What is enterprise risk management?

What is enterprise risk management?

Enterprise risk management is the discipline of identifying, assessing, treating, monitoring, and reporting on all material risks an organisation faces as a single portfolio, governed by the board and tied to a documented risk appetite. The phrase distinguishes it from the older silo model, where cyber risk, financial risk, operational risk, and compliance risk were each owned and assessed separately. ERM rolls those silos up.

The term hardened in the early 2000s with the original COSO ERM framework (2004) and the first edition of ISO 31000 (2009). The 2017 COSO update repositioned ERM as integral to strategy and performance, not a parallel compliance exercise, which is the definition most US boards and audit committees work to today. ISO 31000:2018 sharpened the principles and process for use outside the US and in regulated industries internationally.

“Enterprise risk management is the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.”

1. Component 01

   Governance and culture

   Principles 1–5

   The board oversees risk. The operating model defines authority and reporting lines. Core values, desired culture, and the talent pipeline get explicit attention. Without governance the rest of the framework is decorative.

   Artefacts

   Board risk charter, risk committee terms of reference, code of conduct, RACI for risk decisions.
2. Component 02

   Strategy and objective-setting

   Principles 6–9

   Risk is considered in strategy formulation, not bolted on after. Business context is analysed. Risk appetite is defined in board-approved statements. Alternative strategies and business objectives are stress-tested against the appetite line.

   Artefacts

   Risk appetite statement, strategy risk assessment, business-context analysis.
3. Component 03

   Performance

   Principles 10–14

   Risks are identified, assessed for severity, prioritised, treated, and the portfolio view is developed. This is the analytical core: the register, the heat map, the loss-exceedance curve, the residual-versus-appetite gap.

   Artefacts

   Enterprise risk register, top-risk dashboard, treatment plans, KRI library.
4. Component 04

   Review and revision

   Principles 15–17

   Substantial change is assessed for its impact on the risk profile. ERM performance itself is reviewed. The framework is improved on a defined cadence so it does not ossify around the first design choices.

   Artefacts

   Quarterly risk reviews, post-incident reviews, framework maturity assessments.
5. Component 05

   Information, communication, reporting

   Principles 18–20

   Relevant information is gathered. Communication channels are defined for upward, downward, and lateral flow. Risk, culture, and performance are reported to the board and management on a schedule the board can rely on.

   Artefacts

   Board risk pack, audit-committee report, internal-communications calendar, KRI thresholds.

1. Step 01

   Establish internal environment and context

   Document the organisation's mission, strategy, structure, external regulatory landscape, and internal operating model. Capture the risk culture honestly. The work below depends on this scoping being defensible.

   Output

   Context document with stakeholder map, regulatory inventory, and operating-model diagram.
2. Step 02

   Set objectives and risk appetite

   Translate strategy into specific, measurable objectives. The board approves a risk appetite statement that names tolerated exposure by category. Without appetite, the assessment has no decision line.

   Output

   Board-approved risk appetite statement; per-category tolerance thresholds.
3. Step 03

   Identify events and risks

   Interview business owners, review incident history, run scenario workshops, scan external threat intel. Each risk gets a one-sentence statement (threat, vulnerability, consequence) and an accountable owner from the business.

   Output

   Working enterprise risk register with named owners; no scoring yet.
4. Step 04

   Assess likelihood and impact

   Score each risk on a consistent scale (most teams start with a 5x5 ordinal matrix). For the top 10 to 20 risks, run a quantitative pass in monetary terms using FAIR or a Monte Carlo simulation.

   Output

   Inherent score per risk; quantitative loss-exceedance curve for the top tier.
5. Step 05

   Respond and treat

   For each risk above appetite, choose to accept, treat, transfer (insurance, contractual shift), or avoid (exit the activity). Treatment plans name the controls, the owner, the deadline, and the target residual score.

   Output

   Treatment plan with owners, deadlines, controls mapped, and target residuals.
6. Step 06

   Implement control activities

   Stand up the preventative, detective, and corrective controls the treatment plan calls for. Map each control to the risk it reduces and to the compliance obligations it also satisfies so evidence collected once is credited many times.

   Output

   Live control library cross-mapped to risks and to compliance frameworks.
7. Step 07

   Monitor and review continuously

   Key risk indicators (KRIs) carry the watch between assessments. Control tests run on schedule. Incidents and audit findings feed the register without waiting for the next cycle. The fifth COSO component (review and revision) lives here.

   Output

   KRI dashboard with thresholds; current residual scores reconciled to evidence.
8. Step 08

   Communicate and report

   Board pack on a fixed cadence. Audit-committee deep-dive each quarter. Internal communications to risk owners and to the workforce on culture and incidents. Reporting is a feature of the framework, not an afterthought.

   Output

   Quarterly board risk pack; audit-committee report; KRI watchlist; named-incident lessons.