Jul 21, 2026 · 24 min · 6 segments
Regular ERM is one of the six Time Zones of ERM. This is part 1 of our discussion of regular ERM. We include discussion of Exploiting Risk by focusing on both upside and downside of risk. The three…
Max RudolphHost
Dave IngramHost
So you can't start talking about enterprise risk management without having a definition of it.
Risk can be defined in several ways and uncertainty about an unknown future plays a part.
Many prefer a statistical volatility metric or look only at downside risk or shortfalls against goals.
I tend to look at a combination of these and you need to be aware of how your audience thinks about risk to risk exposure aggregates these metrics, so they can be managed individually.
Risk management considers ways that the risk owner can choose to navigate a risk.
An entity can exploit, manage, minimize, or avoid risk exposures as a form of silo risk management.
I find that many of these concepts applicable even to individuals and have written up similarities to individual investment strategies in the past.
Enterprise Risk Management, or ERM, considers interactions between risks and how they aggregate.
A decision that makes sense for one business unit may not make sense for the firm, and the risk team is often involved in setting up consistent metrics and processes so capital allocation has consistency between opportunities and decision sets.
Some call ERM Enterprise Risk and Return Management, ERRM, alluding to the strategic opportunities and moving beyond purely defensive methods and constraints.
It was developed by the Casualty Actuarial Society and then later adopted by the Society of Actuaries.
The discipline by which an organization in any industry assesses, controls, exploits, finances and monitors risk from all sources for the purpose of increasing the organization's short and long term value to its shareholders.
If your ERM program is going to influence decision making at the senior level, it's important to include exploit in your definition.
This differentiates an ERM definition from pure downside concerns to being involved in strategic planning.
I think of risk management consistent with Max's definition, but I think of it in three layers, actually.
And at a second level layer is where the company is managing its aggregation of risks and And then the third layer is where the company is managing what Max was talking about with the risk and reward management.
And what I found from looking at a lot of companies is that some companies operate only one or two of those three layers.
The risk management system usually operates within a cycle, and what that means is that there's a number of steps that take place, and usually they're repeated year after year, hence the cycle idea.
So you can't start talking about enterprise risk management without having a definition of it.
Risk can be defined in several ways and uncertainty about an unknown future plays a part.
Many prefer a statistical volatility metric or look only at downside risk or shortfalls against goals.
I tend to look at a combination of these and you need to be aware of how your audience thinks about risk to risk exposure aggregates these metrics, so they can be managed individually.
Risk management considers ways that the risk owner can choose to navigate a risk.
An entity can exploit, manage, minimize, or avoid risk exposures as a form of silo risk management.
I find that many of these concepts applicable even to individuals and have written up similarities to individual investment strategies in the past.
Enterprise Risk Management, or ERM, considers interactions between risks and how they aggregate.
A decision that makes sense for one business unit may not make sense for the firm, and the risk team is often involved in setting up consistent metrics and processes so capital allocation has consistency between opportunities and decision sets.
Some call ERM Enterprise Risk and Return Management, ERRM, alluding to the strategic opportunities and moving beyond purely defensive methods and constraints.
It was developed by the Casualty Actuarial Society and then later adopted by the Society of Actuaries.
The discipline by which an organization in any industry assesses, controls, exploits, finances and monitors risk from all sources for the purpose of increasing the organization's short and long term value to its shareholders.
If your ERM program is going to influence decision making at the senior level, it's important to include exploit in your definition.
This differentiates an ERM definition from pure downside concerns to being involved in strategic planning.
I think of risk management consistent with Max's definition, but I think of it in three layers, actually.
And at a second level layer is where the company is managing its aggregation of risks and And then the third layer is where the company is managing what Max was talking about with the risk and reward management.
And what I found from looking at a lot of companies is that some companies operate only one or two of those three layers.
The risk management system usually operates within a cycle, and what that means is that there's a number of steps that take place, and usually they're repeated year after year, hence the cycle idea.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
