for Risk Management which was published on 13 November 2009, and updated in 2018. An accompanying standard, ISO 31010 - Risk Assessment Techniques, soon followed publication (December 1, 2009) together with the updated Risk Management vocabulary ISO Guide 73. The standard set out eight principles based around the central purpose, which is the creation and protection of value. Implementing an ERM program Goals of an ERM program Organizations by nature manage risks and have a variety of existing departments or functions ("risk functions") that identify and manage particular risks. However, each risk function varies in capability and how it coordinates with other risk functions. A central goal and challenge of ERM is improving this capability and coordination, while integrating the output to provide a unified picture of risk for stakeholders and improving the organization's ability to manage the risks effectively. Typical risk functions The primary risk functions in large corporations that may participate in an ERM program typically include: Strategic planning - identifies external threats and competitive opportunities, along with strategic initiatives to address them Marketing - understands the target customer to ensure product/service alignment with customer requirements Compliance & Ethics - monitors compliance with code of conduct and directs fraud investigations Accounting / Financial compliance - directs the Sarbanes–Oxley Section 302 and 404 assessment, which identifies financial reporting risks Law Department - manages litigation and analyzes emerging legal trends that may impact the organization Insurance - ensures the proper insurance coverage for the organization Treasury - ensures cash is sufficient to meet business needs, while managing risk related to commodity pricing or foreign exchange Operational Quality Assurance - verifies operational output is within tolerances Operations management - ensures the business runs day-to-day and that related barriers are surfaced for resolution Credit - ensures any credit provided to customers is appropriate to their ability to pay Customer service - ensures customer complaints are handled promptly and root causes are reported to operations for resolution Internal audit - evaluates the effectiveness of each of the above risk functions and recommends improvements Corporate Security - identifies, evaluates, and mitigates risks posed by physical and information security threats Common challenges in ERM implementation Various consulting firms offer suggestions for how to implement an ERM program. Common topics and challenges include: Identifying executive sponsors for ERM. Establishing a common risk language or glossary. Describing the entity's risk appetite (i.e., risks it will and will