Principles of Risk Management: Exposure Identification and ERM
Getting the vocabulary right
Risk management is the process of identifying, analyzing, controlling, and financing exposures. A peril is the cause of a loss (fire, theft, a liability claim); a hazard is a condition that increases the chance or size of loss (physical, moral, morale, legal); an exposure is anything of value that is at risk. Distinguish pure risk (loss or no loss) from speculative risk (gain or loss), static from dynamic, and fundamental from particular risk.
Enterprise risk management (ERM) treats hazard, financial, operational, and strategic risk together and links them to the organization's objectives rather than managing each in a silo. ERM depends on a stated risk appetite, board oversight, and a common language for risk.
Identification tools
Checklists and questionnaires, flowcharts of operations, physical inspections, contract and lease review, financial statement analysis, loss histories, and structured interviews. Every tool has blind spots: checklists miss novel exposures; flowcharts can miss off-balance-sheet obligations; loss histories miss exposures that have never produced a claim.
Traps
Risk is not the same as uncertainty (uncertainty can be favorable); a hazard is not a peril; insurance is financing, not identification; ERM is not simply buying more insurance. Keep risk appetite (willingness to accept), risk tolerance (acceptable variation), and risk capacity (ability to bear) distinct.
Rule of thumb: walk the value chain - every asset, activity, and obligation creates a possible claim.
Worked example: a bakery chain flowcharts flour delivery, storage, baking, and distribution. The chart exposes a product-recall exposure (contaminated flour), a business-interruption exposure (oven failure), and a contractual indemnity in its distribution agreement - three exposures a fire-only checklist would never reveal.