Enterprise risk management
ERMAlso called firm-wide risk management
Enterprise risk management is the approach of identifying, assessing and managing all of a firm's risks together, rather than in separate silos. It links risk to strategy and risk appetite, so the board sees credit, market, liquidity, operational, compliance and reputational risks in one picture and can decide which risks to take.
How it works
The board sets a risk appetite and approves a risk management framework covering every material risk type. A chief risk officer and an independent risk function run the framework day to day: maintaining a risk taxonomy, collecting risk assessments from the business, setting limits and tracking key risk indicators. Frameworks such as COSO ERM and ISO 31000 give a common structure that many firms adapt.
Risk owners in the first line assess and manage their risks, the second line challenges and aggregates them, and internal audit tests the whole system. Aggregated results feed a risk register and board reporting, showing where exposure sits against appetite. ERM also connects to capital and liquidity planning, stress testing and strategy, so major business decisions consider their effect on the firm's overall risk profile.
The rules
Sets out five components and 20 principles for linking risk management to strategy setting and performance, updating the 2004 COSO ERM framework.
All organisations, used voluntarilyMakes the management body responsible for approving risk strategies and requires significant institutions to have a risk committee advising on risk appetite and strategy.
EU credit institutions and investment firms in scopeRequires a board risk committee overseeing a global risk management framework and, for larger firms, a chief risk officer reporting to the risk committee and the CEO.
US bank holding companies with $50 billion or more in assets, with fuller requirements from $100 billionCommon questions
How is ERM different from traditional risk management?
Traditional risk management handles each risk type in its own department. ERM brings them together, so the firm can see how risks interact and compare total exposure with its appetite and strategy.
Who owns ERM in a bank?
The board owns the risk appetite and framework. The chief risk officer runs it day to day, while business lines own and manage the risks they create.
Is COSO ERM a legal requirement?
No. COSO ERM is a voluntary framework. Banking rules require sound risk management and governance, and many firms use COSO or ISO 31000 to structure how they meet them.
