Enterprise Risk Management · ERM
Enterprise Risk Management
What is enterprise risk management?
- Agreeing on how much risk to accept, not eliminating risk
- The identify–assess–respond–monitor cycle
- A framework that isn’t cited in decisions is a dead framework
The first thing that changes when ERM is introduced is the feel of the meetings. Before, the head of purchasing judged supplier risk and the head of information security judged data-leak risk, each within what they felt able to bear, and issues reached the executive table only after an incident. ERM has senior management first set a number for 'how much loss our company can absorb in a year,' and has the business units operate within that limit. In substance, ownership of risk-judgment standards shifts from department heads to senior management, so what you actually end up arguing about during rollout is not the forms but authority: how far business units can decide on their own.
The point that trips people up most often in practice is the distinction between risk appetite and risk tolerance. Appetite is a directional statement, such as 'we accept the currency and political risks that come with entering emerging markets.' Tolerance is the number that draws the line, such as 'no single customer above 20% of revenue' or 'annual risk losses within 3% of operating profit.' An ERM program with direction but no numbers has no force in approval meetings. Assessment works the same way: if impact is only 'high/medium/low,' each department’s standard differs, so it is better to first build a common yardstick, such as monetary amount or days of line stoppage.
Roles also need to be redrawn. In the commonly used three-lines model, the first line, the business units, actually bears the risk; the second line, the risk and compliance functions, sets the standards and monitoring framework; and the third line, internal audit, verifies that the framework works. If compliance covers one category, legal violations, and BCP covers recovery after an incident, then ERM is the layer above them that decides where to spend resources first. If you lump all three together and hand them to the risk department, the business units just fill in the questionnaire and step away, and the risk register gets maintained while the risks themselves remain.
The most common failure in practice is a reflex to avoid any risk that gets a high rating. Once a new-business proposal gets a single 'High risk' label and items start getting shelved, nobody writes down risks honestly from the next meeting on, and the assessment sheet fills up with 'Medium.' Another common misconception is that a risk is dealt with once it has been handed off to insurance and contract indemnity clauses, but reputational damage and regulatory sanctions are risks that cannot be transferred. The test of whether it works is simple. Check whether last year’s risk ratings are actually cited in budget allocation and new investment approval meetings.
John KimInstructor John Kim, author of “B2B Marketing Design” and CEO of Nanum Consulting
Jinho DanAccounting instructor who makes financial statements, costing, and tax easy to understandIt took shape after major accounting frauds and financial incidents from the 1990s onward highlighted the need for enterprise-wide risk management. It became the standard when COSO published its Enterprise Risk Management Integrated Framework in 2004.
Consider a hypothetical case. Company A, a Korean auto parts manufacturer (740 employees, KRW 230 billion (≈ US$172,078,400) in annual revenue), saw its line stop for 12 days last year after a fire at a Tier 1 supplier, and received 7 findings in a customer quality and safety audit the same year. Each department ran its own safety, information security, and ethics training, but there was no basis for deciding which risk was more urgent. At the CEO’s direction, the company began a six-month ERM build-out.
- At the kickoff meeting, the CFO asked, 'Can anyone tell me how much money we lost to last year’s 12-day line stoppage?' Nobody could answer, so the corporate planning team spent two weeks estimating and produced the first number: KRW 3.4 billion (≈ US$2,543,800) in losses.
- Workshops in six divisions surfaced 68 risks. When the head of production asked, 'Are you trying to cut our evaluation scores?', the CEO committed that the results would not be used in performance reviews, and after removing duplicates the list was narrowed to 41.
- They converted impact into amounts relative to operating profit and days of line stoppage, scored each risk on a 5×5 scale, and shortlisted the top 8; the No. 1 risk turned out to be a structure in which 62% of key components depended on three Tier 1 suppliers.
- The executive in charge of purchasing took on dual-sourcing for two items within six months. Safety items that can’t be passed to insurance were classified as "reduce," and a new 8-hour-per-year practical risk assessment training was set up for 62 site managers.
- Nine key risk indicators were put on a monthly dashboard, and a rule was written into the management meeting regulations: if three or more turn red, new investment proposals are put on hold.
- A year later, line stoppages caused by supplier incidents fell from 12 days to 3, customer audit findings dropped from 7 to 2, and a risk rating sheet began to be attached to all 23 investment review proposals.