Empowered Enterprise Risk Management

CHAPTER 3Risk Theory

IN THE PREVIOUS CHAPTER we established some principles of risk and risk management. As such, they are valid for any type of effort at managing risk that aims at value maximization. Now we turn our attention to enterprise risk management (ERM) itself. Our aim is to explore and understand the defining features that set it apart from other ways of doing risk management, and to develop a theory of ERM. Our message in this chapter is that ERM can be seen as a solution to certain general risk management problems that result from a model of decentralized decision‐making (the so‐called ‘silos’).

We will use the definition provided by COSO (2004), given in Chapter 2, as a point of reference, because it contains several concepts we will return to throughout this book. But we believe the core of ERM is better captured by the following, more parsimonious, definition, inspired by Gates (2006):

Enterprise risk management is a board‐supervised process for integrated risk management across the enterprise.

Here we are able to pin down more clearly the three features of ERM that differentiate it from past attempts at managing risk. First, it is integrated, referring to a high degree of coordination of risk management activities at the corporate level. Second, it is supervised by the board of directors, suggesting an involvement of senior decision‐makers that was previously missing. Third, it is enterprise‐wide in scope, which means that the effort to manage risk comprises ...