Arlington, MA July 19, 2002 Computing the return on investment (ROI) for risk management is a dilemma that has plagued risk management for a long time, and the main problem with it has been: How do you prove a negative? In other words, how do you prove that by taking action "x," some event "y" won't happen? Would that event happen all by itself, even without any intervention? And, in that case, aren't the resources spent on trying to mitigate the event's likelihood, consequences or both being wasted?
Cutter Consortium's recent study on corporate risk management practices reveals that showing a definitive ROI is becoming a major issue of concern for organizations. When asked what they perceived to be the three main weaknesses of risk management, some of the answers were that it's hard to separate risks from problems (36 percent); it can't show a definitive return on investment (33 percent); and it's hard to get cultural/organizational buy-in (33 percent).
According to the study, some 92 percent of survey respondents said they are presently not trying to calculate the ROI of their risk management practice. With that being the case, that left Cutter Consortium Fellow Dr. Robert Charette to wonder why it rates at such a high level of concern.
However, Charette, who analyzed the research for the report "The State of Risk Management 2002," said of the 8 percent of organizations that are trying to calculate ROI: "Most [76 percent] of the organizations figure they are getting less than 50 percent ROI. Some 10 percent claim they are getting more than 100 percent." Yet Charette said he was personally skeptical of those results.
He added: "I believe that risk management ROI cannot really be measured directly only indirectly. A better approach is to try to measure the value the process generally brings." He exlained that he was once part of an effort to understand and quantify the benefits of risk management to a large aviation company. "What we found, after much work, is that we could isolate the overall effects of similar projects doing risk management versus those that were not," he said.
He continued: "Projects performing risk management could hit their cost and schedule targets much better than those projects that did not. A 17 percent difference in the cost performance index and around 15 percent in the schedule performance index existed between projects that diligently practiced risk management and those that did not. The results convinced senior management to throw their wholehearted support behind the practice of risk management in the company."
Charette concluded by saying that risk management ROI will be an increasingly important issue in the future and one that will prove to be very difficult to address. But he believes it is an issue that groups responsible for risk management must think about before senior management asks them to justify how much they are spending on risk management.
