Reading Time: 7 minutes
Enterprise risk management (ERM) is an organization-wide approach to finding, ranking, and responding to risks. Instead of finance, information technology, and legal each tracking their own risks, ERM brings them into one view that leadership and the board can act on.
For boards, ERM is where oversight gets tested. Management runs the program, but directors are accountable for asking whether the right risks are on the list, whether each response fits the organization’s unique risk appetite, and whether anyone followed up. Most of that work happens in the boardroom: in the risk report directors read before the meeting, the questions they ask, and the decisions recorded in the board meeting minutes.
That’s where board management software fits. It isn’t a risk management system. Instead, it’s a secure place where corporate and nonprofit boards receive risk reporting, discuss it, and keep the record of what they decided.
Key Takeaways
- Definition: Enterprise risk management (ERM) is an organization-wide approach to identifying, assessing, and responding to the risks that could affect strategic goals, rather than managing risk one department at a time.
- Five-Step Process: The ERM process has five steps: risk identification, risk assessment, risk response, risk monitoring, and communication and reporting.
- Four Risk Responses: Organizations respond to each risk by avoiding it, reducing it, transferring it, or accepting it within their risk appetite.
- Common Frameworks: The two most widely used ERM frameworks are COSO’s 2017 Enterprise Risk Management framework and the ISO 31000 risk management guideline.
- Board Role: Management designs and runs the ERM program, while the board, often through a risk or audit committee, sets the risk appetite and oversees how well management handles risk.
What is Enterprise Risk Management?
Enterprise risk management is a structured approach to identifying and analyzing risks, leading to more informed and effective decision-making. It is a holistic framework that considers all types of risks, including strategic, operational, financial, compliance, and reputational. Management designs and runs the ERM program. The board oversees it, usually through a risk committee or audit committee.
ERM also treats risk as more than a threat to avoid. The same review that flags a danger can show where the organization can afford to take a calculated risk.
Types of Enterprise Risk
Most ERM programs sort risks into a handful of categories:
- Strategic Risk: Threats to an organization’s director, such as a new competitor, a shift in demand, or an acquisition that underdelivers. A strategic risk assessment tests the plan against these threats.
- Operational Risk: Breakdowns in day-to-day processes, people, or systems, from a supplier failure to the loss of a key employee.
- Financial Risk: Exposure to changes in markets, credit, liquidity, and interests rates.
- Compliance Risk: Fines, lawsuits, or lost licenses from breaking laws, regulations, or contract terms, an area where the board’s role in compliance is well-defined.
- Reputational Risk: Damage to trust with customers, donors, regulators, or the public, which often follows one of the other risk types.
- Cybersecurity Risk: Data breaches, ransomware, and system outages, which many boards new review on a set schedule as part of board cybersecurity risk management.
- ESG Risk: Environmental, social, and governance issues that affect value or stakeholder trust, such as climate exposure or labor practices.
Give the Risk Committee Its Own Governed SpaceRisk committee materials, votes, and minutes sit inside the board's record, with permissions that control who sees each risk report and who signs off on the response.
See Committee ManagementERM vs. Traditional Risk Management
Traditional risk management handles risk one department at a time. Finance watches credit risk, IT watches cyber risk, and legal watches compliance, often without comparing notes. ERM pulls those views together so leadership and the board can see how risks connect and which ones matter most.
| Area | Traditional Risk Management | Enterprise Risk Management |
|---|---|---|
| Scope | Risk handled department by department | All risks viewed together across the organization |
| Ownership | Each function manages its own risks | Management runs one program; the board oversees it |
| View of Risk | Mainly threats to avoid or insure | Threats and opportunities weighed against strategy |
| Link to Strategy | Separate from strategic planning | Built into strategic planning and objective setting |
| Board Reporting | Occasional updates by function | A regular, consolidated risk report to the board |
Components of Enterprise Risk Management
Enterprise risk management requires a structured and comprehensive approach. The key components of ERM typically include:
Risk Indentification
Risk identification involves systematically pinpointing potential hazards that could impact organizational objectives. This includes gathering data from various sources, such as records, expert opinions, and stakeholder inputs.
Workshops with department leaders, incident reports, and audit findings all feed the list. The result is usually a risk register: a living document that names each risk, its owner, and how it’s being handled.
Risk Assessment
Risk assessment is the process of measuring the impact and likelihood of the risks you identify. This component prioritizes risks based on their severity and probability, helping organizations focus on the most critical threats. A risk assessment matrix is the most common tool, plotting each risk by likelihood and impact.
Management can then direct resources to the top risks, and the board can check that those priorities match its risk appetite and risk tolerance.
Risk Response
A risk response is a strategy or action taken to address identified to an organization. The goal is to manage risks in a way that aligns with the organization’s risk appetite and objectives. There are four standard responses:
- Avoid: Stop the activity that creates the risk, such as exiting as market or dropping a new product line.
- Reduce: Add controls that lower the likelihood or impact, such as a backup supplier or multi-factor authentication.
- Transfer: Shift the financial impact to another party through insurance or contract terms.
- Accept: Take on the risk knowingly because it falls within the organization’s risk appetite.
Risk Monitoring
Enterprise risk management requires continuous oversight and evaluation. Monitoring typically includes regular reviews of key risk indicators, such as system downtime, customer complaints, or liquidity ratios. This process also entails tracking the effectiveness of recent responses, analyzing data to detect any changes in risk levels, and making sure risk management practices align with regulatory requirements.
Communication and Reporting
Communication and reporting summarize risk information, key findings, and suggested actions into concise plans.
For the board, that usually means a risk report in every board book showing the top risks, what changed since the last meeting, and any risk that has moved outside the agreed appetite. Many boards receive that report through a board portal, so directors can review it before the meeting and the discussion is recorded.
Enterprise Risk Management Frameworks
Most organizations build their program on one or two frameworks, or a mix of both:
COSO ERM
The Committee of Sponsoring Organizations of the Treadway Commission published Enterprise Risk Management: Integrating with Strategy and Performance in 2017. It groups into give components: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication, and reporting. It’s common among U.S. public companies because it ties risk directly to strategy.
ISO 31000
The International Organization’s for Standardization’s risk management guideline, last revised in 2018, sets out principles, a framework, and a process that any organization can adapt. It’s guidance, so organization’s can’t be certified against it.
Benefits of Enterprise Risk Management
Because ERM Looks for risks on a schedule instead of waiting for one to surface, organizations are better prepared for unexpected events. Other benefits include:
- Better Decision-Making: Leaders weigh the risk of a decision alongside its upside, using the same data the board sees.
- Smarter Resource Allocation: Budget and staff go to the risks most likely to cause harm, not the ones raised most loudly.
- Stronger Regulatory Compliance: A documented process makes it easier to show regulators and auditors how risks are found and handled.
- Greater Stakeholder Confidence: Investors, lenders, donors, and insurers place more trust in organizations that can explain how they manage risk.
- Fewer Surprises: Regular monitoring catches rising risks early, while there’s still time to respond.
Enterprise Risk Management Example
Picture a regional health system with four hospitals and a network of outpatient clinics. During its annual risk review, the chief risk officer meets with department leaders, works through incident reports, and updates the risk register. IT raises ransomeware as a growing threat. Two peer hospitals in the region were hit in the past year, and the system still runs several older clinical applications that are hard to patch.
When the team plots the threat on its risk assessment matrix, ransomware scores high on both likelihood and impact. An attack could take electronic health records offline, force ambulances to divert to other hospitals, and expose protected health information. That would bring regulatory reporting, legal costs, and damage to patient trust that lasts well beyond the recovery.
Ransomware moves to the top of the register, ahead of staffing shortages and reimbursement changes.
A hospital can’t stop using digital records, so avoiding the risk isn’t an option. Management decides to reduce it and transfer part of it instead. To reduce it, the system adds multi-factor authentication for every user and offline backups that are tested each quarter. It also walls off the older applications from the rest of the network and writes a downtime plan so clinicians can keep treating patients if systems go dark. To transfer part of the risk, it buys a larger cybersecurity policy. What remains, management accepts as within the system’s risk appetite.
From there, the risk team tracks a few key risk indicators, such as how many critical patches are overdue and how long a full restore from backup takes. The results go into a cyber risk report to the committee’s board book before every quarterly meeting. Directors review it ahead of time, question management on anything off track, and vote on decisions like the higher insurance spend. Those decisions and follow-up requests are recorded in the minutes, so the board’s oversight carries from one meeting to the next while management keeps running the program day to day.
How a Board Portal Supports Risk Oversight
By integrating risk management into all aspects of operations, ERM helps organizations reduce threats, act on opportunities, and make better-informed decisions.
A board portal isn’t ERM software. Management keeps the risk register, scores risk, and tracks KRIs in its own risk or GRC tools. The board’s job is oversight, and that work happens in the boardroom: reviewing the risk report, questioning management, approving risk appetite and policies, and recording what was decided.
A board portal is built for that side of ERM.
OnBoard features that support the board’s side of risk oversight include:
- Risk Reports in the Board Book: Agenda Builder puts management’s risk report and committee updates in front of directors before the meeting, and Assist AI lets them ask questions of the board book in a closed, governed environment.
- Decisions on the Record: Voting and Approvals capture board decisions, such as approving a risk appetite statement or policy, in an auditable record, and exportable activity logs show who accessed what and when.
- Follow-Through Between Meetings: Task Management tracks the action items the board assigns, such as a follow-up report from management on a risk that moved outside appetite.
- Secure Board Communication: Secure Messenger keeps senstitive risk discussions off personal email, backed by SSO, MFA, dynamic watermarking, remote wipe, and other board portal security controls.
- Board Self-Assessment: Board Assessments include templates covering risk management, so directors can rate how well they oversee it.
Minutes are part of the risk record too. A free board meeting minutes template helps you document risk discussions and decisions the same way every time.
Keep Risk Oversight on the Board's RecordA demo shows how risk reports, committee updates, and the board's decisions on risk response stay together in one secure portal, so directors can see what was identified, what was decided, and who owns the follow-up.
Schedule a DemoAbout The Author
- Tyler Naples is an SEO Strategist focused on building scalable organic growth systems for OnBoard, the leading board management software solution. He specializes in connecting high-intent traffic segments with content that ranks, resonates, and converts.
Latest entries
Risk & ComplianceNovember 12, 2026What is Enterprise Risk Management? (Overview, Definition, and Examples)
AI & TechnologyNovember 4, 2026What is Board Book Software? (+ Free Vendor Evaluation Checklist)
AI & TechnologyOctober 28, 2026How OnBoard AI Minutes Identifies Every Board Speaker
AI & TechnologyOctober 26, 2026Q&A: How Much Does a Board Portal Cost?
