The Tea Talk titled “Critical Red Flags to Avoid in ERM Execution” highlighted one of the most critical yet often misunderstood aspects of enterprise risk management: the pitfalls in execution.
Key Insights
- Effective enterprise risk management (ERM) is not a compliance exercise, but a strategic tool that equips leaders to make better, more informed business decisions.
- To gain real value from ERM, organisations must stop treating it as an isolated audit function and instead integrate it directly into their corporate strategy.
- Successful risk management execution moves beyond ticking boxes and off-the-shelf frameworks, relying instead on competent leadership to manage uncertainty with integrity.
The true value of enterprise risk management (ERM) lies not in compliance checklists or audit functions, but in embedding risk thinking into strategy to improve decision-making. Yet, a glaring gap remains: many organisations claim to have ERM frameworks, but few execute them effectively.
This often stems from a fundamental misconception that ERM is about measuring or eliminating threats, rather than managing risk to support decision-making and organisational objectives. Navigating this reality requires a deep understanding of risk psychology to achieve genuine ERM maturity.
In a Tea Talk hosted by the Institute of Enterprise Risk Practitioners (IERP®) titled “Critical Red Flags to Avoid in ERM Execution”, Chairman of the Board of Governors of the IERP®, Ramesh Pillai, tackled these execution failures. Drawing from decades of practical corporate experience in risk management and governance, he highlighted nine critical warning signs that can derail ERM implementation within an organisation.
Obsessing Over Documentation Instead of Decisions
One of the quickest ways to derail ERM adoption is to emphasise documentation over decision-making. Too many organisations treat it as a formal compliance exercise, spending countless hours generating reports for regulators and boards. Rather than analysing the data to uncover key insights, teams get bogged down in administrative tasks.
After all, the obsession with templates and risk registers often distracts from the real purpose. True ERM goes beyond regulatory optics; it must be driven by core business needs. When leaders prioritise paperwork over strategic risk management, they miss critical opportunities to manage uncertainty effectively.
Replacing Existing Risk Management Frameworks
Every business already practises some form of risk management, even if informally. When risk departments dismiss these existing controls to introduce entirely new systems, that decision can alienate employees and breed resistance. Staff naturally push back when their tried-and-tested processes are invalidated by a top-down mandate.
Rather than starting from scratch, a practical ERM framework integrates the good practices already in place. There is no need to reinvent the wheel; the goal is simply to build on what already exists. Mapping current processes before introducing new risk management frameworks ensures smoother adoption and alignment.
Confusing Operational Risk Management with ERM
A frequent misunderstanding that derails an ERM framework is confusing it with Operational Risk Management (ORM). The distinction is fundamental: ERM is objective-centric, focusing on strategic outcomes and risk-return trade-offs. In contrast, ORM is taxonomy-based and designed to minimise or eliminate specific operational exposures.
When organisations mistakenly apply ORM techniques at an enterprise level, they lose their strategic perspective. Treating enterprise-wide exposures as a series of isolated operational hazards creates a major misalignment. Consequently, this approach leads to fragmented frameworks and ineffective reporting structures that fail to establish robust risk governance.
Ticking Boxes in Risk Governance with Unqualified Leaders
A major red flag in risk governance is the appointment of Chief Risk Officers (CROs) to satisfy regulatory requirements. Ticking this compliance box with an unqualified leader sets risk management frameworks up for failure. True leadership demands more than theoretical knowledge; a competent CRO must deeply understand business strategy, daily operations, and human behaviour.
Moreover, risk practitioners must operate as strategic partners rather than administrative enforcers. Here, leadership is about enabling decision-makers, not policing them. By guiding leaders instead of creating roadblocks, a qualified CRO transforms ERM frameworks into practical tools for confident decision-making.
Disconnecting ERM Frameworks from Strategy
Many ERM frameworks fail because they operate in a silo, disconnected from an organisation’s vision, mission, strategy, and objectives. For ERM to add real value, it cannot function as a standalone activity. In practice, it must cascade clearly from top-level boardroom goals down to everyday operational actions, ensuring risk considerations actively inform every business unit.
Without this clear line of sight, even the most sophisticated framework loses its purpose. Hence, alignment is not an optional extra; it is the essential link that turns ERM frameworks into a core business enabler.
Neglecting the Power of Periodic Risk Reviews
A less obvious but equally dangerous red flag is treating ERM as a static exercise rather than a dynamic discipline. When risk management frameworks are left to gather dust between annual audits, they fail to enhance decision quality. Ultimately, ERM must continuously provide leaders with structured insights and rigorous scenario analyses to navigate an ever-changing business environment.
To achieve this, businesses should embed periodic risk reviews directly into their governance cycles. This process ensures that key business assumptions are regularly tested through independent validation. At its core, ERM is not about avoiding hazards; it is about equipping leaders to make better, more informed decisions.
Forcing an Off-the-Shelf ERM Framework
When designing an ERM framework, many firms default to what they are already comfortable with rather than what is actually required. By falling into the trap of copying industry peers or purchasing generic, off-the-shelf models, businesses may box themselves into a shortcut to failure.
In reality, every organisation possesses a unique risk appetite; replicating another company’s system ignores these critical differences. To be truly effective, an ERM framework demands deep customisation. Practitioners must tailor their processes to align closely with the organisation’s specific structure, operating culture, and overall maturity level.
Blurring the First and Second Lines of Defence
A critical breakdown in accountability occurs when organisations blur the first and second lines of defence. The first line of defence consists of the business units that actively own and manage risk. Conversely, the second line provides independent oversight, challenges assumptions, and ensures compliance without stepping into operational management.
Adequate risk governance requires these roles to remain distinct. When these boundaries are crossed, the risk management framework loses its objectivity. Risk owners become reliant on oversight teams to manage their exposures, while the second line loses its ability to independently challenge decisions. To prevent this, leaders must clearly document responsibilities and ensure every employee understands their specific role.
Letting Technology Dictate the ERM Process
While technology is a powerful enabler, it should support the ERM framework and not replace human judgement. Risk systems that are misaligned with international best practices or confuse ERM with governance, risk, and compliance systems can threaten competent risk governance.
Worse, when organisations rely entirely on systems that fail to explain the logic behind their assessments, these systems will fail to support strategic risk management. They become merely another avenue for businesses to collect data.
Key Lessons For Risk Leaders
Identifying these nine red flags in executing ERM frameworks is just the first step. Fixing them requires more than redesigning a framework; it demands a fundamental shift in how an organisation approaches uncertainty. At its core, ERM is a living discipline that relies on awareness, competence, leadership, and integrity.
To translate risk management frameworks into strategic value, organisations must:
- Align risk management directly with corporate strategy and objectives
- Integrate existing practices rather than forcing unfamiliar, off-the-shelf models
- Empower competent leaders to guide decision-making rather than policing compliance
- Conduct periodic reviews to validate assumptions and test business resilience
- Use technology to support human judgement, rather than letting it dictate the process
All in all, if a company’s ERM framework is not improving every year, it is already falling behind. True ERM execution turns uncertainty into a strategic advantage. As Ramesh succinctly noted: “ERM is not about avoiding risk. It’s about understanding it and managing it with integrity.”
