Enterprise risk management (ERM) is an organisation-wide approach that manages all risks together and links them to strategy. The board sets the risk appetite, and risk becomes everyone's job. The best-known framework, COSO ERM (2017), has five components: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.
ERM vs traditional risk management
| Traditional | ERM | |
|---|---|---|
| Scope | Separate risks in separate departments | All risks, organisation-wide |
| Link to strategy | Weak | Built into strategy and objectives |
| Responsibility | Specialists | Everyone, led by the board |
| Focus | Avoiding losses | Balancing risk and opportunity within risk appetite |
| Timing | Reactive | Continuous |
The board and risk culture
Chapter 12 of the book stresses that the board leads ERM and that risk awareness must be part of the culture, just like controls. In practice the board sets risk appetite, approves the framework, and reviews the main risks regularly, often through a risk committee.
Strategic vs operational risk
| Strategic risk | Operational risk | |
|---|---|---|
| Source | Strategic decisions and the organisation's position in its environment | Day-to-day operations and internal controls |
| Examples | Failing to update products; a poor acquisition | Fraud, system failure, quality problems |
| Managed by | Board and senior management | Managers, through internal controls |
See types of business risk and the risk matrix for assessing them.
ERM in ACCA SBL
ERM sits in risk (syllabus area D). Typical tasks ask you to advise a board that manages risk informally. Recommend setting risk appetite, a risk register, clear ownership, a risk committee and regular reporting, using case facts. Link to the three lines of defence and the COSO framework.
Advantages
- Joined-up view of all risks
- Better strategic decisions
- Clear risk appetite and ownership
- Builds a risk-aware culture
Limitations
- Costly and time-consuming to set up
- Can become bureaucratic
- Needs strong board commitment
- Hard to measure some risks
FAQs
What is enterprise risk management?
ERM is an organisation-wide approach to managing risk that links risk to strategy and performance. It looks at all risks together, across every part of the business, rather than department by department.
What are the five components of COSO ERM?
Governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting. They are supported by 20 principles (COSO, 2017).
What is the difference between ERM and traditional risk management?
Traditional risk management handles risks in silos (insurance, health and safety, treasury). ERM looks at all risks together, links them to strategy and makes risk everyone's responsibility.
What is risk appetite?
The amount and type of risk an organisation is willing to accept in pursuit of its objectives. The board sets it, and ERM keeps risk-taking within it.
What is the difference between COSO ERM and ISO 31000?
Both are ERM frameworks. COSO ERM (2017) is widely used by US and listed companies and links closely to strategy and performance. ISO 31000 (2018) is a shorter international standard of principles and process that suits any organisation.