Enterprise Risk Management: Frameworks, Governance, and Risk Appetite
What ERM actually is
Enterprise risk management is the discipline of identifying, assessing, and responding to risk across the whole organization rather than in isolated silos. Candidates must be fluent in the vocabulary that frameworks share: risk appetite (how much risk the board is willing to accept in pursuit of strategy), risk tolerance (quantified deviation from appetite that a unit may take), risk capacity (the maximum loss the entity can absorb before solvency or mission fails), and risk universe (the full catalogue of exposures). Know the difference between inherent risk (before controls) and residual risk (after controls), and between controls and treatment.
Governance and the three lines
A credible ERM program has board oversight, a risk committee, a CRO with authority independent of revenue functions, and a documented escalation path. The three-lines model is heavily tested: the first line owns and manages risk in the business; the second line provides oversight, frameworks, and challenge (risk, compliance); the third line provides independent assurance (internal audit). Trap: questions that place internal audit in the second line, or that let the first line "self-certify" without challenge.
Appetite statements and linkage to strategy
An appetite statement is only useful if it is specific and measurable: qualitative prohibitions plus quantitative limits (e.g., earnings volatility, capital at risk, concentration caps). ERM must connect appetite to strategy, capital allocation, and incentives. A common trap is treating ERM as a compliance exercise producing registers with no decision rights attached.
Worked rule of thumb
When unsure whether something is ERM or operational risk management, ask: does the decision require an enterprise-level trade-off across units or against strategy? If yes, it is ERM. If it can be resolved entirely inside one process owner's remit, it is operational risk management feeding into ERM.
Traps to watch
Confusing risk appetite with risk capacity; assuming more controls always mean less residual risk (control failure and control risk exist); and ignoring risk aggregation - individually acceptable exposures that become unacceptable in combination.