Enterprise risk management (ERM): what it is and how to set it up
Most businesses already manage risk — the finance team watches cash, IT watches security, operations watches suppliers. Enterprise risk management is what happens when those separate lists become one picture the leadership team can actually steer by.
Enterprise risk management (ERM) is an organisation-wide approach to identifying, assessing and responding to the risks that could stop the business achieving its objectives, managed as one portfolio rather than in separate departmental silos. It links risk to strategy through a risk appetite set by leadership, uses one method and one register across the business, gives every significant risk a named owner, and reports the top risks to the board on a regular cycle. Frameworks such as COSO ERM and ISO 31000 describe how to do it; a small or mid-sized business can set up a working ERM programme in about 90 days.
Run ERM from one registerRisk Samurai gives every department the same scales, owners and review dates, and rolls them up into one view for leadership — no spreadsheet merging.
Get early accessWhat enterprise risk management is
Enterprise risk management (ERM) is an approach in which the whole organisation identifies, assesses, responds to and reports on its risks in one consistent way, with leadership looking at the result as a single portfolio. The word that matters is enterprise: the subject is the business and its objectives, not one function’s concerns.
Three features distinguish ERM from risk management that merely happens in several places at once:
- It starts from objectives. A risk is anything that could stop the business achieving what it set out to do this year and over the plan period. That framing comes straight from ISO 31000, which defines risk as the effect of uncertainty on objectives.
- It is governed by an appetite. Leadership decides, in writing, how much risk it is willing to take in each area. That risk appetite statement turns abstract scores into decisions: treat, accept or escalate.
- It is one system. One method, one set of likelihood and impact scales, one register and one reporting cycle — so a cyber risk and a supplier risk scored “15” mean the same thing.
If you are new to the basics — the process, the four responses, how to rate likelihood and impact — start with what is risk management. This guide assumes those basics and focuses on running them across a whole organisation.
ERM vs traditional risk management
Traditional, or siloed, risk management is not wrong; it is incomplete. Each specialist team does good work inside its own boundary, but no one sees how the risks connect or which ones matter most to the business as a whole.
| Siloed risk management | Enterprise risk management | |
|---|---|---|
| Starting point | Hazards and compliance duties of one function | The organisation’s objectives and strategy |
| Who looks at the whole | Nobody, or the insurer at renewal | The leadership team and the board, on a set cycle |
| Scales | Each team uses its own | One set of likelihood and impact scales for everyone |
| Risk appetite | Implicit, varies by manager | Written, approved by leadership, used for decisions |
| Interactions | Ignored — a supplier failure and a cyber incident are separate items | Considered — one event can trigger several risks |
| Upside | Rarely considered | Risks of not acting (missed opportunities) are in scope |
| Output | Several lists in different formats | One register and a top-risk report |
Why ERM matters for a growing business
The case for ERM in a 50–500 person organisation is practical rather than theoretical:
- Better allocation of money and attention. When all significant risks are scored on the same scale, it becomes obvious that the backup provider you have been postponing matters more than the third policy rewrite this year.
- Fewer surprises. Many damaging events are combinations: a key person leaves during a system migration while the main customer renegotiates. Only a combined view shows the cluster.
- Faster, defensible decisions. With an agreed appetite, a manager knows which risks they can accept and which must go up a level.
- Easier conversations with outsiders. Investors, lenders, insurers and large customers increasingly ask how risk is governed. A register, an appetite statement and board minutes answer the question in minutes.
- A foundation for regulation. Sector rules on operational resilience, data protection and internal controls all assume you already know your risks. ERM is the place you record them once.
ERM frameworks: COSO ERM and ISO 31000
You do not need a framework to start, but two are worth knowing because your auditors, investors or regulators will refer to them.
- COSO ERM — Integrating with Strategy and Performance (2017) is published by the US Committee of Sponsoring Organizations of the Treadway Commission. It organises ERM into five components and 20 principles and is strongest on board oversight, culture and the link between risk and strategy.
- ISO 31000:2018 is the international standard for risk management. It is short, principles-based and applies to any organisation and any type of risk. It describes a framework (how risk management is embedded) and a process (how risks are identified, analysed, evaluated and treated).
Both describe ERM; they differ in emphasis and length. We compare them side by side, with NIST and other frameworks, in risk management frameworks compared. A common and sensible choice for small and mid-sized organisations is to run the ISO 31000 process day to day and use COSO’s vocabulary when reporting to a board that knows it.
The components of an ERM programme
Strip away the terminology and every working ERM programme has the same six parts.
| Component | What it is | Minimum version for an SME |
|---|---|---|
| 1. Governance | Who is accountable for the system and for each risk; how often leadership reviews | A two-page risk policy approved by the board or owners; a named risk coordinator |
| 2. Risk appetite | How much risk the organisation will take, by category | One page: appetite level and a few limits per category |
| 3. Method | How risks are identified, described and scored | Cause–event–consequence statements; a 5×5 risk matrix with written scale definitions |
| 4. Risk register | The single record of risks, owners, controls, scores and actions | One register, every department contributing |
| 5. Monitoring | How you know when a risk is moving | Review dates by risk level; five to ten key risk indicators |
| 6. Reporting and culture | How risk information reaches decision-makers, and whether people raise risks early | A quarterly top-risk report; risk as a standing agenda item |
The rules that tie these together — scope, roles, scales, review cycle, reporting — are usually written down in a risk management plan or risk policy. Keep it short enough that managers actually read it.
Risk categories
ERM works best with a short, stable list of categories so the portfolio can be summarised. A typical set for a commercial business:
- Strategic — market, competition, business model, major change programmes.
- Financial — liquidity, credit, currency, funding, customer concentration.
- Operational — processes, people, systems, suppliers and external events; see our guide to operational risk.
- Technology and cyber — security, availability, data.
- Compliance and legal — regulation, contracts, litigation; see compliance risk management.
- Reputational and ESG — usually a consequence of the others, but worth tracking on its own when conduct or sustainability is material.
Roles: who does what in ERM
| Role | Responsibilities |
|---|---|
| Board or owners | Approve the risk appetite and policy; review the top risks at least quarterly; challenge whether the picture is complete |
| Chief executive or managing director | Owns the ERM programme; accepts residual risk above managers’ authority |
| Risk coordinator (often finance or operations) | Runs the cycle, maintains the method and register, prepares reports. In larger firms this is a chief risk officer |
| Risk owners | Senior managers accountable for specific risks: keep the entry current, own actions, report changes |
| Everyone | Raise new risks, incidents and near misses early |
Larger organisations describe these responsibilities with the Institute of Internal Auditors’ Three Lines Model (updated in 2020): management owns and manages risk (first line); specialist risk and compliance functions provide expertise, support and challenge (second line); internal audit provides independent assurance (third line). A company of 80 people will not have three separate teams, but the idea still helps: the person who checks a control should not be the person who runs it.
How to implement ERM in 90 days
This plan assumes a business of roughly 50–500 people with no formal ERM today. It is deliberately lean: the aim is a working cycle by day 90, improved over the following year.
| When | Step | Output |
|---|---|---|
| Weeks 1–2 | Get a sponsor. Agree scope (whole company), the risk categories, and who coordinates | One-page mandate signed by the CEO |
| Weeks 2–3 | Agree the method: scales for likelihood and impact with written definitions, the matrix, review frequencies by level | Method section of the risk policy |
| Weeks 3–5 | Run identification workshops, one per department, each starting from that department’s objectives | Draft entries: 10–25 risks per area |
| Weeks 5–6 | Consolidate into one register. Merge duplicates, rewrite vague entries, assign owners | One register of 30–60 risks |
| Weeks 6–8 | Score inherent and residual risk; record existing controls; agree actions for risks above appetite | Scored register with action plans (see inherent vs residual risk) |
| Weeks 8–10 | Draft the risk appetite statement using what the register shows; leadership debates and approves it | Approved appetite statement |
| Weeks 10–12 | First top-risk report to the board; set the calendar for monthly owner updates and quarterly reviews | Board minute; review calendar |
Tip: draft the appetite after the first register, not before. Leaders find it much easier to say “this level of supplier concentration is too much” when they can see the actual risk than to agree an abstract appetite for “operational risk”.
Enterprise risk register example
An extract from the consolidated register of a 200-person B2B services company, scored on a 5×5 matrix (likelihood × impact). Notice that the risks come from different departments but are scored on one scale and compared directly.
| ID | Category | Risk | Owner | Residual | Appetite | Response |
|---|---|---|---|---|---|---|
| E-01 | Financial | Top three clients provide over 40% of revenue; loss of one cuts margin below covenant | CFO | 4×5 = 20 | Low | Treat — sales plan targets new sectors; covenant headroom monitored monthly |
| E-02 | Technology | Ransomware encrypts the delivery platform and backups | CTO | 2×5 = 10 | Low | Treat — immutable backups, quarterly restore test |
| E-03 | Operational | Two senior engineers hold knowledge of the billing integration | COO | 3×4 = 12 | Moderate | Treat — document runbooks, pair a third engineer |
| E-04 | Strategic | Competitors bundle our core service into their platform at lower price | CEO | 3×4 = 12 | Moderate | Tolerate — monitor; review pricing at the half-year |
| E-05 | Compliance | Personal data processed by a new subcontractor without a data processing agreement | DPO | 2×3 = 6 | Low | Treat — contract checklist before onboarding |
| E-06 | Operational | Office lease ends in 14 months with no decision on renewal | COO | 2×2 = 4 | Moderate | Accept — decision due at next quarterly review |
The value appears in the comparison: the board can see that client concentration, not cyber, is the biggest residual risk this quarter, and ask why it is above a “low” appetite. For the column-by-column structure, see what is a risk register or download our risk register template.
Reporting ERM to the board
A board does not need the full register. A good quarterly ERM report fits on two or three pages:
- Top risks — the eight to twelve highest residual risks, with owner, score, trend arrow and one line on what changed.
- Outside appetite — every risk above its category’s appetite, with the action, due date and whether it is on track.
- Heat map — the residual position of the top risks on the matrix, compared with last quarter.
- Indicators — the key risk indicators that breached a threshold.
- New and closed risks, and incidents — what entered or left the register and any events that should have been on it.
- Decisions needed — risk acceptances above management’s authority, or appetite changes.
Rules and codes that expect ERM
Most small private companies have no legal duty to run ERM, but several regimes assume it, and they shape what investors and acquirers expect:
- UK Corporate Governance Code 2024 (premium-listed and other companies reporting against the Code): boards must maintain a sound risk management and internal control framework, and under Provision 29 — which applies to financial years beginning on or after 1 January 2026 — make a declaration on the effectiveness of material controls.
- ASX Corporate Governance Council Principles and Recommendations, Principle 7 (“Recognise and manage risk”): listed entities are expected to have a risk committee or equivalent and to review the risk management framework at least annually, reporting against the recommendations on an “if not, why not” basis.
- Financial services regulators: APRA-regulated entities in Australia must meet prudential standards on risk management and, from 1 July 2025, operational risk under CPS 230; UK firms must meet FCA and PRA operational resilience rules.
Even where none apply, a funded start-up or a business preparing for sale will find that due diligence asks for the same artefacts: a register, an appetite, minutes of reviews.
Common ERM mistakes
- Collecting lists, not managing a portfolio. Stapling departmental registers together is not ERM. Scales must be common and leadership must compare and decide.
- Too many risks. A 300-line register hides the twelve that matter. Keep enterprise-level entries above a threshold and let teams keep detail locally.
- Vague risk statements. “Cyber risk” or “people risk” cannot be owned or scored. Write cause, event and consequence.
- An appetite statement nobody uses. If no decision has ever been made by comparing a score to the appetite, it is decoration.
- The coordinator owns all the risks. The coordinator owns the process; managers own their risks.
- Annual-only reviews. Risks move monthly. Owners should update their entries at least as often as their review frequency requires.
Frequently asked questions
What is enterprise risk management in simple terms?
Enterprise risk management is managing all of an organisation's significant risks together, as one portfolio linked to its strategy, instead of leaving each department to manage its own risks separately. It uses one method, one register and one reporting line to leadership.
What is the difference between ERM and traditional risk management?
Traditional risk management is usually done in silos: insurance, health and safety, IT security and finance each keep their own view. ERM brings those views together, uses common scales and a shared risk appetite, looks at how risks interact, and considers upside as well as downside.
What are the components of ERM?
Most programmes have six working parts: governance and roles, a risk appetite linked to strategy, a common assessment method, a single risk register, monitoring through reviews and key risk indicators, and regular reporting to leadership. COSO ERM groups these into five components: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.
Is ERM only for large companies?
No. The principles scale down. A business of 50 to 500 people can run ERM with a two-page policy, a risk appetite statement, one register owned by named managers and a quarterly review by the leadership team. What changes with size is the amount of formality, not the logic.
Which ERM framework should I use?
ISO 31000 is the usual default outside the US because it is short and fits any organisation. COSO ERM is better known to US auditors and audit committees and is stronger on board governance and strategy. Many organisations follow ISO 31000's process and borrow COSO's language for board reporting.
One portfolio of risks, not ten spreadsheets
Risk Samurai keeps every department’s risks in one register with shared scales, owners, actions and indicators, so the leadership view is always current. AI drafts the first version of your register, so you start from a draft rather than a blank page.
Get early access