The paper said there was an "apparent failure to develop and reward internal risk management competencies. From the board room to the trading floor, individuals on the front line who were taking--and trading in--these risks ostensibly were rewarded for short-term profit alone."

Finally, the report said, there was a failure to "use enterprise risk management to inform management's decision-making for both risk-taking and risk-avoiding decisions."

Robert P. Hartwig, president of the Insurance Information Institute in New York, recently criticized current enterprise risk management frameworks in elements of the financial services sector. He said in an e-mail that "the financial crisis is the result of a failure of risk management in the banking and securities markets on a colossal scale."

Mr. Hartwig said that "very fundamental and tough questions about the practice of risk management worldwide must be asked and answered, including:

o How did so many major, allegedly sophisticated financial players miss or overlook such huge, systemic exposures?

o What other shoes might yet be left to drop?

o How can we prevent this from ever happening again?"

Ms. Fox, who is senior director of risk management of Convergys Corp. said that to be effective, ERM must "fundamentally change the ways organizations think about risk."

When ERM becomes part of the "DNA of a company's culture, the warning signs of a market gone astray cannot go unseen so easily." She said that "when designed and implemented systemically, ERM can change future outcomes. When it's practiced fully, ERM enables overall business performance."

She explained that many financial organizations:

o Failed to adopt an ERM culture.

o Failed to embrace and demonstrate appropriate ERM behaviors.

o Failed to develop and reward internal risk management competencies.

o Failed to use ERM to inform management decision-making in both taking and avoiding risks.

She noted that RIMS believes the financial crisis is a "call to action," adding that the financial crisis makes an even stronger case for ERM.

"We consider this white paper an imperative and wakeup call," adding that to "prevent another financial catastrophe, now is the time to consider implementing an ERM program--or work feverishly to improve the one you have."

She added that RIMS is positioned to help drive leadership competencies with its Risk Maturity Model and other tools.

Ms. Fox also pointed out that not all organizations failed in their ERM processes, and that ERM made a difference for Goldman Sachs.

"When they started seeing deviations from their expected outcomes," she said, Goldman Sachs "began to look deeply at risks and, as a result, in 2006 began to pull back from these mortgage securities."

In the RIMS webinar, she added that "at a time when everyone else was jumping in, they were actually taking a reverse position than most of the market, which helped them to be one of the companies that was most resilient."

When reviewing their governance infrastructure, she said, companies need to be sure they have "authorized escalation points outside of the normal reporting" and ways to make sure important information gets to the board or decision-makers.

One factor leading to the failures of financial companies, she said, was an overreliance on the use of financial models, "with the mistaken assumption that the risk quantifications based solely on financial modeling were reliable as predictive tools to justify decisions to take risk in the pursuit of profit."

However, most financial models rely on an expected distribution of losses based on past experience, she explained.

While financial institutions expect there will be losses and manage the risks based on mathematical predictions, the "probabilities of greater deviations are commonly believed to be insignificant--and returns often are lucrative," meaning the financial models often are ignored, she said.

While financial modeling can raise important issues, Ms. Fox said it can "entirely miss other areas that present equal or other serious consequences."

Another factor in the financial meltdown, she added, was an overreliance on compliance and controls to protect assets, "with the mistaken assumption that historic controls and monitoring a few key metrics are enough to change human behavior."

Ms. Fox said controls typically are based on standards or regulatory guidance. Standards, she explained, are a collection of best practices and guidelines, which are developed collaboratively over time and based on experience.

"They are expanded or modified periodically to reflect new practices," she said. "As such, controls do not evolve in scope or speed to keep up with new risks being taken," and are not designed to be predictive of emerging or future risks.

Ms. Fox said another cause of the financial breakdown was "a failure to properly understand, define, articulate, communicate and monitor risk tolerances, with the mistaken assumption that everyone understands how much risk the organization is willing to take."

She added that with "20-20 hindsight, one can only speculate that if a fully understood risk tolerance level had been imposed by all financial institutions on their respected mortgage securities exposures and the market of collateralized debt obligations regardless of probability metrics, the current crisis may have been mitigated to a large extent, if not prevented altogether."

She charged that there was "a failure to imbed ERM best practices from the top down to the trading floor, with the mistaken assumption that there was only one way to view a particular risk."

Ms. Fox added that although financial institutions were among the early adopters of ERM, "even if senior leadership sponsors the development of an ERM program, that's not enough for ERM's foundational principles to take root and flourish."

She explained that as human beings, "we tend to focus on what we expect to see. In such an environment, the credit risk of collateralized debt obligation securities was missed. What was viewed by at least one company as a market risk turned out to be, in fact, a credit event. As a result, organizations were caught unaware."

With the failures at Fannie Mae and Freddie Mac, she noted, Rep. Henry Waxman, the California Democrat who chairs the House Oversight and Government Reform Committee, said that "their own risk managers raised warning after warning about the dangers of investing heavily in the subprime and alternate mortgage market, but these warnings were ignored."

This example, she said, illustrates a governance failure--preventing a direct connection "between the risk management function and the persons responsible for monitoring the adherence to risk management principles."