Enterprise risk management
In one sentenceAn approach by which a business identifies the risks that threaten its objectives, assesses their likelihood and impact, and then decides how to deal with each of them.
Simply put
Enterprise risk management looks at the whole business: financial, operational, regulatory and market risks. They are recorded in a risk register and each risk is given a score.
After the assessment the business chooses to avoid the risk, reduce it with controls, transfer it through insurance, or accept it if it is small.
Worked example
A medicine warehouse assesses the risk of inventory expiry on a scale of 1 to 5 for likelihood and impact.
Likelihood4
Impact5
Risk score4 × 5 = 20 out of 25
High risk that needs immediate controls20
Formula: Risk score = likelihood × impact
Don't confuse it with
Audit riskAudit risk concerns the likelihood that the auditor's opinion is wrong, while enterprise risks cover everything that threatens the business's objectives.