Most of us are trained to prove the value of an investment before any corporate resources are devoted to process change or the purchase of products or services. So how do we assess return on investment (ROI) to prove the benefits of enterprise risk management (ERM) solutions? The answer can be simple, very complex, or impossible to determine depending on your thoroughness and research accuracy standards.
ROI analysis includes accounting for all the net benefits (cost reductions, revenue increases, etc.) likely to occur after an investment is made compared to the costs of implementing and using a new solution.
ROI calculation is a fairly straight-forward exercise when the investment is a specific product or service to improve a well-defined vertical or horizontal business process. Readily available accounting information within an organization and industry standards provide useful data points. But enterprise risk management introduces two broader management concepts when assessing the total benefits of investing in ERM solutions: enterprise-wide outcomes and risks.
Analysis of an enterprise-wide program dictates isolating the effect the solution has on the bottom-line financial results for a company, as well as an organization's market valuation. When you add in a corporate risk perspective with all of the permutations of known and unknown, frequency, and severity components, a cost benefit analysis of the value of risk management software or risk management services investments can quickly appear unwieldy.
Consider the Total Value Return on Investment for ERM
We can apply the usual ROI analysis to pre- and post-implementation labor and resource requirements for risk management processes, but this blog post will focus on the nuances of establishing a more comprehensive cost benefit perspective that encompasses the Total Value Return on Investing (TVROI) in risk management solutions. These benefits include
- reducing the enterprise-wide costs of managing risks,
- reducing residual risks,
- avoiding regulatory scrutiny and fines,
- gaining favorable reviews from credit ratings agencies,
- positioning the enterprise to exploit risk events (i.e. creating not only a resilient organization, but, in Nassim Nicholas Taleb's view, an antifragile entity), and
- raising organizational value.
Typical ROI research and analysis will address the first point. Any investment in a product, service, or new process should ensure a positive cost-benefit differential on the net present value of the resources directly committed to the business process. ERM solution vendors should prove their value by first demonstrating how their product or service will enhance worker and technology resource productivity across the risk management process (including context setting, risk identification, assessment, decision making, action, communication, and audit activities).
Most ROI analysis today stops at this first step, but resource efficiency is just a primary benefit of ERM solutions. In contrast to a product that supports claims management processes, for instance, an ERM solution goes beyond process efficiencies and enhances organizational value itself. The secondary and tertiary benefits noted in points two through six above can provide additional evidence of a positive ROI that should be presented to your investment decision makers and budget gatekeepers.
True enterprise risk management solutions, which address organizational objectives and risks holistically, will enable a company to identify, assess, and manage a broader set of business risks with greater efficiency. This will provide the added benefit of incrementally reducing residual risks. Now the ROI calculation has moved beyond assessing process efficiencies into a value that leverages a risk manager's core expertise.
Moving further along our benefits list, points three and four may include some speculation, but should be quantified and added to ROI calculations. Implementing an ERM solution by itself will have beneficial results with regulators and ratings agency analysts who consider risk management maturity in their company analysis. Cost benefits include not just the direct reduction of time committed to responding to these agencies, but also (1) the avoidance or mitigation of fines from government agencies, and (2) the reduction in cost of capital that may result from improved credit agency ratings.
Points five and six introduce greater complexity for ROI analysis, but should be considered in any thorough ERM ROI evaluation. Unfortunately, risk management is too often associated with time-consuming checkbox and list building exercises rather than an effective decision-making tool. Risk management standards and risk managers are slowly steering ERM toward its greater value as risk-reward tradeoff analysis to help optimize decisions in support of organizational goals. From this perspective, risk management value should include the benefits of both mitigating downside risks and positioning an organization to take advantage of upside potential as risk events occur.
If we are intellectually honest, we must acknowledge a full ERM ROI calculation including the last point cannot exist because of a blatant Catch 22. To assess the benefits of investing in an enterprise-wide risk management program, a company would have to identify how its risks would be better managed, and you cannot assess your risks and how they will be managed until you have a comprehensive program in place. Industry peer group analysis and best practice references can help overcome this hurdle.
Connecting ERM to Rising Organizational Value
The sixth point, ERM's benefit in raising organizational value, is a more elusive notion. If all the other benefits noted above are in place, logic suggests a business' market valuation will rise. However, cause versus correlation questions accompany any analysis relating ERM maturity levels with market valuations. A study by the Journal of Risk Insurance indicates mature enterprise risk management practices can realize up to a 25% valuation increase.
The team of academics that published "Does enterprise risk management influence market value – A long-term perspective" tempered this conclusion with empirical findings showing the positive effects of mature ERM implementation on market value lasts 2.67 years on average. While this raises questions about how ERM practices should evolve over time, it is clear the failure to invest in risk management will hinder the value of an organization relative to peer group benchmarks.
As corporate risk management practices evolve, risk management software companies, risk management consultants, and risk information providers should extend their marketing statements to emphasize values including speed, breadth of risk source coverage, automation, analytical capabilities, and reporting efficiency. Risk managers and decision makers seeking funds to invest in these resources will have to carefully identify and present all of the advantages of enterprise risk management beyond mere process efficiency.
If you are interested in further exploring TVROI analysis of risk management solutions, or you need support conducting an ROI research project, contact IMT to find out how we can help. IMT industry market research consultants engage with both (1) risk management vendors who want to document evidence of their offering ROI to support their sales and marketing efforts, and (2) enterprise risk managers and decision makers who are developing proof of value for investment decisions.