Enterprise Risk Management: From Silo Registers to a Strategy-Linked Process
P3 examines enterprise risk management (ERM) as a board-led process that connects risk to strategy and performance, not as a compliance exercise run by one department. Questions typically ask you to evaluate the maturity of an organisation's ERM, judge whether it is genuinely embedded, or recommend practical improvements.
The ERM idea in CIMA terms
CIMA defines risk management as the process of analysing, evaluating and managing risk, and expects it to address both downside threats and upside opportunities. COSO's 2017 framework describes ERM as the culture, capabilities and practices a board uses, integrated with strategy setting and performance, to manage risk in creating, preserving and realising value. ISO 31000:2018 adds principles (integrated, structured, customised, inclusive, dynamic, continual improvement) and a cyclical process: scope, identification, analysis, evaluation, treatment, monitoring and communication.
Maturity, not paperwork
Hillson's risk maturity model is a useful diagnostic: naive (no process), novice (informal, reactive), normalised (formal but not embedded), natural (risk built into decisions) and nimble (risk used to seize opportunity). Evidence of embedding includes risk owners sitting in business units, appetite expressed as thresholds and delegated limits, registers used in investment and project approvals, key risk indicators reported beside KPIs, and incentives that do not reward unmeasured risk-taking. Silos are the classic weakness: each function scores risk on its own scale, so nothing aggregates into a portfolio view the board can act on.
Worked example
A £200m engineering group has eleven departmental risk registers, each scored 1-10, no group appetite statement, and a board pack with no risk page. A consultant proposes: a common 5x5 likelihood/impact matrix with defined impact bands (financial, safety, regulatory, reputational); a single group register filtered to the top 15 risks; an appetite statement with tolerances per band; a risk-adjusted hurdle rate for capital projects; a quarterly CRO report to a board risk committee; and risk workshops feeding the strategy away-day. Reasoning: the first three moves create comparability and governance; the hurdle rate links risk to return and changes actual decisions; the strategy link converts ERM from reporting into management. Maturity moves from normalised toward natural.
Traps that cost marks
- Confusing risk appetite (how much risk the board wants), tolerance (acceptable deviation) and capacity (maximum bearable) - define all three.
- Describing ERM as internal control or compliance; both are subsets, not the whole.
- Treating ERM as loss prevention only and ignoring opportunity risk.
- Recommending "a risk register" with no owner, scoring scale or reporting line.