with. “From that perspective, it's something we struggle with,” she said. “The other side is that to do this at a leadership level across the enterprise is quite an undertaking and it is turning that theory into a practical how-to.”

To help risk managers, she said RIMS has focused on helping them understand what other practitioners are doing.

“Going through the different competencies is more than having a process in place. If you think of competencies as a behavior, it deals with culture and understanding an organization's risk appetite–imbedding the process of uncovering risk and who owns it–to make the business more resilient and sustainable,” she said.

According to the study, formalized infrastructures in well-managed ERM programs embody the 68 best practice guidelines for efficient and effective risk management programs as presented in the RIMS Risk Maturity Model for ERM.

Among the key Findings were:

o Organizations that have embraced ERM have realized a concrete advantage in their risk management competency. The study found that 93 percent of organizations with formalized ERM programs in place make better risk-informed decisions–a recognized competitive advantage over those that do not have an ERM program.

The study concludes that better managed companies in terms of ERM practices benefit from better business performance.

The RIMS State of ERM Report 2008 is available for free to risk practitioners who complete an online Risk Maturity Assessment at: http://www.RIMS.org/RMM.