• Companies in top 20% of risk maturity globally generate three times level of EBITDA as those in bottom 20%.
  • Financial performance is highly correlated with level of integration and coordination across risk, control and compliance functions.
  • Top-performing companies (from a risk maturity perspective) implement on average twice as many of key risk capabilities as those in lowest-performing group.
  • Leveraging IT controls and GRC software tools can significantly reduce cost of risk management, versus manual controls.

17February 2012: Over the last decade companies around the world have made substantial investments in personnel, processes and technology to help mitigate and control business risk. Historically, these risk investments have focused primarily on financial controls and regulatory compliance, however new evidence suggests that can they can also play a strategic role within the enterprise financially.

Turning risks into results, a report released by Ernst & Young, has identified that the level of risk investment can impact on the financial performance of an organization. The study identified that companies in the top 20% of risk maturity, where maturity was defined by the number of risk management practices applied, generate three times the level of Earnings Before Interest, Taxes, Depreciation and Amortization (EBITDA) as those in the bottom 20%.

Previously, senior executives may not have perceived risk management as strategic to the enterprise, or lacked sufficient confidence in their ability to identify and address the risks that could impact the financial performance, or even the viability, of their organization. This is no longer an option.

Commenting on the findings, Randall Miller, Ernst & Young Advisory Global Risk Leader says “Making a move from being risk-averse to risk-ready may require a significant shift. Ultimately, risk management is about changing the culture of the business. It is about changing the lens through which leaders view the decisions they make.”

Using a global, quantitative survey (based on 576 interviews with companies from sixteen countries and information from 2,750 analyst and company reports), the study assessed the maturity level of risk management practices versus financial performance.

The study identified the leading risk management practices that differentiated the various maturity levels, and organized them into specific risk components. The results revealed that while most organizations perform the basic elements of risk management, top performers do more; and certain risk practices were consistently present in the top performers:

Enhance risk strategy

For effective strategy and governance, proper oversight and accountability at the board and executive levels is critical. Ownership of risk throughout the organization is also needed and at the management level, executives play a crucial role in assessing and managing risk.

Embed risk management

Organizations that embed risk management practices into business planning and performance management are more likely to achieve strategic and operational objectives. Conducting an enterprise risk assessment can help to prioritize and identify opportunities for improvement.

Optimize risk management functions

By aligning and coordinating risk activities across all risk and compliance functions, organizations can reduce their risk burden (overlap and redundancy), lower their total costs, expand coverage and drive efficiency.

Improve controls and processes

By optimizing controls around key business processes, harnessing automated versus manual controls and continuously monitoring critical controls and key performance indicators by leveraging GRC (Governance, Risk management and Compliance) software tools, organizations can improve performance and reduce the cost of controls spend.

Enable risk management, communicate risk coverage

Moving an organization from being risk-averse to risk-ready requires executives who lead by example and tone-from-the-top support. For maximum benefit, regular and open communication with all stakeholders, third-party assurance and the leveraging of technology are required.

Paul van Kessel, Ernst & Young Advisory Global IT Risk and Assurance Leader concludes “Companies that succeed in turning risk into results will create competitive advantage through more efficient deployment of scarce resources, better decision-making and reduced exposure to negative events. Now is the time for senior business executives to begin applying a broad ’risk lens’ to the business.”

About Ernst & Young's Advisory Services

The relationship between risk and performance improvement is an increasingly complex and central business challenge, with business performance directly connected to the recognition and effective management of risk. Whether your focus is on business transformation or sustaining achievement, having the right advisors on your side can make all the difference.

Our 20,000 advisory professionals form one of the broadest global advisory networks of any professional organization, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and superior client experience. We use proven, integrated methodologies to help you achieve your strategic priorities and make improvements that are sustainable for the longer term.

We understand that to achieve your potential as an organization you require services that respond to your specific issues, so we bring our broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where the strategy is delivering the value your business needs. It’s how Ernst & Young makes a difference.

About Ernst & Young

Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 152,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential.

Ernst & Young expands its services and resources in accordance with clients’ needs throughout the CIS. 4000 professionals work at 18 offices in Moscow, St. Petersburg, Novosibirsk, Ekaterinburg, Kazan, Krasnodar, Togliatti, Yuzhno-Sakhalinsk, Almaty, Astana, Atyrau, Baku, Kyiv, Donetsk, Tashkent, Tbilisi, Yerevan, and Minsk.

Ernst & Young established its practice in Ukraine in 1991. Ernst & Young Ukraine now employs more than 500 professionals providing a full range of services to a number of multinational corporations and Ukrainian enterprises.

For more information about our organization, please visit www.ey.com/ua.

This news release has been issued by EYGM Limited, a member of the global Ernst & Young organization that also does not provide any services to clients.