Does Enterprise Risk Management Add Value To Firms?

In their research paper "The Value of Enterprise Risk Management," Robert Hoyt and Andre Liebenberg attempt to uncover whether there is firm value in implementing Enterprise Risk Management (ERM). As the authors discuss, ERM has generated considerable interest from the media in recent years as organizations begin implemented enterprise-level risk management programs, and consulting firms and universities look for ways to offer support, guidance, courses, and services related to ERM. Rating agencies have also begun to consider ERM in the rating process, and regulators are taking notice. The ideas of enterprise and system-wide "systemic" risk are also now being given serious consideration at the economic system level.

Put simply, ERM is focused on the idea that instead of managing and examining individual and separately managed silos of risk, firms are now looking at managing risk in a more integrated, enterprise-wide fashion. It is believe that doing so will help to avoid duplication of risk management expenses by exploiting natural hedges, and allow firms to better understand the aggregate risk. ERM programs also have the benefit of allowing firms to better inform outsiders (investors, regulators) of their risk profile, compared to firms that are more operationally complex. It is expected that such added visibility has the benefit of decreasing earnings and stock price volatility, increasing capital efficiency, and increasing enterprise risk awareness - allowing for more holistic operational and strategic decision-making. But enough flowery language. Does it work, and will it increase shareholder wealth?

[Note: I have offered university-level ERM courses in the past, and will do so again in the near future. Unfortunately, up until now there has not been an empirical study regarding the impact of ERM programs on firm value. Needless to say, I was interested in the results of the research.]

First, a little research background. For the study, the authors focused their attention on U.S. insurers in order to control for regulatory and market differences across industries. Financial institutions and insurers have been some of the first industries to adopt ERM, so this focus makes sense. Without going into further specifics of their modeling and analysis (please refer to the paper), the authors found:

"ERM usage to be positively related to factors such as firm size and institutional ownership, and negatively related to reinsurance use, leverage, and asset opacity. By focusing on publicly-traded insurers we are able to estimate the effect of ERM on Tobin’s Q, a standard proxy for firm value. We find a positive relation between firm value and the use of ERM."

In fact, beyond just adding value, the ERM premium was 16.5%, and found to be both statistically and economically significant, as well as being robust to a range of alternative specifications of both the ERM and value equations. In summary, it appears that added risk management disclosures inherent in ERM add value to the firm. As a bonus, by adding additional risk management transparency, firms are likely to reduce the expected cost of regulatory review, along with the amount risk capital that is allocated for less productive/profitable uses, each of which no doubts helps to increase firm value. Certainly something the proponents of ERM believed, but now there is some initial evidence to back up the claims - at least for insurance companies.

Of course, as investors, knowing that ERM adds value to a firm is good, but now it is necessary to determine which firms are in fact using ERM. Even the authors mention that identifying firms engaging in ERM is a challenge. Nonetheless, absent official disclosures, a search of financial reports and news wires (as performed by the authors) can help to locate candidates for study. Even with relatively strict filtering of data, the researchers were able to identify 117 out of 275 insurance firms that met the requirements of being classified as firms engaging in some type of ERM. As regulators begin to require additional transparency regarding risk management activities, such identification will become easier, and hopefully profitable to investors.