Enterprise Risk Management (ERM)

ERM exists because risks do not respect departmental borders — a cyber incident becomes a legal, financial and reputational problem within hours. One framework, one appetite and one reporting line let the board see the whole exposure of the enterprise rather than a stack of disconnected local views. The decision that depends on it is prioritisation: which risks receive capital, management attention and continuity investment first. Fragmented risk work makes that comparison impossible.

ERM is typically owned by a chief risk officer (CRO) or an equivalent senior executive, with a board risk committee reviewing the consolidated picture quarterly. The framework lives in an ERM policy, a common risk taxonomy and a single enterprise risk register that rolls local registers up to a comparable scale. A practical sign of working ERM: a supplier failure scored by procurement and a data-centre outage scored by IT can be compared on the same 1-to-5 impact scale and compete for the same mitigation budget. In the Gulf, regulators such as SAMA and CBUAE increasingly expect this integrated view in supervised sectors.

The common error is ERM as an aggregation exercise — collecting spreadsheets from departments and calling the pile "enterprise risk", while the top exposures on the CEO's own agenda never enter the framework. Another is stopping at reporting without connecting risks to continuity and recovery capability. The move from classic ERM to genuine resilience is the subject of module M2 "From enterprise risk management to business resilience" in the ERGP programme.