Enterprise risk management (ERM) has recently emerged as a widespread practice in financial
institutions. It has been increasingly codified and encrypted into regulatory, corporate
governance and organisational management blueprints. A burgeoning literature of regulatory
and practitioner texts is indicative of the apparent diversity of ambitions, objectives and
techniques that constitute the ERM agenda. Making sense of these developments is a
challenge. Presenting field-based evidence from two large banking organisations, this paper
argues for the existence of systematic variations in ERM practices in the financial services
industry. The cases illustrate four risk management ideal types and show how they form the
‘risk management mix’ in a given organisation. The paper attempts to explain the differences
in the two risk management mixes pointing towards firm-specific and institutional pressures.
The latter suggest that the cases are likely to be reminiscent of ERM practices in other
financial services organisations, and are thus indicative of the current co-existence of
alternative models of ERM. In particular, two types of ERM models are postulated: one
driven by a strong shareholder value imperative (‘value-based’ ERM), the other
corresponding to the demands of the risk-based internal control imperative (‘strategic’ ERM)