What Enterprise Risk Management Adds Over Silo Risk Management
The gaps that appear when each department manages its own risks alone, and what an enterprise view closes.
12 min
Activities: 0 of 2
Most organisations already manage risk. The safety team has a hazard register. Finance tracks currency and credit exposure. IT tracks cyber threats. Projects keep their own risk logs. Each list may be good. This is silo risk management: every function manages its own risks, with its own scales, its own owners and its own reports.
Enterprise risk management (ERM) is a coordinated way to manage all of these risks together, at the level of the whole organisation, and in direct connection with its strategy and objectives. ERM does not replace the specialist registers. It sits above them and connects them.
You already know the basic risk process, the register and the 5×5 matrix. The question now is different. It is not "how do I manage this risk?" It is "which risks matter most to the whole organisation, and are we taking the right amount of risk to reach our goals?"
Five gaps that silo risk management leaves open
Worked example: a regional logistics company
A logistics company with 2,000 staff runs warehouses in four countries. Each country manager keeps a risk register. All four registers include "warehouse management system outage" as a medium risk, with a score of 9. None of them is alarming.
An ERM review looks across the four registers. It finds that all four countries use the same system, hosted by one provider, in one data centre. A single outage would stop every warehouse at once. Customers have contracts with penalties for late delivery. The combined loss is many times larger than any one country estimated.
No new data was needed. The enterprise view simply joined existing information and asked a different question. The result was one enterprise risk, owned by the chief operating officer, with a funded response.
Second example: a private hospital group
A hospital group wants to open two new clinics in one year. The finance team sees a funding risk. The clinical team sees a staffing risk. The facilities team sees a construction delay risk. Each team plans its own response.
With an enterprise view, leaders see that all three risks rise together if the plan is too fast. They choose to open one clinic first and the second six months later. Total risk falls, and the strategy is still achieved. This is the value of ERM: better decisions, not better lists.
Four country registers each record the same supplier failure as a "medium" risk. What is the main thing an enterprise view adds?