Enterprise Risk Management (ERM) cheat sheet

ERM definition: a process, effected by an entity's board, management, and personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity and manage risk within its risk appetite.

COSO ERM 2017 five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting. These are supported by 20 principles.

COSO ERM 2017 replaces the 2004 cube's eight components (internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, monitoring) and shifts emphasis from risk list to strategy integration.

Risk appetite is the amount of risk an entity is willing to accept in pursuit of value; risk tolerance is the acceptable variation in performance relative to a specific objective. Appetite is set at entity level; tolerances cascade to objectives.

Three-lines model: first line owns and manages risk in operations; second line provides independent oversight, frameworks, and challenge (risk, compliance); third line provides independent assurance to the board (internal audit).

ERM governance: board sets appetite and oversees; a board risk committee reviews top risks and tolerances; the CRO leads the ERM program; the CFO links risk to financial planning; business units own risks.

Risk culture is assessed through tone at the top, accountability, incentives, and transparency. Weak cultures reward excessive risk-taking, suppress bad news, and treat risk as a compliance exercise.

Strategy-risk alignment: risk appetite must be considered when setting strategy and objectives; strategy alternatives are evaluated against appetite, and risk is considered before accepting a strategy, not after.

Risk universe and taxonomy: risks are typically grouped into strategic, operational, financial, compliance/legal, and reputational categories. A complete inventory supports aggregation and reporting to the board.

Risk register content: risk ID, description, category, owner, cause, event, consequence, inherent likelihood and impact, controls, residual likelihood and impact, response type, target date, and status.

Inherent risk is assessed before controls; residual risk after controls. Control effectiveness ratings reduce likelihood or impact, and residual risk must be compared with tolerance to trigger action.

Risk response options: avoid (exit the activity), reduce (mitigate likelihood or impact), share (transfer via insurance, hedging, contracts, outsourcing), and accept (retain, with monitoring).

Expected loss formula: EL = PD x LGD x EAD, where PD is probability of default, LGD is loss given default as a fraction, and EAD is exposure at default.

Value at Risk (VaR) at confidence c: the loss threshold not expected to be exceeded with probability c over a defined horizon. VaR does not describe the size of losses beyond the threshold.

Expected shortfall (ES), also called conditional VaR, is the average loss in the tail beyond VaR; unlike VaR it is subadditive, meaning ES(A+B) <= ES(A) + ES(B).

Monte Carlo simulation: draw inputs from specified distributions, run many iterations, and build the output distribution. Output precision improves with the square root of the number of iterations.

Sensitivity analysis varies one input at a time; scenario analysis varies several inputs coherently; stress testing applies severe but plausible adverse conditions beyond historical experience.

Correlation and diversification: portfolio risk depends on correlations between exposures. Correlation assumptions often break down in stress, so models should test correlation breakdown and fat-tail behavior.

Model risk controls: documented methodology, independent validation, backtesting against actuals, benchmarking, sensitivity testing, and governance over model changes and use limitations.