Boston

Private companies, despite being exempt from any government mandate, must be prepared to disclose details of their enterprise risk management programs because of their dealings with public firms that must comply with SEC requirements, one leading brokerage warns.

That assessment by officials from Marsh was prompted by results from a survey of risk managers conducted by the insurance broker in conjunction with the Risk and Insurance Management Society, released during the RIMS Conference here.

The “7th Excellence In Risk Management” survey of 418 respondents asked if their company was ready for new Securities and Exchange Commission requirements regarding boards to disclose their enterprise risk management preparations.

Of public companies that responded, 78 percent said they were prepared for such disclosure, versus only 22 percent of privately held companies and 32 percent of nonprofits.

During a panel discussion about the survey results, Matthew Allen, head of Marsh's enterprise risk practice, pointed out that private companies and nonprofits have not prepared for ERM disclosure because, unlike public firms, they are not required to report by law.

However, practically speaking, because they have dealings with public companies, privately held firms will need to make reporting preparations as well, he said.

The reason, he explained, is that private firms will be called upon to detail how they will mitigate the material risk they pose in their relationships with publicly owned counterparts, particularly in supply-chain situations, joint ventures, or the like.

The emphasis on disclosure of ERM programs is being generated by compliance with SEC Rule No. 33-9089. While the rules are technically limited to public companies, “what they [private companies] need to understand is they still have to come into compliance,” according to Mr. Allen.

Pamela Rogers, senior vice president with Marsh, noted that a major benefit for companies is that by concentrating on compliance, they will have to build a “good framework” for enterprise risk management, and that “can be beneficial to” all risk managers.

Outside of ERM disclosure, Ms. Rogers noted that one of the major challenges coming out of the survey for risk managers is “lack of personnel resources dedicated to risk management.”

The survey found 44 percent of respondents identified this as a major obstacle in elevating their risk management practices, followed by “other areas have greater priority” at 43 percent, and 34 percent citing “demonstrating the value of risk management programs.”

She said one of the major reasons for this is the economic challenges all corporations faced during the recession, as staff are among one of the first resources companies cut to save money.

To preserve their departments in the face of cost-cutting pressures, risk managers need to emphasize the importance of their discipline to their chief executives, which is essentially explaining the importance of spending money to avoid losses, she said.

Deborah Luthi, director of enterprise risk management services for Sacramento, Calif.-based Matheson Inc., as well as vice president of RIMS, noted that risk managers need to underscore their importance by demonstrating to senior management how much they would lose if they are unprepared and losses occur as a result.

Brian Elowe, managing director for Marsh, noted generally that concerns for risk differ markedly among risk managers, chief executives and finance departments.

Property risk was the number one concern among risk managers, but that area ranked third for chief executives and fourth among finance officials. Business interruption was the top concern among finance people, ranking second for risk managers and fifth for chief executives.

He said this is an indication that the interests of risk managers are not as well aligned as one might assume they should be with other members of senior management.

Risk managers are most comfortable with the handling of hazard risks, such as auto and property, Mr. Elowe noted, while strategic risks (including political risk and enterprise risk) and financial risk fall into the not-comfortable range.

The survey noted that climate change is the “most significant exception among hazard risks” as risk managers indicated they are least comfortable with this exposure.

The survey report found that climate risk receives the least attention “but also generates the most discomfort. In part, it remains a difficult risk for which to develop a management plan. It is also a subject that continues to generate controversy.”