While many companies have adopted enterprise risk management,current ERM processes are “primitive,” according to an article inthe Journal of Accountancy by Kenneth Merchant, chair ofaccountancy at UCLA.

Companies aren't good at weighing good risks and most cannotquantify their risk appetite. The basic problem is that humans arelimited in their ability to conjecture about things that have yetto occur.

The article notes that while companies often quantify theirrisks according to likelihood, severity, and even velocity, fewtake those scores and use them to come up with an overallassessment of whether the company will meet its goals given itsoverall risks. Nor do they audit those scores, compare scores overtime or benchmark their scores with those of other companies.