What is enterprise risk management (ERM)?
A joined-up way to understand, prioritise and manage the risks that could stop an organisation reaching its objectives.
Managing risk as one picture, not many.
Enterprise risk management (ERM) is a structured, organisation-wide approach to identifying, assessing, responding to and monitoring risk, tied directly to the organisation’s strategy and objectives. Instead of each department managing its own risks in isolation, ERM brings them together so leaders can see which risks matter most, how they connect, and how much risk the organisation is willing to take.
Risk is not only about avoiding loss. Well-run ERM also helps an organisation take the right risks on purpose, because it can see the upside and the downside of a decision together.
Eight areas of risk, one view.
Strategic risk
Choices about markets, products, partners and investments that do not deliver what was expected.
Financial risk
Credit, market and liquidity exposures, and pressure on funding, cash flow and capital.
Operational risk
Failed or inadequate processes, people and systems, or external events that disrupt delivery.
Compliance and legal risk
Breaches of laws, regulation, licence conditions or contracts, and the penalties that follow.
Technology and cyber risk
System failure, data breaches, ransomware and dependence on critical platforms.
Third-party and supply chain risk
Suppliers, outsourcers and partners that fail, or that expose the organisation to their own risks.
Geopolitical and external risk
Conflict, sanctions, economic shocks, extreme weather and other events outside the organisation’s control.
Reputation and conduct risk
Loss of trust from how the organisation, its people or its partners behave or respond when things go wrong.
Five steps, at a general level.
Set the context
Agree the objectives, the risk appetite (how much risk is acceptable) and who owns what.
Identify
List the events and conditions that could help or hinder the objectives, in a risk register.
Assess and prioritise
Judge how likely each risk is and how big its impact could be, then rank them.
Respond
Decide whether to avoid, reduce, transfer (for example insure) or accept each risk, and put controls in place.
Monitor and report
Track indicators and incidents, report to senior leaders and the board, and review the picture regularly.
The cycle repeats. New projects, markets, suppliers and incidents all change the risk picture, so the register is a living document rather than a one-off exercise.
You do not have to start from scratch.
COSO ERM
A widely used US-origin framework, Enterprise Risk Management: Integrating with Strategy and Performance. It links risk to strategy-setting and performance, and covers governance and culture, strategy and objectives, performance, review, and information and reporting.
ISO 31000
The international risk management standard. It sets out principles, a framework for embedding risk management in governance, and a process for identifying, analysing, evaluating and treating risk. It gives guidance rather than certifiable requirements.
The three lines model
A way to organise accountability: management owns and manages risk, risk and compliance functions oversee and challenge, and internal audit gives independent assurance to the board.
Regulatory expectations
Supervisors in sectors such as banking and insurance expect a documented risk framework, a board-approved risk appetite and regular risk reporting. Requirements vary by sector and jurisdiction, so check the rules that apply to you.
What ERM looks like in practice.
These examples are generic and illustrative. Every organisation sets its own scales, wording and thresholds, and none of them describes a real client.
A risk register entry
Risk: A key cloud service provider is unavailable for more than a day.
Likelihood: Possible (3 on a 5-point scale).
Impact: Major (4 on a 5-point scale).
Rating: 12, high.
Owner: Head of Technology.
Controls and actions: Tested failover arrangements, a second supplier option, and a quarterly review.
A risk appetite statement
“We have a low appetite for risks that could interrupt our critical services beyond their agreed impact tolerance. We have a moderate appetite for well-governed investment in new markets and products, provided that we understand the risks and can recover from a setback.”
The board approves the statement, and managers use it when they accept, reduce or escalate a risk.
A key risk indicator with a threshold
Indicator: Critical supplier reviews that are overdue.
Green: None overdue.
Amber: One or two overdue. The risk owner is told.
Red: Three or more overdue, or any overdue by a long period. The risk committee is told and an action plan is agreed.
The thresholds here are examples only.
From risk register to continuity plan
1. The register records a supplier failure or a cyber event as a high-rated risk.
2. A business impact analysis shows which critical services depend on that supplier or system.
3. The continuity plan sets out the alternative supplier, the workaround and the recovery steps.
4. An exercise tests the plan, and the results update the register.
ADVOX can help you build these for your own organisation: see ERM Consulting and ERM Training.
Enterprise Risk Management (ERM) that connects to continuity.
ERM looks across every kind of risk and helps leaders decide what to do about it. Business continuity management (BCM) deals with one important outcome: keeping critical products and services running when something disrupts the organisation, whatever the cause. Operational resilience goes a step further, asking whether the organisation can stay within its tolerance for disruption.
ERM informs BCM
The enterprise risk assessment shows which disruptions are most likely and most damaging, so continuity effort goes where it matters.
BCM tests ERM
Business impact analysis and exercises show whether the controls and recovery arrangements work in practice.
Resilience joins them up
Impact tolerances and scenario testing connect risk appetite to what the organisation can actually deliver in a crisis.
Read more: What is business continuity?, What is operational risk? and What is operational resilience?
The words you will hear.
Risk appetite
The amount and type of risk an organisation is willing to accept in pursuit of its objectives.
Risk tolerance
The acceptable variation around an objective, often set as a limit or threshold that triggers action.
Risk register
The central record of identified risks, their ratings, owners, controls and actions.
Inherent and residual risk
Inherent risk is the exposure before controls. Residual risk is what remains after controls are applied.
Key risk indicators (KRIs)
Measures that give early warning that a risk is rising, such as system downtime or overdue supplier reviews.
Risk owner
The person accountable for managing a particular risk and keeping its entry in the register current.
Risk culture
How people at every level think about and respond to risk, including whether they speak up early.
Emerging risk
A new or changing threat that is hard to measure yet, such as a new technology or regulation.
What good ERM looks like.
Leadership ownership
The board and executives set the appetite and use risk information when they decide, rather than treating it as paperwork.
Clear accountability
Every significant risk has a named owner, and everyone knows who to tell when something changes.
Proportionate effort
The depth of analysis matches the size of the risk, so the process stays usable and does not become a reporting burden.
Tested response
Plans for the biggest risks are exercised, so the response is proven rather than assumed. ADVOX designs business continuity exercises and incident response and crisis management simulations around an organisation’s own risks.
Talk to ADVOX about enterprise risk and resilience.
We aim to reply to your enquiry within 2 hours during working hours.