Enterprise Risk Management

Enterprise Risk Management
CC BY-SA 3.0 · source
Name	Enterprise Risk Management
Focus	Organizational risk oversight
Related	Sarbanes–Oxley Act of 2002, COSO (Committee of Sponsoring Organizations of the Treadway Commission), ISO 31000

Enterprise Risk Management is an integrated approach to identifying, assessing, responding to, and monitoring risks that affect an organization’s ability to achieve objectives. Rooted in practices from Committee of Sponsoring Organizations of the Treadway Commission and standards like ISO 31000, it informs board-level oversight and executive decision-making across sectors such as Financial Services, Healthcare, Manufacturing, Energy and Information Technology. Practitioners draw from disciplines represented by institutions like Institute of Internal Auditors and Association for Federal Enterprise Risk Management to align risk appetite with strategy, compliance, and performance.

Overview

ERM emerged from corporate governance reforms tied to events such as the Enron scandal, the passage of the Sarbanes–Oxley Act of 2002, and regulatory responses exemplified by agencies like the Securities and Exchange Commission. It synthesizes concepts from actuarial science, management consulting firms including McKinsey & Company and Boston Consulting Group, and academic research at institutions such as Harvard Business School and London School of Economics. ERM typically addresses financial, operational, strategic, compliance, and reputational risks encountered by conglomerates like General Electric and Siemens, as well as sovereign entities involved with bodies like the World Bank and the International Monetary Fund.

Frameworks and Standards

Widely adopted frameworks include the COSO (Committee of Sponsoring Organizations of the Treadway Commission) ERM framework, ISO 31000, and sector-specific guidance from regulators like the Federal Reserve and the Office of the Comptroller of the Currency. Professional standards from Institute of Internal Auditors and certifications such as those by Project Management Institute and Global Association of Risk Professionals influence implementation. Jurisdictional requirements under laws like the Dodd–Frank Wall Street Reform and Consumer Protection Act and expectations from agencies such as European Banking Authority shape risk governance in banks such as JPMorgan Chase and Deutsche Bank.

Risk Identification and Assessment

Identification methods draw on techniques from Forbes-cited scenario analysis and academic models developed at Massachusetts Institute of Technology and Stanford University. Tools include risk registers used by firms like KPMG, PwC, Deloitte, and Ernst & Young alongside stress testing practices applied by Bank of England and Federal Deposit Insurance Corporation. Quantitative assessment leverages models from Moody's Analytics and S&P Global Ratings while qualitative insights are informed by case studies from BP incidents and Toyota recalls. Emerging approaches incorporate threat intelligence from organizations like NATO and Interpol for cybersecurity risk profiling.

Risk Response and Mitigation

Responses range from transfer mechanisms using instruments from Lloyd's of London and Munich Re to reduction strategies employed by Tesla, Inc. and Boeing. Hedging techniques draw on derivatives markets run by exchanges such as Chicago Mercantile Exchange and London Stock Exchange Group. Operational mitigations often reference supply-chain resilience work involving firms like Walmart and Maersk, and crisis frameworks used by governments during events like the COVID-19 pandemic. Legal and compliance remediation aligns with rulings from courts including the United States Supreme Court and regulatory actions by the European Commission.

Governance, Roles, and Culture

Governance models assign oversight to boards influenced by codes from Organisation for Economic Co-operation and Development and governance advisors such as Institutional Shareholder Services. Roles include the Chief Risk Officer position, internal audit functions tied to Institute of Internal Auditors, and risk committees modeled on practices at Apple Inc. and Microsoft. Culture change initiatives reference change-management research from Kotter International and leadership theories promoted by figures like Peter Drucker and Warren Buffett. Stakeholder engagement encompasses investors represented by BlackRock and Vanguard Group and regulators from Financial Conduct Authority.

Measurement, Monitoring, and Reporting

Metrics include key risk indicators (KRIs), value-at-risk models advanced by academics from University of Chicago and Columbia University, and performance linkages measured by entities such as Bloomberg and Thomson Reuters. Monitoring uses dashboards developed by vendors like SAP SE and Oracle Corporation and reporting aligns with disclosure expectations of exchanges such as New York Stock Exchange and NASDAQ. Audit trails and assurance may involve external auditors like KPMG and PwC and standards setters such as Financial Accounting Standards Board and International Accounting Standards Board.

Integration with Strategy and Decision-Making

Strategic integration ties ERM to corporate planning at firms such as Procter & Gamble and Cisco Systems and to public-sector strategy in ministries modeled after UK Cabinet Office guidance. Scenario planning methods reflect practice at Shell and policy analysis from RAND Corporation. Investment decisions consider risk-adjusted returns using frameworks taught at Wharton School and INSEAD, while mergers and acquisitions due diligence draws on precedent transactions by Goldman Sachs and Morgan Stanley.

Tools, Techniques, and Technology

Technology stacks include governance, risk and compliance (GRC) platforms from vendors like RSA Security and ServiceNow, risk analytics from SAS Institute and Tableau Software, and cybersecurity solutions by CrowdStrike and Palo Alto Networks. Techniques incorporate Monte Carlo simulation popularized in finance firms such as Barclays and optimization algorithms developed in collaboration with research centers like Carnegie Mellon University. Emerging technologies involve applications of blockchain researched at MIT Media Lab and machine learning models from Google DeepMind applied to predictive risk scoring.

Category:Risk management