Enterprise Risk Management (ERM)

Traditional risk management tends to happen in separate pockets. Finance manages credit and market risk, IT manages security risk, operations manages safety and supply chain risk, and legal manages regulatory risk. Each team may do its job well, yet no one sees how the risks combine. A supplier failure, a cyber incident and a regulatory change might each look manageable alone, but together they could threaten a major product launch or the year's financial targets. Enterprise risk management brings these views together so leaders can see the organization's risks as a portfolio and manage them in light of strategy.

ERM gained momentum in the early 2000s, after a run of corporate failures and the Sarbanes-Oxley Act increased board attention on risk oversight. COSO published its first ERM framework in 2004 and an updated version in 2017. ISO 31000, first published in 2009, offers a similar approach. For risk, finance and strategy teams, ERM connects risk to the decisions that matter most: which objectives to pursue, how much risk to accept and where to invest in protection.

Definition of Enterprise Risk Management

Enterprise risk management is the culture, capabilities and practices, integrated with strategy setting and performance, that an organization uses to manage risk across all of its units and functions in order to create, preserve and realize value.

ERM is usually built on a risk management framework, guided by a stated risk appetite and supported by a shared risk register.

The COSO ERM Components

Governance and culture covers board oversight, operating structures, desired culture and the people who manage risk.

Strategy and objective-setting connects risk to the organization's strategy, including its risk appetite and how objectives are chosen.

Performance covers identifying, assessing, prioritizing and responding to risks that affect the achievement of objectives.

Review and revision looks at how well risk management is working and adjusts it as the business changes.

Information, communication and reporting makes sure the right risk information reaches the right people. This includes regular reporting to leadership and the board on the organization's most significant risks.

How ERM Differs From Traditional Risk Management

Traditional risk management focuses on individual risks within functions, usually to avoid losses. ERM looks across the whole organization. It covers strategic, financial, operational, compliance and reputational risks in one view.

ERM considers how risks interact, so that combined exposure is understood, not just individual items.

ERM treats risk as part of strategy, considering both threats and opportunities rather than only downside events. An opportunity missed because of excessive caution can cost as much as a threat that was ignored.

ERM gives the board a single, consistent view of the organization's most significant risks.

Importance of Enterprise Risk Management in Risk and Compliance

ERM improves strategic decisions. When leaders understand the risks attached to each option, they can choose strategies that fit the organization's appetite and capacity for risk.

It reduces surprises. Looking across functions makes it more likely that emerging and connected risks are spotted before they cause damage.

It also strengthens oversight. Boards, regulators, rating agencies and investors increasingly expect a clear account of how risk is governed across the enterprise.

Enterprise Risk Management and Financial Management

ERM helps allocate capital and budgets toward initiatives whose expected returns justify their risk, and away from those that add risk without enough reward.

Linking risk to financial plans allows leaders to stress-test forecasts against major risk scenarios, such as a recession, a key customer loss or a major outage.

A consolidated view of risk helps avoid paying twice for overlapping controls, insurance and monitoring in different functions.

Rating agencies and lenders may consider the quality of risk management when assessing creditworthiness, so a credible ERM program can support financing.

Common Challenges

ERM programs can become compliance exercises that produce reports but do not influence decisions.

Business leaders may see ERM as the risk team's job rather than part of their own responsibilities.

Combining risks from different functions is difficult when each uses different terms, scales and tools. Without a shared taxonomy, the same risk can appear under three different names in three registers.