One of the most difficult tasks for insurers in establishing an effective enterprise risk management (ERM) program is embedding ERM principles and practices throughout the organization. As challenging as it may be for chief risk officers and risk committees to master the key concepts and strategies of ERM, it can be even more difficult to explain them to "novice" business people in the rest of the organization.

It is critical to the success of an ERM program, however, that companies instill ERM practices at every level in the company. ERM should be a day-to-day, simmering concern within business departments, rather than just a once-a-quarter fire drill by a small core risk-management team.

Accordingly, a major phase in most ERM programs is a "roll-out" phase of training and education for functional departmental managers, business heads and staff that may be involved in identifying risks, or implementing controls. Within this training, a foundational agenda item is often a session explaining what ERM is, and how it differs from what staff may be used to as traditional or historical compliance, internal audit, or risk management efforts.