Many observers, commenting on the development of risk management in financial
institutions, highlight the increasing spread and codification of risk practices under the fashionable
term Enterprise Risk Management (ERM). International bank capital regulation and corporate
governance are two areas where the prominence of ERM is observable. So much so, that Power
(2003a) wonders if ERM might be emerging as a ‘world model’: ‘If we were to imagine the
creation of a new banking organization, we know that it could not be founded without rapidly
adopting the mission and principles of ERM…’3
In particular, ERM is being prescribed by the new international bank capital regulatory
framework (Basel II). The Basel Committee, leading the reform of banking supervision, endorses
enterprise risk management as an umbrella notion that can accommodate the techniques required
for bank capital adequacy calculation: ‘…integrated firm-wide approaches to risk management
should continue to be strongly encouraged by the regulatory and supervisory community.’
4
ERM is also encrypted in corporate governance texts, prescribed as best practice by
landmark reports from the North American Treadway Commission and the UK Turnbull
Committee. Europe is likely to follow, with Germany already in tow with the Control and
Transparency Act (KonTraG).
Still, enterprise risk management remains a rather elusive and under-specified concept. Its
broad definition (e.g. COSO (Treadway Commission), 2003) is an umbrella to diverse risk
management techniques and arrangements, so long as they create the image of consistent and
comprehensive application. Just like Lam (1999) and Gilbert (2004), ERM advocates typically
outline a set of risk management tasks and envision a ‘framework’ for the treatment of these under
the auspices of an appointed senior risk officer. This requires the prioritisation and the ordering of
the various elements into a control cycle (as described by corporate governance advocates and
regulators) with recognisable structural and personnel arrangements.
Making sense of these developments is a challenge. What follows is an attempt at
‘unbundling’ enterprise risk management. Having studied a number of normative and technical
texts I propose the outlines of four ideal types of risk management, all of which qualify as
‘enterprise-wide’, but vary in terms of their focus and purpose.