Late last week, 15 of the world’s top risk managers gathered at RIMS Risk Summit 2013 steps from Wall Street at Zurich’s Manhattan offices. Paul Walker, Ph.D., CPA, from the Center for Excellence in ERM at St. John’s University’s Tobin College of Business kicked off the morning by asking “How does your boss know you’re doing ERM well?”

Even at the highest level, the challenge to communicate and demonstrate the value of risk still can impede the success of a risk management program. While those in the room with complex ERM programs seemed to have buy-in from the C-suite, others still in the process of implementing the discipline struggle “stating their case.”

Later in the day, the conversation turned to reputation risk. A debate circled around that value proposition. Attendees agreed that any risk identification or assessment exercise that failed to include reputation risk would be deemed incomplete by leadership.

But, the question remained: “Is reputation risk a risk that needs to be managed independently or is an organization’s good reputation a by-product of managing its other risks well?”

While no real consensus was reached, Carol Fox, RIMS director of strategic and enterprise risk practice, acknowledged that discussions like that are the reason the Summit is held and the debate would be something that RIMS explores in greater detail.

At the end of the day, the Summit covered everything from best practices in identifying, assessing, reporting and monitoring risks, to steps for identifying risk appetite and risk tolerance.

So, that brings us back to the question, “how does your boss know that you’re doing ERM well?

”

While it was agreed that benchmarking, case studies, data analytics and other quantitative measures are fundamental to getting ERM off the ground and proving its value, unfortunately if those options fail, sometimes risk practitioners need to wait for a good crisis or a new opportunity to showcase the extent of their ERM program and how it adds quantitative value to the organization.