Standard & Poor’s much-touted plan to evaluate companies’ risk management efforts as part of its credit-rating decisions seems to have stalled, as S&P analysts figure out how to scrutinize risk management and whether it’s worth the extra burden to companies.

Speaking at a recent corporate governance conference in Boston, Geoffrey Buswick, head of S&P’s public-finance ratings office, frankly admitted that the idea of evaluating enterprise risk management is easier said than done.

“We’re still not sure about the value of ERM … as it relates to ratings,” said Buswick, who spoke at a conference by the Global Strategic Management Institute. One question, ...