A survey conducted in July and August of 2009 by Aon has revealed that companies are moving beyond “basic” ERM imple­men­ta­tions:

62% of the survey respon­dents in the Global Enter­prise Risk Management Survey 2010 reported going beyond basic ERM, compared with only 38% in Aon’s inaugural ERM survey in 2007.

I wonder what happened between now and 2007 that would’ve affected companies’ willingness to ramp up their risk management practices…

The survey asked respon­dents (of which there were 201) to rate the maturity of their ERM imple­men­tation, from “initial/lacking” through “basic”, “defined”, “opera­tional” and “advanced”.

My take is that respon­dents are more likely to overes­timate the maturity of their imple­men­tation and generally more likely to respond the more advanced they (feel they) are in the process. Still, the survey is a welcome indicator that ERM efforts are on the rise.

I also think the fact that ratings firms are taking ERM into account when they determine their grading is helping execu­tives point to a tangible financial benefit and obtain buy-in from all stake­holders, which is critical. In my mind the primary indicator of maturity in a company’s risk management program is how compre­hensive it is across all depart­ments and divisions, as the “initial/lacking” stage is exhibited by a rigid, siloed approach.

The survey is available on Aon’s website (if you give them some personal infor­mation first).