What enterprise risk management is for
Enterprise risk management is the discipline of identifying what could prevent the organisation meeting its objectives, deciding how much of that exposure is acceptable, and reporting the position to the board. Built on COSO ERM 2017, it treats risk as an input to strategy rather than a register maintained alongside it.
The failure we see most often in practice
Most organisations have a risk register. Far fewer can point to a decision it changed. The register sits beside the strategy rather than informing it, gets refreshed annually because it must be, and reaches the board as a heat map nobody interrogates. The test of a working ERM framework is simple: name the last time a risk assessment altered a business decision.
