Key Summary
- Enterprise risk management has evolved from a manual compliance task into an integrated system that actively shapes senior leadership decisions.
- Practitioners must abandon one-size-fits-all approaches and adapt their risk strategies to the unique culture of their industry.
- Overcoming stakeholder denial and departmental silos requires continuous engagement, active listening, and professional certification
Enterprise risk management is no longer just a back-office compliance function. Now, it is the mechanism that prevents business leaders from being blindsided by emerging threats.
Ahmad Azwang has seen this evolution up close and it has shaped his career. Today, as Head of Governance and Risk Management at DXN Holdings Berhad, he provides advisory input on governance, risk management, and business continuity matters.
“A key focus of my role is driving continuous improvement initiatives, both within the department and across the organisation,” he shared. “This includes reviewing and approving risk updates captured in the report or system to ensure accuracy and relevance.”
Over his 15-year career in the field, the profession has changed dramatically.
Azwang recalled that back when he first started his enterprise risk management career, risk registers and reports were still being manually prepared using Microsoft Word. Now, practitioners operate in a much more dynamic environment, managing real-time data alongside cross-departmental expectations.
Navigating this change, Azwang’s journey spans from establishing departments in financial institutions like SME Bank as Head of Enterprise Risk Management to tailoring practices for the media industry at Media Prima Berhad.
He is now applying these diverse experiences to strengthen governance and enterprise resilience at DXN, supporting a global organisation that operates across distribution, manufacturing, cultivation, and research activities in multiple regions.
Through it all, Azwang learned that strategic risk management is never a one-size-fits-all solution. It requires adapting to different industry cultures, addressing talent retention challenges, and overcoming resistance from stakeholders who remain in denial about emerging threats.
Building a Tailored Enterprise Risk Management Framework
A robust enterprise risk management framework requires practitioners to adopt a flexible approach. During his time in the financial sector, Azwang observed a highly structured environment driven by central bank requirements.
While this ensures consistency and compliance, it often limits flexibility and creativity in how risks are assessed and presented.
In contrast, non-financial sectors require a tailored approach. This demands a deeper understanding of the specific industry, as each sector has its own unique characteristics in terms of risk appetite, culture, and operational dynamics.
For example, the media industry thrives on creativity, with a more dynamic mindset, whereas manufacturing prioritises compliance, product quality, and service excellence to customers.
“Risk reporting cannot adopt a one-size-fits-all approach. It must be carefully designed and tailored to align with the specific needs, culture, and priorities of each industry,” Azwang shared.
Beyond the strategy, the tools supporting an enterprise risk management framework have also evolved. Organisations now expect integrated systems that offer real-time reporting and rigorously quantified matrices, allowing businesses to evaluate impact and likelihood with greater reliability.
Cultivating a Proactive Risk Culture
A recurring challenge throughout Azwang’s career has been managing stakeholders who remain in denial about emerging threats.
He experienced this early in his career within the media industry, where he warned stakeholders about the rapid evolution of digital media. Many dismissed his concerns, only to see the landscape shift entirely within five years.
Overcoming this level of complacency requires a strong risk culture.
While senior leadership previously delegated risk matters entirely to the enterprise risk management function, today’s management and boards expect a consolidated view of threats across their global business landscape.
“There has been a notable improvement in mindset and risk culture across the organisation,” Azwang shared. “Achieving this transformation, however, has required continuous engagement, communication, and awareness-building at all levels.”
Because of this cultural shift, he sees a growing reliance on his function for advisory and consultation. Looking ahead, Azwang hopes for “stronger adoption of risk-based thinking across all employees,” ensuring the risk management function is recognised as a value-adding partner rather than an administrative hurdle.
Shifting Towards Strategic Risk Management
Another common pitfall in enterprise risk management is department tunnel vision. Azwang encountered this challenge first-hand when building a financial institution’s enterprise risk management function from the ground up.
Engaging department heads across Liquidity, Credit, Market, and Operational Risk proved difficult because each stakeholder viewed the enterprise risk management framework strictly through the lens of their own domain.
Effective strategic risk management, however, must rise above these departmental boundaries.
“Enterprise risk management is inherently holistic. It integrates all these risk dimensions and operates above them to provide a consolidated, enterprise-wide perspective,” Azwang explained.
While domain experts are highly competent in their fields, they often miss the broader scope. Bridging that disconnect is essential today, especially as leadership expectations have shifted.
Azwang noted that senior management now actively relies on risk insights for strategic planning and decision-making.
For enterprise risk management to deliver this value, practitioners must listen actively to each business unit. By understanding the differing priorities and decision-making approaches at various levels, teams develop the professional maturity needed to align their insights with the organisation’s overall goals.
The Value of a Risk Management Certification
No matter how robust a framework is, it requires continuous learning to maintain it.
“Regardless of how long we have been in a particular field, experience alone does not guarantee that our approach is always correct or complete,” Azwang shared.
To ensure his own strategies remained sharp, Azwang turned to formal professional education to standardise his approach and build professional confidence.
In 2019, Azwang pursued the market leading Enterprise Risk Manager (ERM®) certification with the international Institute of Enterprise Risk Practitioners (IERP®) to strengthen his knowledge and capabilities, while recognising the long-term growth potential in this field.
“The certification programme, comprising 11 modules, significantly contributed to my professional development,” he shared. “It enhanced my confidence and validated that my approach to enterprise risk management was aligned with established practices and standards.”
Crucially, these 11 modules provided a comprehensive foundation that helped Azwang bridge the gap between the highly structured demands of financial institutions and the dynamic, tailored approaches required for non-financial sectors.
Alongside this, Azwang also pursued his sustainability risk management (SRM™) certifications with the (IERP®). These enabled him to implement sound methodologies, aligning with an organisation’s requirement for reporting on both fronts.
Beyond the coursework, Azwang found immense value in the broader IERP® community. The knowledge, together with the notes, templates, and materials shared by the IERP® faculty and fellow participants, proved highly valuable in supporting the practical adoption of these frameworks.
Equipped with this community support and a refined strategic perspective, Azwang secured multiple leadership roles, establishing a new department at SME Bank and filling vacant, specialised roles at Media Prima and DXN Holdings Berhad.
For future practitioners, Azwang recommended pursuing formal, internationally recognized, professional qualifications.
“Pursuing an internationally recognised risk management certification, such as those offered by the IERP®, can significantly enhance confidence in applying the right methodologies and processes,” he advised.
Advice to Aspiring Risk Practitioners
While formal professional education lays the groundwork, succeeding in enterprise risk management requires more than just mastering frameworks and compliance.
As Azwang noted, driving true organisational transformation comes down to having the right people, supported by the right tools and methodologies, and executing with consistency.
Having a strong role model helps, too. For Azwang, that was Dato’ Anthony Firdauz Bujang, the former CEO of New Straits Times Press.
“What inspired me most was his leadership, his ability to motivate and align everyone towards a common goal, and delivering results that had not been realised in the previous 30 years,” he shared.
For aspiring risk professionals, this level of leadership is the benchmark. True strategic risk management is no longer just about mitigating loss; it is about driving organisational transformation.
By blending the structured foundation of a professional enterprise risk management certification with a proactive, strategic mindset, practitioners can step out of their silos and position themselves as invaluable leaders driving their organisations forward.
