enterprise risk management (ERM)

Imagine a hospital that has a brilliant fire-safety officer, a brilliant infection-control nurse, and a brilliant finance manager — but they never talk to each other. Each one keeps their own corner safe, yet nobody is watching whether all three problems could strike on the same bad day, or whether fixing one quietly makes another worse. ERM is the decision to stop running risk in separate silos and instead look at every threat to the whole organization on one shared table, asking not just 'how big is each danger alone?' but 'how do they add up, and which ones could sink us together?'

Concretely, enterprise risk management is a coordinated, top-down process. Leadership first decides how much total risk the firm is willing to carry (its risk appetite), then identifies the full menu of risks — markets falling, borrowers defaulting, claims spiking, computers failing, cash drying up — measures each in a common currency (usually 'how much capital could this cost us?'), and aggregates them while accounting for the fact that they rarely all go wrong at once. A simple picture: if a market crash would cost 60 and a wave of claims would cost 80, the firm does not necessarily need 140 of capital, because a stock crash and a hurricane are not the same event — but it cannot assume they are unrelated either. ERM is the discipline of making that aggregation honest and acting on it.

For an insurer this is not optional housekeeping; it is increasingly the law and the core of staying alive. Regulators (through frameworks like Solvency II and the ORSA) require an embedded, board-owned ERM process, and rating agencies grade insurers partly on it. The common misconception is that ERM is a binder of risk reports filed once a year. Good ERM is the opposite: a living loop where the risk view actually changes what the company prices, sells, reinsures, and invests in — risk is managed forward, not just measured after the fact.