The Renaissance CIO

Once ERM starts, it doesn't stop. The real value of enterprise risk management comes when it becomes a continuous part of everyday business. Running a huge risk assessment once every six months will help you manage enterprise risk the same way looking at your cupboard once every six months will help you manage your grocery shopping.

Or to use a stronger metaphor, Rockwell Collins's Gemmer says that continuous enterprise risk management is like the quizzical winter sport of curling. In curling, participants hurl heavy stones down ice while team-mates madly brush the ice in front of the moving stone to affect its path. The goal is to land the stone as close to the high-scoring area as possible.

The stone is your company. The hurling of it is an initial risk strategy. The brushing is continuous risk management. Gemmer puts it like this in an article on ERM: As the stone hurtles along to the goal area (which for you is overall profitability and shareholder value), "uncertainty [about the outcome] decreases, but your choices also become more limited". It's a creative metaphor, born of Gemmer's interest in the world outside IT. In fact, according to virtually everyone we talked to about risk management, the people who are most successful at ERM have varied experiences, both in their careers and their personal lives.

You have a greater chance to succeed in an ERM-driven company if you are a Renaissance CIO: If you have interests outside IT, a breadth of experience and knowledge, an ability to think outside your own silo, and an understanding of the history and culture of your corporation. "My predecessor was 10 times smarter than me about technology," says Sharon. "But he couldn't communicate risk to the business like I can."

Besong agrees that CIOs must be well-rounded. "We have this system we put on planes called TCAS, which stands for Traffic Alert and Collision Avoidance System. It constantly monitors the airspace around a plane and captures objects within 25 miles. It determines their paths, their speeds and projects their course. If [an] object's on a collision course with the plane, it alerts the pilot and suggests possible responses.

"The role of the CIO now is to do for business managers on the ground what TCAS does for pilots at 35,000 feet. It's the most challenging and invigorating work I've done."

SIDEBAR: IT and the Enterprise Risk Management Enabler

Beyond participating in the cultural shift that is a corporate-wide Enterprise Risk Management (ERM) program, IT has another role to play with risk management: creating the systems your company will use to collect information about risks.

"ERM will not work unless IT is there to support it with infrastructure," says consultant James Lam, who was the first chief risk officer at any company, a position that he pioneered at GE Capital. "The most important application to develop is a dashboard that will grab risk data from all over the corporation and report it" in layman's terms, he says. When business units report they have specific risks, the system will record that information, along with related statistical data.

For example, Lam says, Sarbanes-Oxley requires companies to report material events within four business days. "If the SEC gets to find out in four days, you want to know within one day, max," he says. "You need an IT platform to pull that all together."

As of now, Lam says, there's no one product to buy and install that will do this. You can do the job with statistical software and databases.