Enterprise risk management (ERM) explained

Enterprise risk management (ERM) is the practice of identifying, ranking and responding to every kind of risk a business faces, strategic, operational, financial and compliance as well as insurable, in one process tied to the company's goals. Traditional risk management asks which policies to buy. ERM asks which risks could keep the business from reaching its objectives, how much risk it is willing to take, and what combination of controls, insurance and retained cost fits that answer.

ERM is a management discipline, not an insurance product. It matters to insurance buyers because the answers set your retentions, your limits and how much of the program you build around insurance at all.

What ERM is, and what it is not

The best-known definition comes from COSO, the Committee of Sponsoring Organizations of the Treadway Commission, whose 2017 publication Enterprise Risk Management: Integrating with Strategy and Performance replaced its 2004 framework. COSO's executive summary (June 2017) says enterprise risk management is not a function or department. It is the culture, capabilities and practices an organization integrates with strategy-setting and applies when it carries out that strategy. It also says ERM is more than a risk listing, is not a checklist, and is a system of monitoring, learning and improving.

That correction matters. Many companies hire a risk manager, build a spreadsheet and call it ERM. If the list never changes a budget, a contract or a strategic decision, it is a record, not a program. The role of the person who runs it is covered in what a risk manager does, and when a business needs one.

The two reference frameworks

You will hear two names from auditors, lenders and consultants.

COSO ERM (2017) organizes the practice into five components, supported by twenty principles:

1. Governance and culture, including board oversight and the behaviors the company wants.
2. Strategy and objective-setting, including the definition of risk appetite.
3. Performance: identifying risks, assessing their severity, prioritizing them, selecting responses and taking a portfolio view.
4. Review and revision, meaning checking how the program works as the business changes.
5. Information, communication and reporting.

ISO 31000:2018 is the international guideline on risk management, in its second edition. It is built from principles, a framework and a process: communication and consultation, scope and context, risk assessment (identification, analysis, evaluation), risk treatment, and monitoring and review. ISO 31000 is guidance, not a certification scheme. Its treatment options include avoiding the activity, removing the source, changing the likelihood or consequences, sharing the risk (through insurance, contracts or partners) and retaining it by informed decision.

Neither framework tells you which risks to rank first. They give a common vocabulary, and both say the program should scale to the organization. COSO states that ERM applies to organizations of any size.

The vocabulary you will use

• Risk appetite. The amount and type of risk the company is willing to accept in pursuit of its goals. It is usually a short board-approved statement.
• Risk tolerance. The acceptable variation around a specific objective, stated in numbers: "no single retained loss above $450,000."
• Risk capacity. The most the company could absorb before covenants break, liquidity runs short or the business fails. Appetite should sit well inside capacity.
• Key risk indicators. Early-warning measures: overdue safety corrective actions, days of supplier inventory, open vacancies in critical roles, patch backlog on servers.
• Portfolio view. Looking at risks together, because one event can hit property, supply, staff and customers at once. A flood is not four small risks, it is one large one.
• Risk owner. The named manager accountable for a risk and its response. The register itself is covered in the how to build a risk register guide.

A running cycle, in order

1. Set the context. Write the strategy and the three to five objectives that matter most this year, so risks are judged against something concrete.
2. Identify risks. Workshops with department heads, review of loss runs: what they are and how to request them, contract reviews, supplier and customer concentration, internal audit findings and external reports. The Allianz Risk Barometer 2026, based on 3,338 expert responses published in January 2026, put cyber incidents first, artificial intelligence second (up from tenth) and business interruption third. That reshuffle is the argument for refreshing the list rather than carrying it forward unchanged.
3. Assess. Score likelihood and severity on an agreed scale. Where data exists, use dollar ranges rather than labels.
4. Prioritize against appetite. Anything beyond tolerance needs a response and an owner.
5. Respond. Choose from avoid, reduce, transfer or retain; see risk transfer vs retention: avoid, reduce, transfer or retain.
6. Report to the board or owners on a fixed calendar, with the top risks, key risk indicators and open actions.
7. Review after major events, deals or strategy changes, and at least annually.

Hypothetical example: appetite drives the deductible

Say a food manufacturer in Ohio with $120 million of annual revenue and $9 million of operating income builds its first ERM profile. Its board adopts a tolerance: no single retained insurable loss above 5% of operating income ($450,000), and no more than 10% ($900,000) of retained insurable losses in a year. The figures are the company's choice, not a benchmark.

The risk team then reviews the property program. A broker offers a $250,000 deductible and a $1 million deductible with a lower premium. The $1 million option breaks the single-loss tolerance, so it is off the table whatever the premium saving, unless the company raises its tolerance on purpose and the board agrees. The same logic applies to the workers' comp and auto programs. Retention choices become a rule instead of a negotiation, and the deductible and retention break-even calculator checks what a bad year looks like at each level.

The portfolio view finds more. One plant makes 70% of revenue, and a single ingredient comes from one supplier. The risk that matters is not a fire in the plant in isolation, it is a fire plus the weeks to restore supply. The responses: a second ingredient source (reduce), contingent business income coverage (transfer, see contingent business interruption insurance and supply chain risk), and a tested writing a business continuity plan: a step-by-step guide. The industry guide for Manufacturer insurance lists the usual exposures.

Boards, regulators and directors

For public companies, SEC Regulation S-K Item 407(h) (17 CFR 229.407(h)) requires disclosure of the extent of the board's role in risk oversight. Under Delaware law, directors owe oversight duties. In Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), the Delaware Supreme Court revived claims against the Blue Bell Creameries board after the 2015 listeria outbreak, holding the complaint supported an inference that the board had made no effort to put in place a reasonable board-level system to monitor food safety, a mission-critical risk. Whether a particular board has met its duty is a question for counsel. The practical lesson for any company is that an ERM program with documented board reporting is evidence of a system. It also bears on Directors and officers (D&O) insurance explained, because underwriters ask how the board oversees cyber, safety and compliance.

How ERM changes insurance buying

• Retentions come from capacity, not from the quote with the biggest discount.
• Limits come from scenarios. Instead of copying peers' limits, you test your worst realistic events, such as a plant loss or a product recall, against the program.
• Gaps appear that policies cannot fill. Reputation, regulatory change and key customer loss are real risks with limited insurance answers. Ranking them still guides where money goes.
• Alternatives become thinkable. A company with stable, data-rich losses may consider what is a captive insurance company and how does it work?; see Is a captive right for your business? A feasibility checklist.
• The cost picture sharpens. The Total cost of risk (TCOR) calculator and Total cost of risk (TCOR): what it includes and how to calculate it put premiums, retained losses and safety spending in one figure to track against the program's goals.

Why programs fail

• Heat maps with no decisions attached. A red box nobody owns changes nothing.
• Scoring risks independently when they are correlated. A hurricane, a cyber outage and a supplier failure can all arrive together.
• Treating the list as a once-a-year exercise before the board meeting.
• Leaving strategy out. If the risks are not tied to objectives, the executives will not use the output.
• Quantifying only what insurance covers, which makes insurable risk look like all of the risk.

Key takeaways

• ERM manages all risks that can affect objectives in one process. Insurance is one response among several.
• COSO's 2017 framework (five components, twenty principles) and ISO 31000:2018 are the two reference points. Both scale to the size of the organization.
• A written risk appetite and tolerance turn retention and limit decisions into rules the board has approved.
• The portfolio view matters more than the list: look for single events that hit several parts of the business at once.
• Boards are expected to oversee mission-critical risks with a real reporting system. Keep documentation of what is reported and decided.