Framework library · Risk management and assessment
Enterprise risk management (ERM)
Enterprise risk management treats risk as a set of choices the board makes for the whole organisation, not a list kept by each team. For each category of risk it states an appetite, a measure with a limit and an owner, then compares that with where the business actually stands. The useful output is the gap: where the company carries more risk than it chose, and where it takes less than it could afford.
Use it when
- The board needs to agree how much risk it will take in each part of the business, for example before a spectrum auction or a large build programme.
- Risk registers exist in every team, but nobody can say whether the company as a whole carries more risk than it intended.
- A lender, rating agency or regulator asks how risk appetite is set and monitored.
- Strategy is changing, such as a move into enterprise services or a new network technology, and the old limits no longer fit.
Avoid it when
- You need to manage the risks to one project. A risk register does that; ERM sets the limits the register works within.
- You want to define what a likelihood of 4 or an impact of 3 means. That is the job of the risk matrix, which ERM relies on but does not replace.
- You need to show the board how each top risk moves once controls are applied. Use a risk heat map with inherent and residual positions.
- The board will not discuss appetite. Without its view the statements are the risk team's guesses. Start with a short board session on three or four categories instead of a full framework.
How to run it
Choose a small set of risk categories
Six to ten categories that match how the business is run and reported: market, balance sheet, network resilience, cyber and data, regulation, safety, new ventures. Every team's risks should map to one of them.
Set an appetite for each category
Use a five-step scale from averse to eager and write one sentence in the board's words. Appetite differs by category: a group can be eager on new ventures and averse on safety at the same time.
Turn each appetite into a measure with a limit
A tolerance the business can report, such as net debt no higher than 3.0 times EBITDA, or no outage over two hours for more than 100,000 customers. An appetite with no measure cannot be monitored.
Rate where the business stands today
Rate current exposure on the same scale, using the measure and the risk registers beneath it. The gap between exposure and appetite is the finding.
Name one executive owner per category
The person who reports the measure to the board and has the authority to bring exposure back inside appetite.
Act on gaps in both directions
Exposure above appetite needs an action and a date. Exposure well below appetite where the board is open or eager means opportunity left unused, which also needs a decision.
Review quarterly and after big decisions
Re-rate after an acquisition, an auction, a major outage or a change of strategy, not only on the calendar.
Work through it
Answer the questions below, or load the worked example to see a finished one. The drawing updates as you type. Export the result as a PowerPoint deck, a Word document, an Excel workbook, a PDF or plain text.
What you type stays in this browser, so you can close the page and come back to it. It is not sent to Blue Prysm or anyone else, and the exports are made here, on your device. Privacy policy.
Mistakes to avoid
- Writing appetite statements so general ("we have a low appetite for risk") that no decision could ever breach them. Each statement needs a measure and a limit.
- Setting the same appetite for every category. If everything is cautious, the statements help nobody choose.
- Looking only for exposure above appetite. Categories where the business takes far less risk than the board allows are often where growth is being missed.
- Building the enterprise view by adding up project registers. Aggregation counts risks but does not show concentrations, such as one supplier behind several categories.
- Leaving appetite and exposure unchanged after a major decision. A spectrum purchase or an acquisition can move the balance sheet from cautious to stretched overnight.
Where it comes from
Set out by COSO (the Committee of Sponsoring Organizations of the Treadway Commission) in Enterprise Risk Management: Integrated Framework (2004), revised as Enterprise Risk Management: Integrating with Strategy and Performance (June 2017), which has five components and 20 principles. ISO 31000:2018, Risk management: Guidelines (second edition, February 2018, replacing the 2009 edition), gives the principles, framework and process as an international standard. Source.
Use it with
Further reading
Work through it with us
The frameworks here are free to use as they stand. If you would rather work through the question behind this one with us, these are the ways an engagement starts.