Which statement about enterprise risk management (ERM) is true?

Which statement about enterprise risk management (ERM) is true?

• A. The ERM framework encompasses all stakeholders in the organization.
• B. ERM is concerned with pure risk, primarily hazard risk.
• C. In ERM, the risk management function is the responsibility of the safety manager.
• D. ERM requires less communication than traditional risk management.

Answer: (A)

Enterprise risk management is an integrated, organization-wide approach to identifying, assessing, and managing all types of risk in a way that aligns with the organization’s strategy. It involves input and consideration from multiple stakeholders—such as owners, employees, customers, suppliers, regulators, and the community—as risk governance, risk culture, and risk reporting require broad engagement and transparency. Because of this, ERM covers not just hazard risk but strategic, financial, operational, compliance, and reputational risks, all viewed as an interconnected portfolio rather than isolated hazards. The risk function isn’t owned by one person or department; it’s a governance process shared across leadership and many parts of the organization, with ongoing communication to the board and other stakeholders. That’s why the statement about encompassing all stakeholders is true, while the other choices misstate ERM’s scope, ownership, and communication requirements.

Enterprise risk management is an integrated, organization-wide approach to identifying, assessing, and managing all types of risk in a way that aligns with the organization’s strategy. It involves input and consideration from multiple stakeholders—such as owners, employees, customers, suppliers, regulators, and the community—as risk governance, risk culture, and risk reporting require broad engagement and transparency. Because of this, ERM covers not just hazard risk but strategic, financial, operational, compliance, and reputational risks, all viewed as an interconnected portfolio rather than isolated hazards.

The risk function isn’t owned by one person or department; it’s a governance process shared across leadership and many parts of the organization, with ongoing communication to the board and other stakeholders. That’s why the statement about encompassing all stakeholders is true, while the other choices misstate ERM’s scope, ownership, and communication requirements.