Skip to main content
Regulatory Council
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Category: Enterprise Risk Management

Value Preservation

Also known as: Value Preservation Imperative
Simply put

Value preservation is an organization's focus on preventing its value from being lost or eroded through unintended actions or processes. It is often framed as a counterpart to value creation, emphasizing the protection of what an organization and its stakeholders already have. In some formulations it is described as an obligation to preserve, protect, and defend stakeholder value.

Formal definition

Value preservation refers to an organizational orientation directed at preventing the loss or erosion of value arising from unintended actions or processes, positioned in the literature as a complement to value creation. One articulation frames it as the 'value preservation imperative', characterized as a social, moral, and ethical obligation to preserve, protect, and defend stakeholder value. As presented in the available evidence, the concept is conceptual and context-dependent rather than tied to a specific binding framework or standard; practitioners should note that its scope, and its relationship to formal risk management and governance frameworks (for example, distinctions between inherent and residual risk, or between risks and controls), is not defined by the sources cited here and should be established with reference to applicable frameworks and professional guidance. Related but distinct uses of 'preservation' in the evidence, such as wealth preservation (protecting the value and purchasing power of assets over time) and physical preservation of art and collectibles, address specific asset classes and fall outside the general organizational meaning of value preservation.

Why it matters

Value preservation directs organizational attention to a distinct question from value creation: not how an organization generates new value, but how it protects the value that it and its stakeholders already hold from being lost or eroded through unintended actions or processes. This orientation matters because value that has been built over years can be diminished by decisions, failures, or processes that were never intended to cause harm, and a governance posture focused solely on growth may overlook the exposures that threaten what already exists.

Some commentators frame this focus more strongly as a "value preservation imperative", a social, moral, and ethical obligation to preserve, protect, and defend stakeholder value. Framed this way, value preservation is not merely a defensive activity but a responsibility owed to the range of parties who have a stake in the organization's continuity. Positioning it as a counterpart to value creation helps boards and management recognize that both orientations warrant deliberate governance attention rather than treating protection as an afterthought to growth.

Practitioners should note that, as presented in the available evidence, value preservation is a conceptual and context-dependent orientation rather than a term tied to a specific binding framework or standard. Its relationship to formal risk management and governance concepts, such as the distinction between inherent and residual risk, or between risks and the controls that modify them, is not defined by the sources cited here and should be established with reference to applicable frameworks and professional guidance.

Who it's relevant to

Boards and Governance Bodies
Directors responsible for how an organization is directed and controlled may use value preservation as a lens to ensure that protecting existing stakeholder value receives deliberate attention alongside value creation, rather than being treated as secondary to growth.
Risk Managers
Those responsible for identifying and treating uncertainty against objectives may find value preservation a useful framing for the loss or erosion of value through unintended actions or processes. Because the evidence does not define its relationship to formal risk concepts, practitioners should connect the orientation to applicable risk management frameworks to give it operational meaning.
Executive Leadership
Senior management balancing value creation against value preservation can use the concept to frame decisions in terms of what the organization stands to lose as well as what it stands to gain, consistent with the described obligation to preserve, protect, and defend stakeholder value.
Governance and GRC Professionals
Practitioners working across governance, risk, and compliance may reference value preservation as a conceptual counterpart to value creation, while recognizing that its scope is context-dependent and should be established against the frameworks and professional guidance applicable to their organization, sector, and jurisdiction.

Inside Value Preservation

Objective Protection Orientation
Value preservation refers to the aim of protecting existing organizational value from erosion, encompassing the safeguarding of assets, reputation, financial position, and stakeholder confidence against adverse events. It is typically framed in contrast to value creation, which seeks to generate new value, though many frameworks treat the two as complementary rather than mutually exclusive.
Risk Management Linkage
In many enterprise risk management frameworks, value preservation is associated with identifying, assessing, and treating uncertainty that could reduce achievement of objectives. It often emphasizes downside risk and the mitigation of threats, though the boundary with value-creating risk-taking is context-dependent.
Control Environment Contribution
Internal controls, policies, and governance structures typically contribute to value preservation by modifying risk to acceptable levels. Controls are measures that reduce the likelihood or impact of adverse events; they do not eliminate risk, and residual risk generally remains after their application.
Governance and Oversight Role
Value preservation often falls within the responsibilities assigned through governance structures, including board oversight, defined decision rights, and accountability mechanisms that direct how the organization protects its interests. This links the concept to the governance pillar as well as risk management.
Risk Appetite Alignment
The extent to which an organization emphasizes preservation over the pursuit of opportunity is commonly expressed through its risk appetite and tolerance. Value preservation tends to reflect a lower appetite for certain categories of risk, but appetite settings vary by organization, sector, and objective.

Common questions

Answers to the questions practitioners most commonly ask about Value Preservation.

Is value preservation the same as value creation?
No. Value preservation and value creation are complementary but distinct aims. Value preservation focuses on protecting existing organizational value from erosion, loss, or destruction, typically through risk mitigation, control activities, and safeguarding of assets and reputation, whereas value creation concerns generating new value, often by taking on risk in pursuit of strategic objectives. Many governance and risk frameworks treat both as legitimate outcomes of effective risk management, but conflating them can lead organizations to over-emphasize protective controls at the expense of opportunity, or vice versa. The balance between the two is generally a matter of the organization's risk appetite and strategy.
Does value preservation mean avoiding all risk?
No. Value preservation is not synonymous with risk avoidance or the elimination of risk. No control or strategy can eliminate risk entirely, and an organization that sought to avoid all risk would typically forgo the risk-taking necessary to pursue its objectives. Value preservation is better understood as managing risk so that existing value is not unduly exposed to loss, consistent with the organization's risk appetite and tolerance. It often involves accepting, transferring, or mitigating risk rather than avoiding it altogether.
How does value preservation relate to an organization's risk appetite?
Value preservation is typically operationalized through the boundaries set by risk appetite and risk tolerance. Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives, while tolerance describes acceptable variation around specific measures. Activities aimed at preserving value, such as controls, insurance, or limits, are generally calibrated so that potential losses remain within these boundaries. In practice, articulating appetite and tolerance first helps an organization decide how much protective effort is warranted for a given asset, process, or exposure.
What kinds of controls typically support value preservation?
Controls that modify risk in ways that protect existing value can span preventive, detective, and corrective types. Common examples include segregation of duties, access and authorization controls, physical and information security safeguards, business continuity and disaster recovery arrangements, insurance and other risk-transfer mechanisms, and monitoring activities that detect losses or breaches early. The appropriate mix depends on the nature of the value at risk, the organization's context, and applicable requirements. It is worth noting that a control modifies risk rather than being a risk itself, and no single control guarantees protection.
How can value preservation efforts be measured or monitored?
Organizations often monitor value preservation through indicators tied to the exposures and controls that matter most, such as key risk indicators, control effectiveness testing, incident and loss data, audit findings, and tracking of residual risk against tolerance thresholds. Because value preservation concerns avoided or limited losses, measurement can be challenging, as the absence of a loss is not always directly observable. Many organizations therefore rely on a combination of leading indicators, control assurance, and periodic risk assessments rather than a single metric. Specific measures should be tailored to the organization's objectives and context.
Who is typically responsible for value preservation within an organization?
Responsibility is generally shared across governance and management structures rather than resting with any single function. Under commonly used models such as the three-lines approach, operational management (first line) owns and manages the risks to value in day-to-day activities, risk and compliance functions (second line) provide oversight, expertise, and challenge, and internal audit (third line) provides independent assurance. The governing body typically sets the tone, approves risk appetite, and holds management accountable. Exact roles and titles vary by organization size, sector, and jurisdiction, and allocation of responsibility is ultimately a governance decision.

Common misconceptions

Value preservation means avoiding all risk.
Value preservation typically concerns managing downside risk to protect existing value, not eliminating risk-taking entirely. Most frameworks recognize that some risk-taking is necessary to achieve objectives, and preservation and value creation often operate together rather than in opposition.
Implementing strong controls guarantees that value is preserved.
Controls modify risk but do not eliminate it. Residual risk generally remains even after controls are applied, and no control can be said to guarantee an outcome. The effectiveness of controls also depends on their design, operation, and the environment in which they function.
Value preservation is purely a compliance function.
While compliance with laws, regulations, and internal policies can support value preservation, the concept spans governance and risk management as well. Reputational, financial, and operational value can be affected by factors beyond regulatory adherence, so treating it as compliance-only understates its scope.

Best practices

Distinguish clearly in your risk documentation between value preservation objectives and value creation objectives, so that risk appetite and tolerance settings can be calibrated appropriately for each.
Map controls to the specific risks they are intended to modify, and explicitly track residual risk rather than assuming controls remove exposure entirely.
Align preservation-related activities with the organization's stated risk appetite and tolerance, and revisit these settings as objectives and the external environment change.
Integrate value preservation into governance oversight by defining clear decision rights, accountability, and reporting lines to the board or its committees.
Where value preservation relates to regulatory obligations, verify applicability against the relevant jurisdiction and sector, and seek professional advice for matters of legal interpretation.
Use qualified, evidence-based language when reporting on preservation effectiveness, avoiding claims that any measure guarantees protection or eliminates risk.
Promotional banner for the Pentest Readiness checklist download