# XGRC® Enterprise Risk Management

_Enterprise Risk Intelligence_

**Risk managed at enterprise scale, not spreadsheet scale.**

Enterprise risk management (ERM) software is the system an organisation uses to identify, assess, treat, monitor and report risk across the whole business. XGRC® ERM gives you a structured, auditable approach to enterprise, operational and project risk, aligned to ISO 31000 and COSO ERM, with board-level dashboards, risk appetite monitoring and corrective action tracking built in.

## What it is

Enterprise risk management (ERM) software is a system for identifying, assessing, treating, monitoring and reporting the risks that could affect an organisation's objectives, across business units, projects, strategic objectives and operations. Unlike a spreadsheet risk register, it links every risk to an owner, its controls, key risk indicators (KRIs), the board's risk appetite and the actions raised to treat it, so the risk picture stays current between reviews.

## Overview

XGRC® ERM provides a complete enterprise risk management platform, from risk identification and appetite-setting through treatment planning, KRI monitoring, and board-level reporting, with every element linked to governance, controls, and assurance.

## When organisations use it

Organisations typically adopt XGRC® ERM when risk registers are maintained annually in spreadsheets, risk appetite thresholds are set but not enforced, and the board has no real-time view of residual risk. The XGRC® ERM solution connects enterprise risk to controls, assurance, compliance obligations, incidents and actions within the same secure data foundation used across XGRC® Software.

## What it is not

ERM is not a static annual risk register exercise. It is a live risk management system with board dashboards, KRI monitoring and appetite-breach alerts, designed to stay current between review cycles, not just at them.

## Challenges it addresses

- **Risk registers nobody maintains** — Annual reviews produce impressive registers that are outdated before they are presented. Residual risk is never re-assessed.
- **Risk appetite defined, but not enforced** — The board sets appetite thresholds. Operational decisions ignore them. There is no mechanism to detect or escalate breaches.
- **KRIs reported in isolation** — Key risk indicators tracked separately from the risks they monitor. Early warning signals go unnoticed until they become incidents.
- **Risk and assurance disconnected** — The audit plan bears no relationship to the risk register. High-risk areas go unaudited. Low-risk areas receive excess coverage.

## Modules

- **Risk Identification:** Risk Register, Risk Categorisation, Emerging Risk Tracking, Risk Event Capture
- **Assessment & Appetite:** Likelihood & Impact Scoring, Risk Appetite Thresholds, Tolerance Monitoring, Heat Map Visualisation
- **Treatment & Action:** Treatment Plans, Action Accountability, Escalation & Breach Alerts, Residual Risk Tracking
- **Monitoring & Reporting:** KRI Monitoring, Board Dashboards, Management Reporting, Trend Analysis

## What enterprise risk management software does.

Good risk management software follows the risk management cycle rather than storing a list. XGRC® ERM covers every stage on one platform, so the same risk record moves from identification to treatment to the board report without being copied between files.

- **Identify:** A central risk register with risk categorisation, emerging risk tracking and risk event capture across enterprise, operational and project risk.
- **Assess:** Likelihood and impact scoring, inherent and residual risk, and heat map visualisation, so a long list of risks becomes a prioritised one.
- **Treat:** Treatment plans with named owners, action accountability and residual risk tracking as each treatment takes effect.
- **Monitor:** Key risk indicators and risk appetite thresholds monitored against each risk, with escalation and breach alerts when a tolerance is exceeded.
- **Report:** Real-time board dashboards, management reporting and trend analysis drawn from the live register, not assembled by hand.
- **Assure:** Controls, audit findings and assurance coverage linked to each risk through Integrated Assurance, so the audit plan follows the risk profile.

- [What is enterprise risk management?](https://xgrcsoftware.com/insights/what-is-enterprise-risk-management/)
- [The five risk management process steps](https://xgrcsoftware.com/insights/five-risk-management-process-steps/)

## A risk register that stays current between reviews.

Most risk registers start life in Excel. They work for one owner and one review cycle, then break as soon as several business units, risk owners and treatment plans share the same file. XGRC® ERM replaces the spreadsheet with a live risk register: every risk has an owner, a category, inherent and residual scores, linked controls and a treatment plan, and every change is recorded in the audit trail.

- **Owned and scored:** Each risk carries an owner, a category and likelihood and impact scores, so residual risk is re-assessed when controls or circumstances change, not once a year.
- **Linked to controls and actions:** Controls, treatment plans and actions sit on the risk itself. Overdue actions and failed controls raise the residual score where the board can see it.
- **Appetite and KRIs built in:** Risk appetite thresholds and key risk indicators are monitored against each risk, with escalation and breach alerts when a tolerance is exceeded.

- [Moving on from a risk register template](https://xgrcsoftware.com/use-cases/risk-register-template/)
- [ISO 31000 risk management](https://xgrcsoftware.com/use-cases/iso-31000-risk-management/)

## Aligned to ISO 31000, COSO ERM and King V.

South African boards are usually asked to show that risk is governed against a recognised framework. XGRC® ERM is structured so the same risk data answers to all three.

| Framework | What it asks for | How XGRC® ERM supports it |
| --- | --- | --- |
| ISO 31000 | A risk management process: scope, context and criteria, risk assessment, treatment, monitoring and review, and recording and reporting. | Risk categorisation, likelihood and impact scoring, treatment plans, residual risk tracking and management reporting follow the ISO 31000 process. |
| COSO ERM | Risk integrated with strategy and performance across five components, from governance and culture to information, communication and reporting. | Risks link to objectives, appetite thresholds and KRIs, with trend analysis and board dashboards for review and revision. |
| King V | A governing body that governs risk in a way that supports setting and achieving strategic objectives, with oversight through its committees. | Board and committee views of top risks, appetite breaches and assurance coverage, with a full audit trail behind every figure. |

- [ISO 31000 vs COSO: the key differences](https://xgrcsoftware.com/insights/iso-31000-vs-coso-key-erm-framework-differences/)
- [King V governance](https://xgrcsoftware.com/use-cases/king-v-governance/)

## One view of risk for the board and the audit committee.

Board packs usually take days to assemble because risk data is spread across registers, incident logs and audit reports. In XGRC® ERM the board dashboard is built from the live register: top risks against appetite, movement since the last meeting, overdue treatment actions and KRI trends.

Because ERM runs on the same platform as Integrated Assurance, the audit committee also sees which high risks have been audited, which controls were tested and where assurance gaps remain. The internal audit plan follows the current risk profile rather than last year's.

- [Integrated Assurance](https://xgrcsoftware.com/integrated-assurance/)
- [Enterprise risk management use case](https://xgrcsoftware.com/use-cases/enterprise-risk-management/)

## How to choose enterprise risk management software.

Most ERM software looks good in a demo with sample data. These six questions separate a system that is still maintained two years from now from one that becomes another stale register.

- **Framework alignment:** The risk process should follow ISO 31000, and the same risk data should answer COSO ERM and, in South Africa, King V, without separate registers for each.
- **Appetite and KRIs that act:** Risk appetite thresholds and key risk indicators should be monitored against each risk and escalate when a tolerance is breached, not sit as passive fields.
- **Links to controls and assurance:** Each risk should link to its controls, treatment actions and audit findings, so a failed control or an overdue action changes the residual risk.
- **Board-ready reporting:** Board and audit committee views should come straight from the live register, showing movement since the last meeting, with an audit trail behind every figure.
- **Room to grow into GRC:** Risk rarely stays separate from compliance, audit, ESG and information security. Choose a platform where those disciplines can be added on the same data later.
- **Security and hosting:** Ask for independent certification and where the data lives. XGRC® Software is certified to ISO/IEC 27001:2022 and hosted in Microsoft Azure West Europe (Netherlands).

- [ERM software vs traditional risk tools](https://xgrcsoftware.com/insights/erm-software-vs-traditional-risk-tools/)
- [GRC software: the wider XGRC® platform](https://xgrcsoftware.com/grc-software/)

## ERM software compared with spreadsheets, point solutions and GRC suites.

There are four common ways to run enterprise risk. Each has its place. The right choice depends on how many risks, owners, business units and frameworks you need to govern, and how closely risk has to connect to compliance and audit.

| Approach | Best suited to | Limits and what to plan for |
| --- | --- | --- |
| Spreadsheet risk register | A small number of risks, one owner and an annual review cycle. | No enforced ownership, an unreliable change history, no appetite or KRI alerts and no link to controls or audit findings. The register ages between reviews. |
| Standalone risk tool (point solution) | A risk team that needs better scoring and a shared register than a spreadsheet allows. | Risk sits apart from compliance, audit and incidents, so the links between a risk, its controls and the findings against them are rebuilt by hand every reporting cycle. |
| Broad GRC suite | Organisations that need risk, compliance and audit on one data model. | Check the depth of the risk module itself: appetite, KRIs, treatment tracking and board reporting, as well as how long it takes to go live. |
| XGRC® ERM on the XGRC® platform | Organisations that want dedicated ERM now, connected to compliance, assurance, ESG and information security on the same data. | Agree risk categories, scoring criteria and appetite thresholds up front, then add further solutions module by module rather than in one big-bang rollout. |

- [ERM vs traditional risk management](https://xgrcsoftware.com/insights/enterprise-risk-management-vs-traditional-risk-management/)
- [Moving on from a risk register template](https://xgrcsoftware.com/use-cases/risk-register-template/)

## Certified, securely hosted and in use.

XGRC® Software is certified to ISO/IEC 27001:2022 for information security management, and customer data is hosted in Microsoft Azure West Europe (Netherlands). Users can sign in with single sign-on through Microsoft Entra ID (Azure Active Directory).

The XGRC® platform is trusted by 800+ companies. TN Ceramics, a South African manufacturer supplying the mining industry, runs XGRC® ERM alongside SHEQX® and ENVIRX® and cut its high-priority enterprise risks by 40%.

- [Security, hosting and certification](https://xgrcsoftware.com/trust/)
- [XGRC® customers](https://xgrcsoftware.com/customers/)

## Standards & frameworks

- ISO 31000
- COSO ERM
- King V
- IFRS

## Frequently asked questions

### What is enterprise risk management (ERM) software?

ERM (enterprise risk management) software is a system for identifying, assessing, treating, monitoring and reporting risks across a whole organisation. It replaces spreadsheet risk registers with a live register that links each risk to owners, controls, key risk indicators and treatment actions, and gives the board a current view of risk against appetite.

### ERM vs ERP: what is the difference?

ERP (enterprise resource planning) software runs business transactions such as finance, procurement and inventory. ERM (enterprise risk management) software governs the risks to the business: what could go wrong, how likely it is, what controls are in place and whether they work. Many organisations run both, with ERM drawing on ERP data as a source of risk indicators.

### Is ERM software better than spreadsheets?

For more than a handful of risks and owners, yes. Spreadsheets cannot enforce ownership, track changes reliably, alert on appetite breaches or link risks to controls and audit findings. ERM software keeps the register live and auditable, so the figures in the board pack are the same figures the business works from.

### What should I look for in enterprise risk management software?

Look for a risk process aligned to ISO 31000 that can also answer COSO ERM and King V, risk appetite thresholds and KRIs that escalate when breached, links from each risk to its controls, actions and audit findings, board reporting drawn from the live register, a path to add compliance and assurance on the same data, and independent security certification such as ISO/IEC 27001.

### What is enterprise risk and compliance software?

It is software that manages enterprise risk and compliance obligations together, so a compliance failure shows up in the risk picture and each risk links to the obligations it threatens. XGRC® ERM runs on the same platform as compliance, assurance, ESG and information security, so risk and compliance share one data foundation instead of two systems.

### What is the difference between ERM software and GRC software?

ERM software focuses on risk: the register, appetite, KRIs, treatment and board reporting. GRC software is broader, covering governance and compliance as well as risk and connecting all three. XGRC® provides both, with ERM as the risk pillar of the XGRC® GRC platform.

### Is XGRC® ERM aligned to ISO 31000?

Yes. ERM is aligned to ISO 31000 and COSO ERM, with King V and IFRS-aligned reporting for South African organisations.

### Can ERM link to our internal audit function?

Yes. ERM connects directly to Integrated Assurance, so the audit plan reflects the current risk landscape rather than last year's assumptions.

### Does ERM support board-level reporting?

Yes. ERM includes real-time board dashboards, risk appetite monitoring and trend analysis built for board and audit committee reporting.

### How is ERM different from a risk spreadsheet?

ERM keeps risk data live and linked, appetite breaches, KRI thresholds and treatment plans are monitored continuously, with full audit trails, rather than reconciled manually once a year.

### Where is XGRC® ERM data hosted, and is it secure?

XGRC® Software is certified to ISO/IEC 27001:2022 for information security management, and customer data is hosted in Microsoft Azure West Europe (Netherlands). Users can sign in with single sign-on through Microsoft Entra ID.

## Related solutions

- [Integrated Assurance](https://xgrcsoftware.com/integrated-assurance)
- [MSX®](https://xgrcsoftware.com/msx)
- [MSXCyber®](https://xgrcsoftware.com/msxcyber)
- [AI Governance](https://xgrcsoftware.com/ai-governance)

---

Source: https://xgrcsoftware.com/erm