A practical introduction to Enterprise Risk Management (ERM), covering risk identification, assessment, treatment, monitoring, and reporting. Learn how organisations manage risk and how GRC professionals apply these principles in real-world scenarios.
Every organisation faces uncertainty.
A supplier may experience an outage. A cyberattack may disrupt operations. A regulatory change may introduce new obligations. A strategic investment may fail to deliver its expected benefits.
Organisations cannot eliminate uncertainty, but they can establish structured processes to understand it, make informed decisions and respond appropriately.
This is where Enterprise Risk Management (ERM) comes in.
In this guide, we'll explore how ERM works, the responsibilities involved, and how GRC professionals can apply risk management principles in practice.
Enterprise Risk Management is an organisation-wide approach to identifying, evaluating, managing and monitoring risks that could affect the achievement of objectives.
Rather than assessing risks in isolation, ERM considers how risks interact across business functions, strategic priorities and operational activities.
For example, a cloud service outage might initially appear to be an IT problem.
However, the consequences could extend to customer service, financial performance, contractual commitments, regulatory obligations and reputation.
An enterprise risk management approach helps the organisation understand these wider consequences and make coordinated decisions.
ERM is not limited to cybersecurity. It can encompass strategic, financial, operational, legal, regulatory, technology and other risks.
Cybersecurity risk management is therefore one important component of the broader enterprise risk management programme.
A structured ERM programme helps organisations:
Consider two business units assessing the same type of disruption risk.
Without an agreed methodology, one department may classify the risk as high while another considers it low.
The difference might reflect genuine business context, but it could also result from inconsistent assessment criteria.
ERM provides a framework for making these judgements more consistent, transparent and comparable.
Risk is the effect of uncertainty on objectives, as described in ISO 31000.
In security risk assessments, risks are frequently expressed as potential adverse events and their consequences.
For example:
There is a risk that unauthorised access to the customer database could result in disclosure of personal information, leading to regulatory, financial and reputational consequences.
A useful risk statement connects a potential event or cause with its effect on organisational objectives.
A risk owner is the person or function accountable for managing a particular risk.
The GRC analyst may facilitate the assessment, but the relevant business owner normally remains accountable for decisions within their authority.
Inherent risk is commonly used to describe risk exposure before considering the effects of relevant controls.
It helps organisations understand the underlying exposure associated with an activity.
The precise definition and assessment approach should be documented in the organisation's methodology.
Residual risk is the risk remaining after risk treatment.
In practice, analysts consider the effectiveness of existing controls when evaluating the current level of exposure.
Residual risk is not necessarily acceptable simply because controls exist.
Risk appetite describes the amount and type of risk an organisation is willing to pursue or retain in support of its objectives.
For example, an organisation may have very low appetite for unauthorised disclosure of sensitive customer information.
Risk tolerance concerns acceptable variation or boundaries around risk exposure or performance.
Organisations may express tolerance through thresholds, limits or other measurable criteria.
Risk appetite and tolerance are related, but their exact operational definitions should be established within the organisation's governance framework.
Risk treatment involves selecting and implementing measures to modify risk.
Common responses include avoiding an activity, reducing exposure, sharing or transferring aspects of risk, or retaining risk through an authorised decision.
Although methodologies vary, an ERM process generally includes the following activities.
Before assessing risks, understand the organisation.
Relevant questions include:
Practitioner output: Defined assessment scope, context, risk criteria and responsibilities.
Without this foundation, risk assessments can become inconsistent or disconnected from business priorities.
Risk identification involves determining what could affect the organisation's objectives.
Information may come from stakeholder interviews, incident records, audits, threat intelligence, business process reviews, supplier assessments and other sources.
For example, a payment processing company may identify risks associated with service disruption, fraudulent transactions, data compromise and supplier failure.
The objective is to identify meaningful risk scenarios rather than simply compile a list of vulnerabilities.
Practitioner output: Documented risk scenarios, causes, potential consequences and relevant context.
Risk analysis considers the nature and level of identified risks.
Depending on the methodology, this may involve evaluating likelihood, consequences, exposure, uncertainty and existing controls.
Some organisations use qualitative categories such as Low, Medium, High and Critical.
Others use quantitative techniques, scenario analysis or combinations of methods.
A common illustrative scoring method is:
Risk score = Likelihood × Impact
For example, on a five-point scale:
Likelihood = 4
Impact = 5
Calculated score = 20
However, this is an illustrative ordinal scoring convention, not a universal or mathematically precise measure of risk.
A score of 20 does not establish that the risk is twice as severe as a score of 10.
The meaning of each rating, the thresholds and the treatment of uncertainty must be defined in the assessment methodology.
Practitioner output: Documented risk analysis, assumptions, evidence and assessment results.
Risk evaluation compares assessment results with the organisation's established risk criteria.
The objective is to determine whether further action is required.
For example, a residual risk classified as High may exceed the approved appetite for the relevant category.
This may require escalation, additional treatment or a formal management decision.
Practitioner output: Risk evaluation, priority, appetite status and decision requirements.
Where treatment is required, the organisation determines an appropriate response.
Suppose a company identifies a significant risk of unauthorised privileged access.
Possible treatment measures could include stronger authentication, privileged access management, periodic access reviews and improved monitoring.
A treatment plan should identify:
Practitioner output: Approved risk treatment plan and assigned actions.
Risks change over time.
New threats emerge, controls deteriorate, business activities change and treatment actions may be delayed.
Organisations should therefore review significant risks periodically and when material changes occur.
Monitoring may include key risk indicators, control testing, incident trends, overdue actions and changes in external conditions.
Practitioner output: Updated risk records, monitoring results and revised assessments where appropriate.
Communication and consultation occur throughout the risk management process, rather than only at the end.
Different stakeholders need different levels of information.
Technical teams may need detailed findings and remediation requirements.
Business owners may need information about operational consequences and treatment decisions.
Senior management may need an aggregated view of significant exposures, appetite breaches and emerging trends.
Practitioner output: Risk reports, dashboards, escalation records and documented decisions.
Consider Meridian Financial Services Ltd, a fictional UK financial technology company.
Meridian relies on a cloud-hosted platform to process customer transactions.
A prolonged service disruption could prevent customers from accessing payment services.
Risk statement:
There is a risk that an extended outage affecting the primary cloud environment could interrupt payment processing, resulting in financial losses, customer disruption and potential contractual consequences.
For this exercise, Meridian uses a fictional five-point likelihood and impact scale.
The analyst assigns:
| Assessment factor | Illustrative rating |
|---|---|
| Likelihood | 4 — Likely |
| Impact | 5 — Severe |
| Inherent score | 20 — Critical |
These ratings are assumptions for the exercise, not estimates derived from real operational evidence.
Meridian has implemented:
During the assessment, the analyst discovers that the disaster recovery plan has not been tested against the current production architecture.
This creates uncertainty about whether the organisation can restore services within its recovery objectives.
After evaluating the available controls and their limitations, the analyst assigns a provisional residual risk rating of High.
This is a professional judgement within the fictional methodology, not a result that can be calculated reliably by subtracting a control score from inherent risk.
The analyst recommends:
The appropriate risk owner reviews the recommendations and determines the next actions under Meridian's governance process.
This example shows why risk management involves more than completing a scoring matrix.
The analyst must understand the business, evaluate evidence, recognise uncertainty and communicate decisions.
A risk register is an important record, but it does not replace governance, ownership, treatment, monitoring or decision-making.
Ratings become difficult to defend when different assessors interpret likelihood and impact inconsistently.
A documented control may be poorly designed, incompletely implemented or inconsistently operated.
Identifying a risk does not mean the organisation has formally accepted it.
Risk acceptance requires an appropriate decision by an authorised person or body.
Technical findings are more meaningful when their potential effects on operations, customers, finances and obligations are understood.
A previously acceptable risk may become unacceptable when the business environment or effectiveness of controls changes.
Several recognised frameworks and standards can inform an organisation's approach.
ISO 31000: Provides principles, a framework and a process for managing risk across organisational contexts.
COSO Enterprise Risk Management: Emphasises the integration of risk with strategy, performance and governance.
ISO/IEC 27005: Provides guidance for managing information security risks.
NIST Risk Management Framework: Provides a structured approach to managing security and privacy risk associated with information systems and organisations, particularly in contexts where the framework is applicable.
These references serve different purposes. Organisations should select and adapt approaches based on their objectives, obligations and operating environment.
If you're new to GRC, a useful starting exercise is to assess a fictional business risk from beginning to end.
You should be able to:
GRC Workshop provides a free ERM Toolkit to support the documentation and organisation of these activities.
The toolkit should be used alongside a clearly defined risk methodology, not as a substitute for professional judgement.
Enterprise Risk Management is not primarily about scoring risks or maintaining spreadsheets.
It is about helping an organisation understand uncertainty, establish accountability, make informed decisions and monitor whether risks remain appropriately managed.
For a GRC professional, effective ERM requires analytical thinking, business understanding, evidence evaluation, clear documentation and stakeholder communication.
Your next step: Explore the GRC Workshop ERM Toolkit and begin applying these principles to a fictional organisational risk assessment.