For the past year, the Covid-19 pandemic has been redefining how companies manage risk. The rapidly changing business environment has led to ever-increasing risk velocities. Companies' exposures are in flux, and new risks are emerging more and more frequently. In this environment, traditional organizational structures—with risk specialists in one department, compliance in another, and silos of additional risk professionals spread across different lines of business—have proven ineffective.

As a result, the Committee of Sponsoring Organizations of the Treadway Commission (COSO), a highly influential risk management thought leadership organization, recently issued guidance for companies to create closer links between compliance departments and risk managers who focus on an array of corporate hazards. This underscores the widespread need for companies to unsilo risk functions and create an enterprise risk management (ERM) program.

Although not a new concept, integrated ERM represents a significant improvement over more common, fragmented approaches to risk management. The fundamental purposes of an enterprise risk management program are to:

• Bring together risk management and business strategy functions to establish a healthy, corporate-level perspective on the organization's risk appetite.
• Integrate all areas of organizational exposures to market opportunities (innovation, technology, competition, supply and demand, etc.) and risks (financial, operational, reporting, compliance, etc.).
• Prioritize and manage those exposures as an interrelated strategy and risk portfolio rather than as individual risk "silos."
• Evaluate corporate strategy and the company's risk portfolio in the context of all significant internal and external environments, systems, circumstances, and stakeholders.
• Recognize that individual risks across the organization are interrelated and can fit into a view of aggregated exposures companywide, which may differ significantly from the sum of the individual risks.
• Provide a structured process for managing all risks, whether those risks are primarily quantitative or qualitative in nature.
• View the effective management of risk as a competitive advantage.
• Embed risk management as a component in all critical decisions throughout the organization.

There are three primary reasons why this approach to risk management is particularly well-suited to the rapidly evolving current environment.