How Organizations Identify and Assess Enterprise Risks

Enterprise Risk Management (ERM)—the process through which organizations identify and manage a broad portfolio of risks in an integrated way—is a good investment for any organization because known and unknown risks are everywhere. While risk will always be part of the price of doing business, the good news is that many organizations leverage a portfolio of techniques for systematically identifying, assessing, and prioritizing it. Drawing from the results of our Evolving Practices in Risk Management research, this article describes some of the most common approaches for risk identification and assessment observed in the study and highlights emerging practices that are adding value to ERM.