What enterprise risk management is
Enterprise risk management (ERM) is the practice of managing risk across the whole organization, linked to strategy, rather than department by department. Instead of finance, IT, operations and compliance each keeping their own risk lists, ERM gives leadership one view of the risks that could affect objectives, one way to rate them and one place to decide what to do.
ERM is the risk part of GRC. It works best when it is connected to governance (risk appetite set by the board) and to compliance (obligations and controls that reduce risk).
The two main frameworks
| COSO ERM | ISO 31000 | |
|---|---|---|
| Full name | Enterprise Risk Management: Integrating with Strategy and Performance (2017) | ISO 31000:2018 Risk management: Guidelines |
| Structure | Five components and 20 principles | Principles, a framework and a process |
| Emphasis | Linking risk to strategy-setting and performance | Practical guidelines usable by any organization |
| Certifiable? | No | No; ISO states it “is not a certifiable risk management standard” |
| Common users | US public companies, organizations already using COSO internal control | International organizations, public sector |
COSO’s five components are Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting. COSO describes the 2017 framework as an update to its 2004 integrated framework that “highlights the importance of considering risk in both the strategy-setting process and in driving performance.”
Many organizations borrow from both: COSO for board-level structure and ISO 31000 for the working process.
The ERM process
- Set context and appetite. Define objectives and how much risk the organization will accept to reach them.
- Identify risks. Workshops, interviews, incident data, audit findings, emerging-risk scanning.
- Assess. Rate likelihood and impact against common scales; note velocity and interdependencies.
- Prioritize. Compare against appetite; agree the top risks.
- Respond. Accept, reduce, transfer or avoid; assign owners and actions.
- Monitor. Key risk indicators (KRIs), control testing, incident trends.
- Report. A concise view for management and the board, with changes since last period.
- Review. Revisit the risk profile when strategy, operations or the environment change.
Risks rising in 2026
| Risk area | Signal |
|---|---|
| Third-party and supply chain | Verizon’s 2026 DBIR (May 19, 2026) found breaches involving a third party accounted for 48% of all breaches, up 60% |
| Vulnerability exploitation | The same report found 31% of breaches started with vulnerability exploitation, the first time it overtook stolen credentials as the top entry point |
| Unapproved AI use | Employee use of unapproved AI tools rose from 15% to 45% in a year, per the 2026 DBIR |
| Cyber disclosure | SEC rules require public companies to describe cyber risk processes and board oversight annually |
| AI regulation | The EU AI Act, US state laws and federal policy are changing quickly; see our AI risk assessment article |
| Operational resilience | EU DORA has applied to financial entities since January 17, 2025 |
These risks share a feature: much of the evidence about them sits outside the organization, in vendor reports, contracts and attestations.
What risk management software does
| Capability | Why it matters |
|---|---|
| Central risk register | One version of the truth across departments |
| Common scoring scales and heat maps | Comparable ratings |
| Risk-control mapping | Shows which controls reduce which risks |
| KRIs with thresholds | Early warning, not just annual review |
| Action and issue tracking | Responses actually completed |
| Incident and loss data | Real outcomes inform ratings |
| Board reporting | Consistent, traceable reports |
| Links to compliance and third-party modules | ERM connected to the rest of GRC |
Common weaknesses
- Risk registers as lists. Risks recorded but never linked to controls, owners or actions.
- Scores without rationale. “High” ratings no one can explain.
- Annual-only reviews. Risk profiles that miss fast-moving risks.
- Third parties missing. Vendor risk managed separately, if at all.
- No evidence behind ratings. A risk rated “low” because a control exists on paper.
ERM checklist
- Framework chosen (COSO, ISO 31000 or a blend) and documented
- Risk appetite approved by the board
- Common rating scales across the organization
- Risks linked to objectives, owners, controls and actions
- KRIs defined for top risks
- Third-party, cyber and AI risks included
- Ratings supported by evidence and documented rationale
- Regular reporting with changes highlighted
Check the evidence behind risk ratings with AskDona
A risk rating is only as good as the evidence behind it. AskDona reads control evidence, policies, vendor reports and audit findings against the criteria you set and flags gaps, such as controls rated effective without supporting evidence or vendor reports that contradict assumptions, with links to the source page. Run a sample risk evidence review on one top risk. AskDona shows the evidence; your risk team decides.
FAQ
What is enterprise risk management? Organization-wide management of risks to objectives, using a common process, common ratings and board oversight.
What is the best ERM framework? There is no single best. COSO ERM suits organizations focused on strategy and board reporting; ISO 31000 offers practical guidelines. Many combine them.
What does risk management software do? It holds the risk register, scoring, controls, KRIs, actions and reporting in one system.
How is ERM different from GRC? ERM is the risk part of GRC. GRC also covers governance and compliance.
How often should enterprise risks be reviewed? Top risks continuously through KRIs and at least quarterly by management; the full profile at least annually and when circumstances change.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| COSO, Enterprise Risk Management | Standards organization | COSO ERM description |
| NC State ERM Initiative, COSO’s ERM Framework (archived) | University resource (archived) | Five components, 20 principles |
| ISO 31000 | International standard | ISO 31000 overview |
| Verizon, 2026 DBIR release (May 19, 2026) | Industry report | Third-party, vulnerability and shadow AI statistics |
| SEC press release 2023-139 | US regulator | Cyber disclosure |
| EIOPA, DORA | EU supervisory authority | DORA application date |