I often receive inquiries from companies who have launched an Enterprise Risk Management (ERM) initiative, but are unable to move beyond their initial risk assessment effort. The exact reasons differ by company, but generally they include limited linkage of large risks and influence of those risks on business performance and lack of business unit understanding of their accountabilities for risk management. In most cases, the cause of the impasse stems from an approach that is overly focused on risk identification and awareness rather than on using ERM to improve return on capital and earnings and cash flow stability.

In many companies, ERM efforts stem from a board request to better understand risk or an attempt by management to achieve a standard of "good practice." Programs arising out of such mandates, though, are often undertaken without a clear understanding of objectives beyond the desire to "do something." Boards often don't clearly articulate what they want, and management does not know what they should be delivering or why, over both the short and long term. Unfortunately, ERM efforts with such beginnings are challenged from the start.

In such instances, the first step is often the creation of a risk profile in which the company develops a comprehensive list of risks and prioritizes these according to probability and severity of impact. The presentation of this risk profile frequently takes the form of an n-by-n matrix or "heat-map." It is here where-absent clear objectives-progress may begin to slow when, after investing great effort, management is unsure of what to do with the risk assessment output.