When Risk Management Is Seen as a Cost Rather Than an Investment
For many organizations, enterprise risk management (ERM) is still viewed as a compliance requirement rather than a strategic capability. Risk registers are prepared for auditors, policies are updated to satisfy regulators, and reports are presented to boards primarily to demonstrate that risks have been documented. But what if effective risk management does far more than reduce losses? What if it actually increases the value of an organization?
That question has occupied academics and business leaders for decades. One of the most influential attempts to answer it came in 2011 through a landmark study by Robert Hoyt and Andre Liebenberg, published in the Journal of Risk and Insurance. More than a decade later, it remains one of the most frequently cited pieces of empirical research supporting the business case for Enterprise Risk Management.
The Question That Changed the Conversation
Before Hoyt and Liebenberg’s research, advocates of ERM often argued that a structured approach to risk management “should” improve organizational performance. Yet there was relatively little empirical evidence demonstrating that it actually did. The researchers asked a simple but powerful question:
“Do organizations with mature Enterprise Risk Management programmes create more value than those without them?”
To answer this, they examined 275 publicly traded insurance companies in the United States over a seven-year period (1998–2005), using statistical techniques to control for factors such as profitability, company size, leverage, and growth opportunities. Rather than relying on opinions or case studies, the research analysed actual financial performance.
The Headline Finding
The study found that organizations with mature Enterprise Risk Management practices were associated with approximately 20% higher firm value than comparable organizations without mature ERM programmes.
Firm value was measured using Tobin’s Q, a widely accepted financial metric comparing the market value of a company with the replacement cost of its assets. This finding has since become one of the most widely quoted statistics in the field of Enterprise Risk Management.
Why Would Risk Management Increase Value?
At first glance, the result may seem surprising. Risk management is often associated with preventing losses rather than creating value. However, effective ERM does much more than identify threats. Organizations with mature ERM capabilities are generally better able to:
- integrate risk into strategic decision-making rather than treating it as a separate compliance exercise;
- allocate financial and operational resources more effectively;
- identify emerging risks before they become costly problems;
- improve capital allocation and investment decisions;
- reduce earnings volatility and unexpected losses;
- strengthen stakeholder, lender, and investor confidence.
In other words, mature ERM helps management make better decisions, not simply safer ones.
From Risk Registers to Strategic Decisions
One of the most important messages from the research is that value is not created by producing more risk reports or maintaining larger risk registers. Value is created when risk information influences strategic decisions. Boards and executive teams that routinely ask questions such as those outlined below are far more likely to make decisions that improve long-term performance:
- What assumptions underpin this investment?
- What could prevent this strategy from succeeding?
- Are we taking risks that align with our appetite?
- What early warning indicators should we monitor?
Risk management, therefore, becomes a strategic discipline rather than an administrative process.
An Important Note of Caution
The study does not conclude that implementing an ERM framework automatically increases organizational value by 20%. Instead, it found a strong statistical association between mature ERM practices and higher firm value after accounting for other important business characteristics. This distinction matters.
High-performing organizations often exhibit several characteristics simultaneously: strong governance, capable leadership, disciplined financial management, effective internal controls, and mature risk management. These capabilities reinforce one another.
ERM should therefore be viewed as an important contributor to organizational performance, not a standalone guarantee of success.
What This Means for Canadian Organizations
Whether you lead a business, nonprofit organization, Crown corporation, or public institution, the message is remarkably relevant. Today’s organizations face an increasingly interconnected landscape of risks:
- cyber threats;
- funding uncertainty;
- inflationary pressures;
- supply chain disruption;
- labour shortages;
- regulatory change;
- reputational risk;
- geopolitical uncertainty.
Managing these risks effectively is no longer simply about protecting the organization from harm. It is about improving decision quality. Organizations that consistently outperform their peers tend to integrate risk considerations into strategic planning, budgeting, investment decisions, governance, and performance management. They understand that resilience and value creation are not competing objectives, they are mutually reinforcing.
From Compliance to Competitive Advantage
One of the most significant developments in modern governance has been the shift in how Enterprise Risk Management is perceived. Historically, ERM was often viewed as a compliance obligation. Today, leading organizations increasingly recognize it as a competitive advantage. A mature ERM framework helps organizations anticipate uncertainty, respond more effectively to disruption, allocate resources more efficiently, and pursue growth opportunities with greater confidence. That is why Enterprise Risk Management should no longer be viewed simply as a defensive function. It is an enabler of better decisions, stronger governance, and sustainable value creation.
Final Reflection
Every organization manages risk in some way. The question is whether it does so deliberately, consistently, and strategically. Hoyt and Liebenberg’s research reminds us that risk management is not merely about avoiding losses. At its best, it helps organizations make better decisions, improve resilience, strengthen stakeholder confidence, and create long-term value. The organizations that thrive in an increasingly uncertain world will not be those that avoid risk altogether. They will be those who understand it, manage it intelligently, and use it as a catalyst for sustainable growth.
Wondering how your organization’s risk management measures up? Take Avanguard’s Free Risk Management Assessment Test to identify strengths, uncover hidden vulnerabilities, and discover practical opportunities to build resilience and create long-term value.
References
- Hoyt, R.E. & Liebenberg, A.P. (2011) The Value of Enterprise Risk Management. Journal of Risk and Insurance, 78(4), pp. 795–822.
- Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2017) Enterprise Risk Management—Integrating with Strategy and Performance. Durham, NC: COSO.
- International Organization for Standardization (ISO) (2018) ISO 31000:2018 Risk Management—Guidelines. Geneva: ISO.
