what is enterprise risk management erm 
enterprise risk management erm is a methodology that looks at risk management strategically from the perspective of the entire firm or organization it is a top down strategy that aims to identify assess and prepare for potential losses dangers hazards and other potentials for harm that may interfere with an organization s operations and objectives and or lead to losses understanding enterprise risk management erm enterprise risk management takes a holistic approach and calls for management level decision making that may not necessarily make sense for an individual business unit or segment thus instead of each business unit being responsible for its own risk management firm wide surveillance is given precedence it also often involves making the risk plan of action available to all stakeholders as part of an annual report industries as varied as aviation construction public health international development energy finance and insurance all have shifted to utilize erm erm therefore can work to minimize firm wide risk as well as identify unique firm wide opportunities communicating and coordinating between different business units are key for erm to succeed since the risk decision coming from top management may seem at odds with local assessments on the ground firms that utilize erm will typically have a dedicated enterprise risk management team that oversees the workings of the firm 1while erm best practices and standards are still evolving they have been formalized through coso an industry group that maintains and updates such guidance for companies and erm professionals 2erm friendly firms may be attractive to investors because they signal more stable investments a holistic approach to risk managementmodern businesses face a diverse set of risks and potential dangers in the past companies traditionally handled their risk exposures via each division managing its own business enterprise risk management calls for corporations to identify all the risks they face it also makes management decide which risks to manage actively as opposed to risks being siloed across a company a company sees the bigger picture when using erm erm looks at each business unit as a portfolio within the firm and tries to understand how risks to individual business units interact and overlap it is also able to identify potential risk factors that are unseen by any individual unit companies have been managing risk for years traditional risk management has relied on each business unit evaluating and handling its own risk and then reporting back to the ceo at a later date more recently companies have started to recognize the need for a more holistic approach 1a chief risk officer cro for instance is a corporate executive position that is required from an erm standpoint the cro is responsible for identifying analyzing and mitigating internal and external risks that impact the entire corporation the cro also works to ensure that the company complies with government regulations such as sarbanes oxley sox and reviews factors that could hurt investments or a company s business units the cro s mandate will be specified in conjunction with other top management along with the board of directors and other stakeholders a good indication that a company is working at effective erm is the presence of a chief risk officer cro or a dedicator manager who coordinates erm efforts components of enterprise risk managementthe coso enterprise risk management framework identifies eight core components that define how a company should approach creating its erm practices a company s internal environment is the atmosphere and corporate culture within the company set by its employees this sets the precedence of what the company s risk appetite is and what management s philosophy is regarding incurring risk the internal environment may be set by upper management or the board and communicated throughout an organization though it is often reflected through the actions of all employees as a company determines its purpose it must set objectives that support the mission and goals of a company these objectives must then be aligned with a company s risk appetite for example an ambitious company that has set far reaching strategic plans must be aware that there may be internal risks or external risks associated with these lofty goals in response a company can align the measures to be taken with what it wants to accomplish such as hiring additional regulatory staff for expansion areas it is currently unfamiliar with positive events may have a great impact on a company on the other hand negative events may have detrimental outcomes on a company s ability to continue to operate erm guidance recommends that companies identify important areas of the business and associated events that may have dire outcomes these high risk events may pose risks to operations e g natural disasters that force offices to temporarily close or strategic e g government regulation outlaws the company s primary product line in addition to being aware of what may happen the erm framework details the step of assessing risk by understanding the likelihood and financial impact of risks this includes not only the direct risk e g a natural disaster yields an office unusable but also residual risks e g employees may not feel safe returning to the office though difficult the erm framework encourages companies to consider quantifying risks by assessing the percent change of occurrence as well as the dollar impact a company can respond to risk in the following four ways control activities are the actions taken by a company to create policies and procedures to ensure management carries out operations while mitigating risk control activities often referred to as internal controls are broken into two different types of processes information systems should be able to capture data useful to management to better understand a company s risk profile and risk management this means not granting exceptions for departments outperforming others all aspects of a company should be continually monitored by extension some of this data should be analyzed and communicated to employees if it is relevant to mitigating risk by communicating with employees there is more likely to be greater buy in for processes and protection over company assets a company can turn to an internal committee or an external auditor to review its policies and practices this may include reviewing what is actually performed compared with what policy documents suggest this may also entail getting feedback analyzing company data and informing management of unprotected risks in an ever changing environment companies must also be ready to assess their erm environment and pivot as needed the committee of sponsoring organizations coso board originally published the erm framework in 2004 then an updated version was published in 2017 the publication has been widely used since 2