Enterprise Risk Management Frameworks
Purpose and structure
An ERM framework integrates risk management with strategy, governance, and performance across the enterprise. Candidates should recognise the components common to major frameworks without reproducing any proprietary text: governance and culture, strategy and objective setting, performance, review and revision, and information and communication. The framework is a cycle, not a checklist, and its value lies in linking risk to decision-making and capital allocation.
Maturity and integration
Maturity models move from ad hoc and siloed risk management to repeatable, integrated, and optimised states. Signs of low maturity include risk registers maintained only for compliance, no linkage to strategy, and inconsistent taxonomies. High maturity shows aggregated risk reporting, scenario use in planning, and risk-adjusted performance metrics.
Traps to watch
- A framework does not guarantee effective risk management; culture and execution matter more than documents.
- ERM is not the sole responsibility of the risk function; it is enterprise-wide with board oversight.
- Frameworks are adaptable, not prescriptive; blindly copying a template without tailoring is a weakness.
- Aggregation can hide concentration; enterprise-level views must preserve granularity where needed.
Worked rule of thumb
When a question describes an organisation with a complete policy suite but no board discussion of risk appetite and no linkage of risk to strategy, the correct diagnosis is low maturity despite documentation. Framework presence is not framework effectiveness; look for evidence of use in decisions.