Uncertainty is a fact of life for all organizations, big or small, no matter what their business. Markets change, technology develops, regulations get tougher, and no one knows what can happen next – such as a cyber attack or a disruption in the supply chain – to mess up even the best of business plans. It’s not if risk will manifest. It’s when your organization is ready.
Whereas, enterprise risk management comes in. Unlike departmentalized risk management individual issues of risk are managed as a whole organization approach called enterprise risk management (ERM). It brings together the financial risk, operational risk, strategic risk, and compliance risk in one place in order to help leadership make informed decisions that have a clear idea of what’s at risk.
This guide explains what enterprise risk management (ERM) is, how it has become a boardroom priority and how companies of any size can develop a program that is more about protecting value than completing compliance checklists.
What Is Enterprise Risk Management
Enterprise risk management is an integrated and systematic process throughout the organization for identifying, analyzing, prioritizing and addressing risks that may impact an organization’s goals. ERM brings together the efforts of these departments under one umbrella that is coordinated, unlike traditional risk management that was often used in silos where IT managed cyber security risks, finance managed credit risks, and legal managed compliance risks.
| Traditional Risk Management | Enterprise Risk Management |
|---|---|
| Managed separately by individual departments (IT handles cybersecurity, finance handles credit risk, legal handles compliance) | Coordinated under one umbrella, bringing financial, operational, strategic, and compliance risk together |
| Often reactive, addressing risks after they surface as problems | Proactive, identifying and prioritizing risks before they escalate into crises |
| Risk data kept in siloed, department-specific spreadsheets | Centralized risk register with an organization-wide view |
| Limited visibility into how risks in one department affect another | Enterprise-wide visibility that shows how risks can compound across functions |
| Focused on compliance and back-office concerns | Integrated into strategic planning and executive decision-making |
| No unified risk appetite or tolerance guiding decisions | Guided by a defined risk appetite statement and risk tolerance levels |
| Success measured mainly by avoiding incidents | Success measured through key risk indicators, faster decision-making, and improved resilience |
The objective is not to completely eliminate risk, but to reduce it. It’s not practical or desirable, and there are risks that are worthwhile to take if the potential rewards are worth it. Rather, ERM can help organizations understand their appetite for risk, intentionally select risks to take, transfer, mitigate, or avoid, and be resilient enough to rapidly rebound when things go awry.
There are generally four classes of risk that should be included in a well functioning ERM program:
- Business risks – risks that are specific to the business, including risks that may affect the long-term goals, like changing customer preferences or aggressive competitors.
- Technological risk – problems with the technology or the computer system itself
- Operational risk – failure to manage day-to-day operations successfully due to problems such as human resources or internal controls
- Environmental risk – the risks arising from the environment and how it is managed
Why Enterprise Risk Management Matters More Than Ever
Ten years ago, risk management was regarded as a reactive, back office role—one that was of concern to insurance and legal departments, and not as much to other parts of the business. This attitude has been significantly altered, and it’s not hard to see why.
As business organizations today face rapid technological advancement, global supply chains, and increased regulatory oversight, these factors are influencing the way they manage their operations. An unpatched software system, dependence on one supplier, a non-compliance in management, can all be one vulnerability that can escalate to a crisis that impacts revenue, reputation, and customer trust.
More and more boards and executive teams are requiring that the risk management function be put into strategic planning, rather than added on later. Investors and rating agencies also scrutinize a company more closely for its ability to identify and control risk, which will help determine the long-term stability and value of the company.
Another aspect that is sometimes forgotten is the competitive edge. Companies with more advanced ERM programs are better equipped to make better, more timely decisions, as they know what risks exist. The next time a new market opportunity comes up, they can take a look at it using a clear framework and not just on gut instinct. This agility, based on organizational resilience, is a real differentiator.
Core Components of an Enterprise Risk Management Framework
ERM programs are different in every organization, but there are some common elements to most effective ERM programs.
Risk Identification
The first step to any ERM program is determining what might possibly go wrong. This means building a broad consensus across the organization, beyond just those at the top, with frontline staff, departmental managers and external organizations all with a unique perspective on the risks. Risk workshops, interviews, scenario planning and analysis of past incidents are all tools that can help identify the risks that may not be identified at first sight but may become a crisis later.
Risk Assessment and Prioritization
Not all the identified risks need to be treated equally. After listing the risks, they must then be assessed on two parameters: likelihood (what is the probability that this risk will be realized) and impact (what would be the consequences of it happening). A risk assessment matrix is one way to visualize this; it is a grid that puts risks in a context that enables leadership to easily see those that need to be addressed in the short term, and those that can be addressed over time.
A lot of programs make this step the wrong one. It’s easy to overlook quieter, high-frequency risks that slowly drain the value over time from your organization – such as recurring process failures or compliance gaps that slowly and steadily build up – and focus instead on dramatic, low probability risks (like a major cyber attack).
Risk Response and Mitigation
After prioritizing risk, there should be a plan for each of these risks. In general, the following four strategies can be used for responding:
- Avoid – discontinue the activity that creates the risk
- Reduce – put in place controls to reduce the risk and/or impact
- Transfer – pass the risk to another party (usually insurance, contracts)
- Accept – recognise the risks and provide monitoring, typically where the costs of mitigating the risk outweigh the risks that could result.
The selection of appropriate risk mitigation measures needs to strike a balance between cost and benefit. High costs for mitigating a risk with low impact are often not worthwhile and low costs for mitigating a risk with high impact may be a fatal error.
Monitoring and Reporting
Risk isn’t static. New risks appear, old ones change and the actions taken to manage them must be periodically assessed to ensure that they are effective. Ongoing monitoring (with dashboards, key risk indicators (KRIs) and periodic reviews) makes the ERM program relevant and not a document that is updated once a year and then forgotten.
Governance and Culture
None of the above are effective without leadership buy-in, and an environment where staff are comfortable in discussing issues. Corporate governance systems like a separate risk committee reporting to the board help to make risk management a key topic of business, not a compliance issue.
Recognized Enterprise Risk Management Frameworks
ERM programs are seldom developed from the ground up. Rather, they usually modify existing frameworks, adapting them to their context.
One of the most popular models is the COSO ERM Framework created by the Committee of Sponsoring Organizations of the Treadway Commission, especially in North America. It focuses on the approach of integrating risk management into strategy setting and performance, and not as an exercise in its own right.
The ISO 31000 provides more general principles-based approach to risk management, applicable to all the industries, irrespective of size of the organizations. It doesn’t prescribe any specific steps, but gives organizations guidelines to follow based on their own situation, which makes it popular among businesses that conduct business internationally.
The NIST Risk Management Framework is a more focused, and cybersecurity-centric, framework for management of U.S. federal agencies and contractors’ information systems and cybersecurity risks, but many private organizations cite it when structuring their technology risk programs.
Each of these frameworks, or a combination of aspects of each, will be dependent on what works best for an enterprise based on industry, regulatory environment, and maturity. There is no right or wrong framework; the best option is the one that your organization will use regularly.
Building an Enterprise Risk Management Program Step by Step
Organizations that are new can use the following sequence when implementing from the ground up, or organizations that have an ad hoc solution that needs to be made more structured.
Step 1: Secure Executive Sponsorship
ERM programs that don’t have a strong senior-level buy-in are likely to sink. Prior to building processes, locate a supporter of the program at the executive level, preferably within the C-suite or on the board, that will propel the program and provide the resources and attention it requires.
Step 2: Define Risk Appetite and Tolerance
You have to know what level of risk you are prepared to take when working towards your goals before you can determine how to react to risks. A risk appetite statement sets this out at a high level, e.g. “We will not compromise product safety to meet our revenue targets”. Risk Tolerance sets the acceptable variation in the metrics, e.g. “We will not compromise product safety more than X %.”
Step 3: Establish a Risk Governance Structure
Determine ownership for risk management at every level of the organization. This will typically also require a risk committee, a Chief Risk Officer (CRO) or similar position and some designated risk owners across departments who are accountable for managing risks pertaining to their area of expertise.
Step 4: Conduct an Enterprise-Wide Risk Assessment
Organize a team of people from throughout the company to do a systematic risk identification and assessment process. This is not an event that should happen once a year or even semi-annually, it should be done continuously throughout the year.
Step 5: Develop and Implement Response Plans
Outline a response strategy for each identified risk, ownership, timelines and measurement of success for each risk. Unspecific plans with no accountability are hardly implemented.
Step 6: Monitor, Report, and Refine
Establish frequent reports to leadership and board, reporting via dashboards or scorecards that are easy to understand the risk landscape. Review the programme regularly to include new risks, evolving business priorities and new lessons learnt from incidents.
Common Challenges in Enterprise Risk Management
No matter how well-intentioned, there are the regular challenges that arise with ERM programs.
Making ERM a compliance project. If risk management is a process that is merely to please auditors or regulators, then it is not really a risk management process, it’s a paperwork exercise. The best practice programs are embedded in strategic planning and routine activities.
Siloed risk data. Many remain exposed to risk in individual departments, by operating with silo-style spreadsheets that do not communicate with one another. Leadership cannot get a complete picture without centralized view to see how one risk can exacerbate another risk.
Underestimating cultural resistance. There is a risk that employees will be reluctant to report risks if they think this will negatively impact their performance and/or the department. Leadership and consistent actions are needed to foster a culture of psychological safety when it comes to reporting risks.
Static risk registers. Once-taken risk assessments become quickly out-of-date. Businesses evolve, new technologies emerge and old risks that were once insignificant can turn into a crisis.
Lack of measurable outcomes. It’s hard to determine if mitigation efforts are having an impact or generating activity, if there are no clear key risk indicators.
Real-World Applications of Enterprise Risk Management
Think of a medium sized manufacturing company that purchased one key component from an overseas supplier. The supplier concentration was identified as a high impact and moderate probability risk in an enterprise-wide risk assessment. They changed their supplier base to diversify and entered into contingency agreements with another supplier instead of waiting for a disruption to occur. Their main supplier was disrupted in the region too at a later stage and they did not suffer a production stoppage like other companies in the region.
A financial services company applied ERM principles in assessing the risks of introducing a new, digital product as an example. The firm’s risk committee considered cybersecurity, regulatory compliance and reputational risk as a whole, early in the development project, rather than having different teams to consider them at the end. The integrated view revealed an issue of compliance which would have caused months of delay if it had been found when the product went live.
The examples above highlight an important aspect of ERM: the value of it isn’t simply that the organization is not going to be destroyed, it’s that the organization knows its risks well enough to make better, faster decisions.
Enterprise Risk Management Tools and Technology
Many organizations transition from spreadsheets to risk management software as their ERM programs grow. The platforms usually include other capabilities, such as centralised risk registers, automated visualisation of risk assessment matrices, workflows to assign and track mitigation actions, and reporting dashboards for leadership and the board.
The selection of the appropriate tool will depend greatly on the size and complexity of the organization. A carefully designed spreadsheet and disciplined processes might just be enough for smaller companies, and larger organizations with regulatory reporting needs might require custom-built governance, risk, and compliance (GRC) systems that integrate with other business applications.
Regardless of the tool, it is important to keep in mind that technology is a tool of the ERM process – not the ERM itself – and that the judicious use of technology is not a replacement for good judgment, culture and governance, which are the keys to effective risk management.
Measuring the Success of an Enterprise Risk Management Program
While it is easy to assess an ERM program on the basis of a disaster being avoided, this is not a complete measure as there are plenty of organizations that avoid major incidents by good fortune, rather than good process. The following is a more reliable indicator:
- Early identification of new and emerging risks before they can get out of hand.
- Quick and assured decision making in strategic planning
- An improvement in the number and/or intensity of operational incidents over time.
- Better audit and regulatory examination outcome
- More proactive employee reporting of risks
A pattern of these indicators over a series of reports will provide a clearer understanding of whether the ERM program is actually enhancing organizational resilience.
Conclusion
ERM is not about removing uncertainty, it’s about facing uncertainty with clarity and preparation. Organizations shift from firefighting to decision-making and decision making to a coordinated effort by introducing risk identification, assessment and response in one framework. If you are developing a risk management program for the first time, or fine-tuning an existing program, the same thing is always the same: Safeguard what’s built to foster the confidence to take new chances. Assess where there are the greatest “blind spots” in your organization now and then make improvements.
Frequently Asked Questions
What is the primary objective of the Enterprise Risk Management?
Rather than engaging in risk management in departmental silos, the primary objective is to enable organizations to identify, assess and respond to risks in a coordinated manner, enabling them to protect value and make more confident strategic decisions.
What are the differences between enterprise risk management and the traditional risk management approach?
Typical risk management is done sector-wise, e.g., insurance, safety, etc., and different teams take care of each sector. ERM combines all types of risk in an organization-wide perspective—strategic, operational, financial and compliance.
Is there a need for enterprise risk management among small businesses?
Yes, but the tactic can be toned down. Small businesses have a multitude of the same risk categories as large businesses and even the most basic risk register and risk review process can make a significant difference in decision-making and resilience.
What ERM framework do I need to adopting for my organization?
This will depend on the nature of your business and objectives. COSO ERM is applicable for organizations with a strong emphasis on the integration of risk and strategy and performance, whereas ISO 31000 is principles-based guidance that can be applied to different industries and sizes.
When is it time to update a risk assessment?
Many organizations carry out an enterprise-wide risk assessment each year or every six months and continually monitor the risks as new risks are identified or the risk landscape changes.
What is a risk appetite statement?
A statement of an organization’s willingness to take risk to achieve its goals. It helps to inform decisions regarding boundaries, such as a limit on financial risk or disruption to operations.
Is there a way of averting all business disasters with enterprise risk management?
No, and not by this standard! While ERM can only make people less likely to be affected by many risks and less affected by them, it is not completely removing uncertainty. It is important because of improved anticipation and recovery.
How does culture contribute to the success of ERM?
A significant one. Early warning of risk needs to be generated by employee’s concerns, not by their fear of blame. Successful ERM is more likely to be driven by leadership commitment to ERM and by open communication than by the framework selected.