Use of enterprise risk management at some financial firms stavedoff the financial turmoil that has hit many companies, according toa risk manager's group.

While failures of risk management are being blamed by many forthe financial crises in the banking industry, these issues did not"arise from a failure of risk management as a business discipline,"according to the Risk and Insurance Management Society Inc.

Companies that followed the precepts of risk management fortheir enterprise, like Goldman Sachs, helped protect their firmsagainst the downturn, said Carol Fox, former chairperson of theRIMS Enterprise Risk Management Development Committee, during ateleconference yesterday.

She discussed a paper released by RIMS, "The 2008 FinancialCrisis, A Wakeup Call for Enterprise Risk Management (ERM)," thatcalled the financial crisis a result of a "failure to embraceappropriate enterprise risk management behaviors--orattributes--within these distressed organizations."

The paper said there was an "apparent failure to develop andreward internal risk management competencies. From the board roomto the trading floor, individuals on the front line who weretaking--and trading in--these risks ostensibly were rewarded forshort-term profit alone."

Finally, the report said, there was a failure to "use enterpriserisk management to inform management's decision-making for bothrisk-taking and risk-avoiding decisions."

Robert P. Hartwig, president of the Insurance InformationInstitute in New York, recently criticized current enterprise riskmanagement frameworks in elements of the financial servicessector.

He said in an e-mail, "The financial crisis is the result of afailure of risk management in the banking and securities markets ona colossal scale."

Mr. Hartwig said that "very fundamental and tough questionsabout the practice of risk management worldwide must be asked andanswered. How did so many major, allegedly sophisticated financialplayers miss or overlook such huge, systemic exposures? What othershoes might yet be left to drop? How can we prevent this from everhappening again?"

Ms. Fox, who is senior director, risk management of ConvergysCorp. said that to be effective, ERM must "fundamentally change theways organizations think about risk."

When ERM becomes part of the "DNA of a company's culture, thewarning signs of a market gone astray cannot go unseen so easily."She said that "when designed and implemented systemically, ERM canchange future outcomes. When it's practiced fully, ERM enablesoverall business performance."

She explained that many financial organizations:

o Failed to adopt an ERM culture.

o Failed to embrace and demonstrate appropriate ERMbehaviors.

o Failed to develop and reward internal risk managementcompetencies.

o Failed to use ERM to inform management decision-making in bothtaking and avoiding risks.

She noted that RIMS believes the financial crisis is a "call toaction," adding that the financial crisis makes an even strongercase for ERM.

"We consider this white paper an imperative and wakeup call." To"prevent another financial catastrophe," she said, "now is the timeto consider implementing an ERM program--or work feverishly toimprove the one you have."

Ms. Fox said that risk practitioners should take away thefollowing key points:

o Use models judiciously, by paying attention to improbableevents and questioning the underlying assumptions.

o Recognize that compliance and controls are importantcomponents of ERM but are not replacements for it.

o Set risk tolerance thresholds at levels that are expected tobe breached, in order to force escalation and conversations at theappropriate levels.

o Reward risk management competencies as well as results.

o Advocate that ERM must be part of the culture throughout theorganization.

She pointed out that RIMS is positioned to help drive leadershipcompetencies with its Risk Maturity Model and other tools.

Ms. Fox also said that not all organizations failed in their ERMprocesses and that ERM made a difference for Goldman Sachs.

"When they started seeing deviations from their expectedoutcomes," she said, the company "began to look deeply at risksand, as a result, in 2006 began to pull back from these mortgagesecurities."

She said in the Webinar, "At a time when everyone else wasjumping in, they were actually taking a reverse position than mostof the market, which helped them to be one of the companies thatwas most resilient."

When reviewing their governance infrastructure, she said,companies need to be sure they have "authorized escalation pointsoutside of the normal reporting" and ways to make sure importantinformation gets to the board or decision-makers.