Enterprise Risk Management

Traditionally, many organisations managed risks separately, with treasury handling financial risks, operations handling safety, and so on. ERM brings these together so that leaders can see the full picture, understand how risks interact and decide which to accept, reduce, transfer or avoid.

An ERM framework typically involves setting the organisation's risk appetite, identifying risks across all areas, such as strategic, financial, operational, compliance and reputational, assessing their likelihood and impact, assigning owners, putting controls in place and reporting regularly to senior management and the board.

For example, a manufacturer using ERM might realize that its dependence on a single supplier, its exposure to a foreign currency and a weakness in its IT security together create a much larger risk than any one of them seemed to on its own.

Well-known ERM frameworks include those published by COSO and the international standard ISO 31000. ERM aims to help organisations make better decisions about risk, not to remove all risk.