Enterprise risk management
Definition
Enterprise risk management
Enterprise risk management is the single company wide process for finding, rating, owning and monitoring the things that could stop the business hitting its plan. It replaces a set of separate departmental risk lists with one register the board can read.
The word enterprise is doing real work here. Credit risk, cyber risk, supplier risk and conduct risk are rated on the same scale, so the board can compare them and choose where to spend attention rather than fund whichever team shouts loudest.
Keep the line clear with enterprise performance management. That cycle tracks whether you are hitting the numbers. This one tracks what could stop you hitting them. Performance looks at the upside of the plan; risk looks at its exposure.
Key takeaways
- One register, one scoring scale, one named owner per risk is the whole idea.
- Each risk needs an owner with budget, not just a department label.
- Compliance obligations are inputs to the register, not a substitute for it.
- Review the register quarterly at minimum, because an untouched register is a document rather than a control.
How it works
Enterprise risk management runs a repeating loop: identify exposures, score them by likelihood and impact, assign an owner, agree a treatment, then monitor. The register is reviewed by a risk committee and reported upward on a fixed schedule.
| Stage | What happens | Usual owner |
|---|---|---|
| Identify | Workshops, incidents and audit findings feed the register | Risk function |
| Assess | Score likelihood and impact on one shared scale | Risk owner |
| Treat | Accept, reduce, transfer or avoid | Business owner |
| Monitor | Track indicators and control tests | Second line |
| Report | Quarterly pack to the committee and board | Chief risk officer |
Risk appetite comes first, though many registers skip it. Until the board says how much of a given exposure it is willing to carry, a score of twelve out of twenty five means nothing and every risk looks equally urgent.
The reference method is well established. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) rewrote its integrated framework because boards and executives were asking for improved risk reporting as the nature of risk changed.
Indicators do the early warning. A key risk indicator is a number that moves before the risk does — supplier late deliveries creeping up, or failed logins climbing — and it is what turns a quarterly register into something closer to live.
Technology risk has its own published method. The National Institute of Standards and Technology Risk Management Framework links system level risk processes to organisational risk processes and assigns accountability for the controls each system inherits.
Day to day, someone has to run it. A compliance officer usually owns the regulatory slice of the register and the evidence behind it, reporting into the same committee as operational and financial risk.
The register is not the programme. Compliance program design decides the policies, training and testing that reduce a rated risk, which is the treatment step rather than the assessment step.
Outsourcing changes who holds the exposure but rarely how much there is. A provider can run the control; the accountability for the outcome stays with you, and the contract should say so in plain terms.
Reporting closes the loop. The committee pack should show what changed since last quarter, which treatments landed and which risks moved, rather than reprinting a heat map that has looked identical for a year.
Examples
Risks cluster by sector, and the register shows it. Healthcare registers fill with patient data exposure, payment businesses with card data, and contact centres with consent and recording rules.
The top five rarely surprise anybody inside the business — the value of the register is that it forces a public ranking, so attention and budget follow the ranking rather than the loudest department.
Healthcare and health services. Patient data handling dominates. HIPAA compliance obligations appear as rated risks with named owners, control tests and breach response plans rather than as a policy filed once a year.
Payments and retail. Card data is the headline exposure. PCI compliance scope decisions sit on the register because narrowing which systems touch card data is itself the most effective treatment available.
Contact centres and outbound sales. Dialling rules carry direct financial penalties. TCPA compliance risks are scored on likelihood of a breach and the size of statutory damages, which concentrates minds on consent records.
Multi supplier operations. A firm with several outsourced functions registers concentration risk, meaning what happens when one provider holds three processes, alongside the usual quality and continuity entries.
Manufacturing and logistics. Physical risk dominates: a single sourced component, a port closure, a safety incident. These registers tend to be the most honest, because the failures are visible and nobody can argue the exposure away.
Related terms
- Compliance officer: owns the regulatory slice of the register and its evidence.
- Compliance program design: builds the controls that treat a rated risk.
- HIPAA Compliance: a specific obligation that feeds the register in health settings.
- Service credits in outsourcing: the contractual remedy when a supplier risk turns into a failure.
- Contract administrator: keeps the obligations that sit behind supplier risks current.
FAQ
How is enterprise risk management different from compliance?
Compliance answers whether you meet a specific rule. Enterprise risk management asks what could stop the business delivering its plan, which includes rules but also demand, suppliers, technology and people. Compliance feeds the register; it does not replace it.
Who owns the register?
A chief risk officer or equivalent runs the process, but each individual risk needs an owner in the business with budget and authority. Ownership that stops at a department name is not ownership, and the quarterly pack will show it.
How often should risks be reviewed?
Quarterly is the common minimum, with monthly review for the top handful and immediate review after any incident. Registers reviewed annually are usually describing last year’s company — and last year’s suppliers.
Does outsourcing transfer risk?
It transfers activity and some financial remedy, not accountability. Regulators and customers still come to you, so supplier risks stay on your register with your own named owner. Due diligence at selection is cheaper than remediation at renewal.
Where should a first register come from?
Start with incidents, audit findings and the obligations you already know about, then run one workshop per function. Ten well owned risks beat a hundred unowned ones.
Shortlist providers with documented controls in the Outsource Accelerator directory of vetted outsourcing partners.
Independent
