These days, most forward-thinking finance executives would concede that risk can no longer be assessed department by department or under the arbitrary coverage categories offered by insurers. Risks cut across business units and entire organizations. One event can often trigger simultaneous crises, and while much of the insurance industry may insist on discussing trends in terms of single-year contracts and specific areas of exposure, corporate executives in charge of risk management are starting to construct integrated risk profiles for their companies that involve far longer time horizons and buckets of risk. Conceptually, enterprise risk management (ERM) has finally arrived, even though it may be called by many other names.

Although the term has been kicked around for years in finance circles, the ERM approach retained a certain academic quality until the 21st century arrived, bringing with it the specter of more cataclysmic and systemic risks than have been faced in decades–and sky-high insurance premiums and substantial pressure on companies to retain risk. The hard market and tough times forced companies to see the bigger picture. "The science of risk management is making giant leaps forward," says John F. Ryan, senior vice president at ESIS Marketing and ACE USA's regional operations. "Risk management is not a product. It's not an organization. It's a process, and companies are stepping up with new ideas."

Nonetheless, while everyone's thinking may have caught up with the concept, if only out of necessity, the tools provided to harried CFOs and treasurers have not. "When you look at risk holistically, you must measure it," says Susan Skerritt, a partner at Treasury Strategies Inc. in New York. "But the system to measure it doesn't exist."