Chapter 1

Part A: Foundations

Introduction to enterprise risk management

Last updated November 20267 sectionsabout 16 min read

Key takeaways

ISO 31000 defines risk as the effect of uncertainty on objectives, and an effect may be positive as well as negative, so risk is not simply the chance of loss.
Without a stated objective there is no risk, because there is nothing to deviate from; the same event can be a serious risk to one organisation and irrelevant to another.
Risk appetite is set by the board for the enterprise as a whole, risk tolerance is the quantified variation allowed around a specific objective or risk type, and risk capacity is the most the organisation could bear before it fails.
Appetite must sit below capacity, and the gap between them is the margin of safety.
ERM is enterprise-wide, owned by the board and executive, integrated with strategy setting, and takes a portfolio view that reveals the correlations and concentrations no single assessment shows.

Enterprise risk management is the attempt to answer one question honestly: what could stop this organisation achieving what it set out to achieve, and what are we doing about it. Everything technical in this paper, the registers, the heat maps, the value-at-risk models and the three lines of defence, exists to make that question answerable at the scale of a whole organisation rather than one department at a time.

Evolution of ERM

Risk management did not begin as an enterprise discipline. It began in silos, and the history explains why the modern frameworks are shaped as they are.

How risk management became enterprise risk management

Phase	Characteristic	What forced the change
Insurance risk management	Risk meant insurable hazard: fire, theft, injury. The function sat in finance and its tool was the insurance policy.	Only a narrow class of risk is insurable, and the largest threats to an organisation are usually not.
Specialised silos	Separate functions grew for credit risk, market risk, safety, insurance and later compliance, each with its own methods and language.	Silos measure risk incompatibly, cannot aggregate, and miss risks that fall between them.
Integrated or enterprise risk management	A single framework covering all risk types, owned by the board, linked to strategy and objectives.	Corporate failures where the individual risks were known but nobody held the whole picture.
Risk as a strategic input	Risk appetite set at board level and used to shape strategy rather than to police it after the fact.	Recognition that avoiding all risk destroys value as surely as taking too much.

The formal reference points followed the same arc. COSO published its Internal Control Integrated Framework in 1992 and its first Enterprise Risk Management Integrated Framework in 2004, revising the latter in 2017 to align risk explicitly with strategy and performance. ISO published ISO 31000 in 2009 and revised it in 2018, deliberately as guidance rather than a certifiable requirement standard. In parallel, the Basel Committee developed the accords governing bank capital and risk from 1988 onwards, and corporate governance codes in most jurisdictions made the board's responsibility for risk explicit.

Defining risk

Risk (ISO 31000)

The effect of uncertainty on objectives. Three words carry the definition. Effect is a deviation from the expected, which may be positive or negative. Uncertainty is a deficiency of information about an event, its consequence or its likelihood. Objectives anchors the whole thing: without a stated objective there is no risk, because there is nothing to deviate from.

Risk (COSO ERM 2017)

The possibility that events will occur and affect the achievement of strategy and business objectives. COSO separates risk from opportunity in a way ISO does not, and places both against strategy.

Hazard

A source of potential harm. A hazard is a condition; a risk is the combination of that condition with a likelihood and a consequence against an objective.

Uncertainty

A state of deficiency of information. Distinguished from risk in the classical treatment because a risk can be assigned a probability distribution and pure uncertainty cannot, which matters when a model reports a number for something that was never measurable.

Peril and exposure

The peril is the cause of a loss, such as fire; the exposure is what stands to be lost, such as the warehouse. The pair is inherited from insurance and remains useful for describing a risk precisely.

Why the ISO definition says nothing about harm

Candidates frequently define risk as the chance of something bad happening and lose marks. ISO 31000 defines risk as the effect of uncertainty on objectives, and an effect may be positive. This is not word play. An organisation that treats risk purely as threat will systematically decline opportunities whose upside it never assesses, and will manage its way to a safe decline. Upside and downside are managed by the same process, which is why the modern frameworks refuse to define risk as loss.

Characteristics of risk

Risk is future-oriented: it concerns what has not yet happened, which is why it can only ever be estimated, never counted.
Risk is relative to an objective, so the same event is a risk to one organisation and irrelevant to another.
Risk has two dimensions at minimum, likelihood and consequence, and most frameworks add velocity, how fast the consequence arrives, and persistence, how long it lasts.
Risk is dynamic: the profile changes as the organisation, its strategy and its environment change, which is why a risk register reviewed annually is a historical document.
Risks are interdependent, so treating them one at a time understates the total, and a single event commonly triggers several.
Risk is perceived as well as measured, and perception is shaped by familiarity, dread, controllability and who bears the consequence, which is why stakeholders disagree about the same risk.
Risk can be transferred but rarely eliminated: insurance transfers the financial consequence, not the event or the reputational effect.

Aims of risk management

To increase the likelihood of achieving objectives, which is the primary aim and the one from which the others follow.
To reduce the volatility of outcomes, so that performance is predictable enough to plan and finance.
To protect people, assets, information, the environment and reputation from unacceptable harm.
To make better-informed decisions by making the risk in each option explicit and comparable.
To allocate capital and resource efficiently, directing them to the risks that matter and away from the ones that do not.
To satisfy governance, legal and regulatory obligations, which increasingly require a demonstrable risk process rather than merely a good outcome.
To build resilience, meaning the capacity to absorb disruption and continue, since some events cannot be prevented at any acceptable cost.
To exploit opportunity deliberately, taking risk where the return justifies it rather than by accident.

Key risk concepts

Inherent and residual risk

Inherent risk is the exposure before controls; residual risk is what remains after them. The pair is what demonstrates whether controls are doing anything, and a register showing identical inherent and residual ratings is evidence that the assessment was not done.

Risk appetite

The amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives. Set by the board, expressed for the enterprise as a whole.

Risk tolerance

The acceptable variation around a specific objective or risk type. Appetite is strategic and qualitative; tolerance is operational and normally quantified, which is the distinction examiners test.

Risk capacity

The maximum risk the organisation could bear before it fails, given its capital, liquidity and resources. Appetite must sit below capacity, and the gap between them is the margin of safety.

Risk profile

The description of any set of risks, at whatever level. An enterprise risk profile is the aggregated picture the board actually sees.

Risk owner

The person accountable for managing a risk and with the authority to do so. Accountability without authority is the commonest defect in a risk register.

Key risk indicator

A metric that gives early warning that exposure is changing, as distinct from a key performance indicator, which reports what has already happened.

The elementary expression of risk

Risk exposure = Likelihood x Consequence

Likelihood: the chance of the event occurring in a stated period
Consequence: the magnitude of the effect on the objective if the event occurs

The expression is adequate for ranking and for a heat map, and misleading where it is relied on alone. It treats a one-in-a-thousand catastrophe as equivalent to a frequent trivial loss, and it ignores velocity, correlation and the organisation's capacity to absorb the loss.

What ERM is

Enterprise risk management is the culture, capabilities and practices, integrated with strategy setting and performance, that organisations rely on to manage risk in creating, preserving and realising value. Four features distinguish it from risk management performed function by function.

It is enterprise-wide in scope, covering every risk type and every part of the organisation under one framework, so that exposures can be aggregated and compared.
It is owned by the board and executive rather than by a technical function, because the decisions it informs are strategic and only the board can set appetite.
It is integrated with strategy and performance, considered when objectives are set rather than applied to objectives already fixed.
It is a portfolio view: the concern is the aggregate exposure of the organisation, including correlations and concentrations that no individual risk assessment reveals.

Traditional and enterprise risk management compared

	Traditional risk management	Enterprise risk management
Scope	Specific risk types, function by function	All risk types, enterprise-wide
Ownership	Specialist functions	Board and executive, with risk owners in the business
View of risk	Threat to be minimised	Threat and opportunity, to be optimised against appetite
Relationship to strategy	Applied after strategy is set	Considered during strategy setting
Aggregation	None; risks assessed in isolation	Portfolio view including correlation and concentration
Frequency	Periodic, often annual	Continuous, embedded in decision-making

Strategic relevance of ERM

The case for ERM being strategic rather than administrative rests on the observation that organisations rarely fail because a risk was unknown. They fail because a known risk was owned by nobody, or was assessed in isolation from a correlated one, or was accepted at a level the board would not have accepted had it seen the aggregate.

It informs strategy selection, by making the risk in each strategic option explicit so options are compared on risk-adjusted terms rather than on expected return alone.
It tests the strategy's own assumptions, since the largest strategic risk is usually that a premise on which the strategy rests turns out to be false.
It allocates capital to the activities whose return justifies the risk they carry, which is impossible without a common measure across the enterprise.
It supports resilience and continuity, so a disruption is survivable rather than terminal.
It reduces the cost of capital, because lenders, insurers and investors price uncertainty, and a demonstrable risk framework reduces the uncertainty they price.
It protects reputation, which is generally the largest uninsured asset and the one most quickly destroyed.
It satisfies governance expectations: boards are now expected to state that they have reviewed the effectiveness of risk management, which cannot be done credibly without a framework.

Where the absence of ERM shows
A manufacturer sources a critical input from a single overseas supplier because it is the cheapest. Procurement records this as a cost saving.
The treasury function separately notes exposure to a foreign currency and hedges part of it.
The operations function separately holds two weeks of inventory, judged sufficient on historical lead times.
Each decision is defensible alone. Together they create a single point of failure whose consequence exceeds what any of the three functions was authorised to accept, and no single register records it because it belongs to none of them.
This is precisely the gap enterprise risk management exists to close: not the identification of an unknown risk, but the aggregation of known ones into a picture somebody is accountable for.

Self-check

Define risk in accordance with ISO 31000 and explain why the standard's definition refers to objectives rather than to loss. Distinguish risk appetite, risk tolerance and risk capacity. (12 marks)

Distinguish enterprise risk management from traditional risk management, and explain the strategic case for adopting an enterprise approach. (8 marks)

Show worked answer

The ISO definition, and the appetite trio (12 marks).

ISO 31000 defines risk as the effect of uncertainty on objectives. Effect means a deviation from the expected, which may be positive, negative or both. Uncertainty means a state, even partial, of deficiency of information relating to an event, its consequence or its likelihood. Objectives may be of any kind and may apply at any level of the organisation.

The definition refers to objectives rather than to loss for three reasons. First, risk is meaningless without an objective: an event has no significance in the abstract, and only becomes a risk when it may cause a deviation from something the organisation is trying to achieve, which is why the same event is a serious risk to one organisation and irrelevant to another. Second, defining risk as loss excludes upside, and an organisation whose framework recognises only threat will systematically decline opportunities whose potential gain it never assesses, managing itself into a safe decline while appearing prudent. Third, anchoring on objectives forces integration with strategy and planning, because it is impossible to identify risks without first stating what is to be achieved, which drags risk management out of a specialist function and into the process by which the organisation sets its direction.

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives. It is set by the board, expressed at enterprise level, and is typically qualitative or expressed in broad quantitative terms. Risk tolerance is the acceptable level of variation around a specific objective or within a specific risk type; it is operational, normally quantified, and it translates appetite into limits that a manager can be held to. Risk capacity is the maximum level of risk the organisation could absorb before its viability is threatened, determined by its capital, liquidity, and human and operational resources.

The three are related as a hierarchy of constraint. Capacity is a fact about the organisation and is not chosen. Appetite is a board choice and must sit below capacity, the gap being the margin of safety that allows the organisation to survive an outcome worse than it planned for. Tolerances sit within appetite and allocate it across objectives and risk types, so that the sum of what individual managers may accept does not exceed what the board has accepted overall. An organisation that sets appetite equal to capacity has no margin; one that sets tolerances without reference to appetite will find its aggregate exposure exceeding what the board sanctioned, notwithstanding that every individual limit was observed.

ERM distinguished, and the strategic case (8 marks).

Traditional risk management addresses specific risk types function by function, is owned by specialist functions, treats risk as a threat to be minimised, is applied after strategy has been set, assesses risks in isolation without aggregation, and operates periodically. Enterprise risk management covers all risk types across the whole organisation under one framework, is owned by the board and executive with risk owners in the business, treats risk as both threat and opportunity to be optimised against a stated appetite, is integrated into strategy setting rather than applied afterwards, takes a portfolio view that includes correlation and concentration, and operates continuously as part of decision-making.

The strategic case rests on the observation that organisations seldom fail because a risk was unknown. They fail because a known risk was owned by nobody, or was assessed in isolation from a correlated risk, or was accepted at an aggregate level the board would never have sanctioned had it seen the total. An enterprise approach addresses each: it assigns ownership with authority, it aggregates so that correlation and concentration become visible, and it compares the total against an appetite the board has set. Beyond loss avoidance it contributes positively. It permits strategic options to be compared on risk-adjusted rather than expected returns. It tests the assumptions on which the strategy itself rests, which is where the largest strategic risks usually sit. It allocates capital to activities whose return justifies the risk carried, which requires a measure common across the enterprise. It reduces the cost of capital, because lenders, insurers and investors price uncertainty and a demonstrable framework reduces the uncertainty they price. And it protects reputation, generally the largest uninsured asset. The distinguishing claim of ERM is therefore not that it prevents more losses, but that it allows an organisation to take risk deliberately and in known quantity, which is what creating value requires.