EB Chapter 2 – Enterprise Risk Management in an Organization

Collection of vocabulary terms covering enterprise risk management approaches, maturity models, and key organizational functions based on Elliot Book Chapter 2.

Enterprise Risk Management (ERM)

A system that adds value to an organization when it effectively identifies and addresses key risks.

Bottom-up approach

An approach where risks are identified throughout the organization at all levels to provide as complete a picture as possible of all the organization’s risks.

Top-down approach

An approach where senior management and the board of directors identify major risks and determine risk management principles and procedures to communicate throughout the organization.

Lagging indicators

Measures of risk identification based on past events, such as employee injuries or damaged products.

Leading indicators

Measures of risk identification that signal potential future issues, such as flaws in designs or procedures.

Risk management computerized dashboard

A tool showing each risk along with its likelihood, its potential effect on the organization, and the ability of the organization to respond.

Risk Appetite and Strategy Statement

A top-down building block representing the amount of risk an organization is willing to take in pursuit of its objectives.

Risk Maturity Model (RMM)

A model providing well-defined levels to assess an organization’s progress in developing an ERM program and improving business processes.

Ad hoc (CMM Level)

Level $1$ of the Capability Maturity Model where there is no formal risk management process and little awareness of the concept.

Initial (CMM Level)

Level $2$ of the Capability Maturity Model characterized by basic risk management processes with no attempt at enterprise-wide risk management.

Defined (CMM Level)

Level $3$ of the Capability Maturity Model featuring a formal risk management process, at least for project management.

Managed (CMM Level)

Level $4$ of the Capability Maturity Model using quantitative metrics for identification, assessment, and response to risk.

Optimizing (CMM Level)

Level $5$ of the Capability Maturity Model involving ongoing improvement to the risk management process and a robust organizational risk culture.

Capability Maturity Model Integration (CMMI)

A $2006$ expansion of CMM that evaluates activities, results, and the alignment of processes with strategic goals.

RIMS Risk Maturity Model

An ERM model developed by RIMS and LogicManager in $2006$ that uses five maturity levels and seven specific attributes.

David Hillison's RMM levels

A four-level model developed in $1997$ consisting of Level $1$ "naïve," Level $2$ "novice," Level $3$ "normalized," and Level $4$ "natural."

S&P Risk Maturity Ratings

A assessment system using positive, neutral, and negative ratings to evaluate an organization's risk management policies and tolerances.

Balanced scorecard

A management technique introduced in the $1990\text{s}$ to evaluate the alignment of a project, process, or business unit with strategic objectives.

Governance

The organizational function in which the board and senior executives set management policy and guidelines.

Risk Tolerance

The amount of risk an organization can endure, which may vary according to capitalization, regulation, and competitive environments.

Internal Control Function

An organizational function that audits operations and can detect indicators of potential risk before they appear in operational results.

Chief Risk Officer (CRO)

A senior role responsible for ERM that typically reports to the CEO, CFO, or a board risk committee.

Sarbannes-Oxley Act of $2002$

Legislation that introduced new control standards for many organizations after the collapse of Enron.

Dodd-Frank Wall Street Reform and Consumer Protection Act

A $2010$ act that introduced new requirements for financial organizations.