Enterprise Risk Management is a critical topic in FRM Part 1 (Foundations of Risk Management) and increasingly important in modern financial institutions.

What Is ERM?

Enterprise Risk Management is a comprehensive, integrated approach to managing all risks across an organization. Unlike siloed risk management, ERM looks at risks holistically, considering interactions and concentrations across the enterprise.

COSO ERM Framework

The most widely referenced ERM framework (updated 2017):

Five Components

  1. Governance and Culture: Board oversight, risk culture, ethical values
  2. Strategy and Objective-Setting: Aligning risk appetite with strategy
  3. Performance: Identifying events, assessing severity, prioritizing risks
  4. Review and Revision: Monitoring changes and reviewing performance
  5. Information, Communication and Reporting: Leveraging information across the organization

Key ERM Concepts

Risk Appetite vs Risk Capacity vs Risk Tolerance

  • Risk Capacity: Maximum risk the firm can absorb before failure
  • Risk Appetite: The amount of risk the board is willing to accept
  • Risk Tolerance: Acceptable variation from risk appetite targets

Risk Aggregation

Combining risks across the enterprise to understand total exposure, considering:

  • Correlations between risk types
  • Concentration risk
  • Diversification benefits
  • Interdependencies

Risk Culture

The shared values, beliefs, knowledge, attitudes, and understanding about risk:

  • Tone from the top
  • Accountability
  • Open communication
  • Challenge and escalation

Benefits of ERM

  1. Better decision-making: Risk-informed strategic choices
  2. Reduced surprises: Early identification of emerging risks
  3. Improved capital allocation: Risk-adjusted resource allocation
  4. Regulatory compliance: Meeting evolving regulatory expectations
  5. Value creation: Risk management as a competitive advantage

Three Lines of Defense

  1. First Line — Business Units: Own and manage risks day-to-day
  2. Second Line — Risk Management Function: Independent oversight and challenge
  3. Third Line — Internal Audit: Independent assurance

Chief Risk Officer (CRO) Role

  • Reports to board/risk committee
  • Independent from business lines
  • Oversees all risk functions
  • Develops risk frameworks and policies
  • Challenges business risk-taking

Implementation Challenges

  • Siloed organizational structures
  • Data integration difficulties
  • Quantifying non-financial risks
  • Maintaining risk culture
  • Balancing risk management with business growth

Strengthen your ERM knowledge for the FRM exam with our practice questions!