What Is ERM and Why Is It Important?

Updated, March 2019

This isn’t just our opinion. In its “2010 Report on the Current State of Enterprise Risk Oversight: 2nd Edition,” North Carolina State University concluded that risk management processes are relatively immature and ad hoc. In addition, Standards & Poor’s (S&P) issued a report on how non-financial companies are managing risk based on its reviews, declaring that the state of development of ERM in non-financial companies is at a relatively immature stage.

In its immature state, ERM adds limited value because it often leaves management with a list of risks and very little insight as to what to do next. In its various forms, ERM may increase risk awareness with management, the board of directors and others, but it will not be effective in driving decisions because it typically isn’t integrated with the enterprise’s decision-making processes. As a result, risk is often an afterthought to strategy and risk management is an appendage to performance management.

So what is ERM?

The Committee of Sponsoring Organizations (COSO) points out that ERM, among other things is:

• An ongoing process
• Applied in strategy setting and across the enterprise
• Designed to identify potential events that, if they occur, will affect the entity and to manage risk within its risk appetite
• Provides reasonable assurance regarding the achievement of business objectives

ISO 31000 states that risk management is an integral part of organizational processes as well as a part of decision making.

While these and other risk management frameworks provide valuable insight in defining ERM, we believe ERM can be summed up as follows:

ERM is the discipline, culture and control structure an organization has in place to continuously improve its risk management capabilities in a changing business environment.

Why is ERM important?

Events over recent years have pointed to five realities that every CEO and board face:

1. The time may come – sooner than we may expect – when the fundamentals of the business are about to change. Risk management is about securing “early mover” positioning in the marketplace. Management of strategic uncertainties requires an understanding of the key assumptions underlying the strategy and monitoring changes in the business environment to ensure that these assumptions remain valid over time.
2. It is not what we know that matters; it is what we don’t know that makes the difference. The question should be: Is our approach to assessing risk identifying emerging risks and telling us something we don’t know?
3. Most businesses are boundary-less. A strategic perspective applied to operational risks suggests the need for an end-to-end extended enterprise view of the value chain, requiring consideration of upstream and downstream relationships. What happens if any critical component of this chain were lost for an indeterminate period of time?
4. Sooner or later, there will be a crisis that will test your company. Even the most effective risk management cannot prevent this exposure. Yet companies spend a lot of time guessing at probabilities and ignoring the speed of impact, the persistence of impact over time and the organization’s response readiness.
5. Management and directors are struggling with delineating between risk management and risk oversight. The risk oversight playbook is evolving. CEOs fear an overlay and non-value-added activity that is out of sync with the rhythm of the business. It makes sense to start both risk management and risk oversight at the same place – with the formulation of strategy, including an understanding of the key assumptions underlying the strategy.

These five realities are forcing management and their boards to take a fresh look at risk and crisis management. An effectively functioning ERM process is important because it can help them address these new realities.