Glossary term
Enterprise Risk Management (ERM)
Subject: Risk Management, Risk Fundamentals and Frameworks
Also known as: Enterprise-wide risk management
Enterprise risk management is a way of managing risk across the whole organisation in one connected approach, linking risk to strategy and objectives and giving the board a combined view of what could affect results.
Explanation
Instead of each department handling its own risks, ERM uses a common language, process and reporting line, so credit, operational, cyber, legal and strategic risks are seen together. The usual steps are to identify risks, assess and rank them, choose treatments, then monitor and report. It runs from the board's risk appetite down to individual risk owners and limits. Frameworks such as COSO ERM and ISO 31000 give structure, though firms adapt them. The combined view shows things that silos hide, for example one supplier causing financial, operational and reputational exposure at once. Risk appetite and risk culture decide whether the process drives real decisions or turns into paperwork. ERM is the approach; a risk management framework is the set of policies, roles and tools that carry it out. Boards and rating agencies look for it because it shows whether risks are understood before they become losses.
Example
A mid-sized logistics group used to keep fuel price, driver safety and IT outage risks in three separate reports. Under ERM, one risk committee reviews a single register and ranks all three against the board's appetite. It notices that a fuel price spike and a depot IT outage in the same month would together breach the cash limit, and agrees a response before either happens.
Not to be confused with
- Risk Management Framework (RMF)
- The framework is the policies, roles and tools in use; ERM is the integrated, organisation-wide way of working that uses them.