Structuring an Enterprise Risk Assessment Protocol: Traditional Practice and New Methods

In a world that has become increasingly complex, enterprise risk management (ERM) has emerged as a practice for identifying reasonably foreseeable hazards that pose risks to an organization, both its physical and human assets. Due to the breadth and depth of factors that can impact an organization's risk portfolio, it is incumbent that the underlying risk assessment process that supports ERM embodies a holistic and systematic approach. This is easier said than done, however, as much of the effort in self‐acclaimed ERM programs remain entrenched in compartmentalized parts of the organization or ignore threats that are “outside of the box” of the operating environment to which management is accustomed. This environment therefore creates opportunities for key risks to go unnoticed. The authors propose a comprehensive, yet flexible framework for overcoming this challenge, an approach that can be utilized by both the public and private sector. A sample application is provided, using a free, web‐based tool developed as part of the initiative.