Enterprise Risk Management (ERM) does not have a universal approach. There are many ways and strategies to identify, analyse, and manage risk in an enterprise. So how can managers best interpret ERM concepts and implement them to mitigate risks?

ERM implementation involves adopting risk management protocols. There is no single correct way to implement these, but effective adoption and risk management strategies can be achieved by identifying and overcoming common pitfalls and critical risk factors that can significantly impact an enterprise’s bottom line.

According to Matt Lerner, director of Advisory Services practices at Grant Thornton LLP, a good starting point in discussing enterprise risk management is to divide the risk analysis into types of impact as follows:

• Strategic — Causes a strategic objective to fail;
• Financial — Incurs unanticipated cost or reduces revenues;
• Operational — Affects the quality or efficiency of how work gets done;
• Reputational — Creates negative media attention;
• Environmental, health and safety — Jeopardizes staff, volunteer or others’ well-being;
• Technology — Exposes applications, data, operating systems, network or infrastructure to inappropriate access/change;

Legal — Triggers arbitration or litigation against your organisation.

Once identified, when evaluating these types of risks, organisations should consider their resulting impact, be it financial, technological or reputational.  Risk impact represents the degree to which your business can be affected by these identifiable risks.

Not all the above types of risk may apply to your enterprise, and there can be other significant threats depending on your specific business activities and industry-related aspects.

Also, it is important to note that not all risks will affect an organisation in the same way, and the classification between top risks and lower risks require different responses. For example, senior management should consider all types of risks that impact the business, not only the top critical strategic and financial risks, says Lerner.

While there is no foolproof method to conduct enterprise risk management, success depends on developing and following a comprehensive, structured methodology that fits your organisation, with the ability to identify, evaluate, report and mitigate key risks, and most importantly, translate best practices into actionable steps.

The XGRC Software range of integrated system solutions is designed to meet all the requirements of your organisation’s Governance, Risk Management and Compliance (GRC) strategy, from planning to monitoring and reporting, by aggregating data into a central auditable database.