"Even after the recent regulatory upheaval, many companies are not significantly better prepared to manage enterprise-wide risks to their organization than they were before Sarbanes-Oxley was passed in 2001," said Michael J. Nolan, global head of Internal Audit Services at KPMG. "Of greater challenge, the KPMG study found that company executives want their organization’s risk structure to be more strategic and forward-looking, yet lack the tools, competencies and culture to transform the risk structure."

In addition, companies that once viewed their business decisions in terms of the quality of their people, processes and technology have now added "risk" as a fourth dimension of decision-making, the KPMG study found. New York Stock Exchange listing requirements that call for audit committees to discuss the organization’s risk assessment and risk management policies, as well as rating agencies intending to incorporate enterprise risk management evaluations into all credit ratings, have companies and their boards poised to increase their risk and controls management focus.
 
The KPMG survey, conducted by the Economist Intelligence Unit, also found that 51 percent of the 435 executives surveyed globally want their organization’s risk and controls management to assume a more strategic focus in order to become more effective for the company.   

"Risk and controls management is no longer about keeping score or about taking a reactive and defensive posture," Nolan said. "Companies need to view risk management not as an obligation, but as a competitive business advantage, using it to deliver improved and sustained business performance."
 
Meanwhile, top barriers to effectively managing risk and controls include a limited awareness of how risk management can become part of an organization’s culture (23 percent) and a shortage of resources (17 percent), survey respondents said. Also, in the next three years:

• 29 percent of respondents expect their organizations to significantly increase their risk-and-control investments and resources, while 55 percent anticipate a slight increase; 
• 43 percent of respondents plan to implement continuous monitoring and auditing -- the ability to review and report on business information in real time;
• 56 percent of respondents plan to implement controls transformation -- program and process improvements that can help align risk and controls more closely with their business needs;
• 41 percent of respondents plan to implement enterprise risk management -- an organization-wide assessment and analysis of major risks, and use of a framework for risk management that aligns risk with business strategy;
• 37 percent of respondents plan to implement executive dashboards -- a technology that provides managers with information and alerts on key indicators that will help them identify emerging opportunities, as well as risks.

"Advanced companies are instituting these kinds of strategic initiatives to help improve their performance and enhance the probabilities for success," said Nolan. "The expectation is that these initiatives will also help change their risk and controls culture in a way that will help them better compete in the global marketplace."