Skip to main content
All glossary terms

Regulation & risk

Enterprise Risk Management (ERM)

Enterprise risk management (ERM) is an organization-wide approach to identifying, evaluating, responding to, and monitoring risks that may affect objectives. It gives leadership and operational teams a shared structure for discussing risk across functions rather than treating each concern in isolation.

Also known as ERM.

Why it matters in practice

ERM connects risk ownership, reporting, and decisions with an organization’s strategy and operating processes. Programs vary in method and maturity, and a common register does not make risks directly comparable without context. Technology, privacy, and AI risks may feed an ERM process while still requiring specialized analysis.

Example

A risk owner presents a service dependency alongside financial and operational concerns in the organization’s regular enterprise risk review.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.