Questions asked about enterprise risk management by risk practitioners

Abstract

Enterprise risk management (ERM) was introduced in the 1990s and has become an indicator of good management. Despite this success, many organizations still seek practical advice on ERM implementation. This article provides questions asked of an experienced chief risk officer and his staff by risk practitioners at many organizations over 11 years. Detailed answers based on best practices are provided. This article is important as it shows what areas were of concern related to ERM implementation, and many of these concerns may still apply today. The questions presented in this article fall in the following 10 areas of ERM implementation: background and context, organizational, getting started, risk identification, culture and engagement, risk criteria (which includes risk appetite and risk tolerances), tools and techniques, reporting, the benefits, and the future of ERM. This article should be of interest to practitioners involved with ERM, consultants in the area of ERM, and academics teaching courses on ERM, risk management, and related topics. This article will also provide a base against which further future research can be done to see how ERM evolves.