What is Enterprise Risk Management (ERM)?

Enterprise Risk Management is a structured, organisation-wide approach to identifying, assessing, and managing risks that could affect an organisation's ability to achieve its objectives. The COSO framework, published in 2017, provides the most widely used model and applies across organisation types and sizes.

Does a small business need ERM?

Yes, and arguably more urgently than a large one. Small businesses carry concentrated exposure: fewer clients, narrower revenue streams, and less financial buffer to absorb unexpected losses. ERM scaled appropriately to the organisation's size and resources addresses these concentrations before they produce existential threats.

What is the COSO framework?

The COSO ERM framework is a set of principles published by the Committee of Sponsoring Organisations of the Treadway Commission. The 2017 update organises ERM around five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting.

How long does it take to implement basic ERM?

A basic but functional ERM process for a small organisation can be designed and documented in approximately two full working days of structured leadership time. The ongoing maintenance requires a monthly fifteen to twenty-minute review and an annual deeper assessment of the risk register and controls.

What Enterprise Risk Management Actually Does for Small Organisations

ERM is not a large-company luxury. For smaller organisations, it may be more urgent, not less.

Enterprise Risk Management tends to arrive in professional conversations wrapped in the language of multinationals: board committees, chief risk officers, three-lines-of-defence models, and software platforms that cost more annually than many small businesses earn. The framework's vocabulary signals scale, and smaller organisations read that signal correctly and conclude the discipline is not for them. This is a category error with real financial consequences.

The need for structured risk management does not shrink with the organisation's size. If anything, it intensifies. A firm with four hundred employees and twelve major clients can absorb the loss of one client. A firm with eight employees and three major clients cannot absorb the same proportional loss with the same ease. Concentration of exposure is a small-organisation reality, and it is precisely what ERM is designed to identify and address.

What ERM Means in Practice, for Organisations That Are Not Multinationals

The Committee of Sponsoring Organisations of the Treadway Commission, known as COSO, published an updated Enterprise Risk Management framework in 2017 that explicitly addressed scalability. The framework describes ERM as a set of capabilities that link strategy, performance, and risk at the governance level. COSO did not design this as a compliance exercise for regulated industries. They designed it as a decision-making architecture that any organisation can apply at appropriate depth.

For a small professional services firm, appropriate depth might mean four things: an annual process to identify which categories of risk the firm faces, a decision about how much of each category is acceptable, a set of controls matched to the risks that exceed that threshold, and a review mechanism to check whether those controls are working. This does not require a dedicated risk function. It requires roughly two days of structured executive attention per year, plus a monthly fifteen-minute review embedded in an existing leadership meeting.

The benefit is not primarily about avoiding bad outcomes, though that matters. The more immediate benefit is decision quality. When a small business owner who has documented their risk appetite receives a proposal to enter a new market, they have a reference point for evaluating that decision. Without that reference, the evaluation depends entirely on how the proposal is framed, how the business owner feels on the day they read it, and whatever cognitive biases happen to be most active in that moment.

"ERM, properly adapted, is not a reporting burden for small businesses. It is a thinking discipline. It forces you to articulate what you are trying to achieve and then seriously examine what stands between you and that achievement." — Salihah Budall, MSc., CFS, CRMP, CSSYB

The COSO Components That Matter Most at Small Scale

COSO's 2017 framework organises ERM around five interrelated components: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication, and Reporting. All five matter. But for organisations building a risk management capability from scratch, the sequencing of emphasis is important.

Governance and Culture is where small organisations should spend the most time first, because without clear ownership of risk management responsibilities, every subsequent step produces documentation that nobody uses. In practical terms, this means designating a person, even a part-time person, who is responsible for maintaining the risk register and convening the periodic reviews. It means ensuring that the most senior decision-maker in the organisation visibly participates in risk discussions, because culture in small organisations flows from leadership behaviour more directly than in large ones.

Strategy and Objective-Setting is where the substantive intellectual work happens. Before you can assess risks, you need documented objectives. Many small businesses operate with objectives that exist as shared assumptions rather than written commitments. The exercise of writing them down typically produces a revealing conversation about what the business is actually trying to achieve, as distinct from what it is currently doing. These are not always the same, and the gap between them often contains the organisation's most significant undocumented risks.

Performance, in the COSO framework, refers to the identification, assessment, and prioritisation of risks relative to risk appetite, and the development of risk responses. For small businesses, this is the component most likely to be over-complicated by practitioners trained in large organisations. A simple risk matrix with five probability categories and five impact categories, calibrated to the organisation's actual financial thresholds, is sufficient for most small businesses. The important discipline is that the matrix is completed rigorously, not that it is methodologically sophisticated.

Where Small Organisations Stall

The two most common failure points in small-organisation ERM implementation are both behavioural rather than technical. The first is treating the initial risk register as complete. Risk identification is an iterative process that should be revisited at least quarterly, because the operating environment changes and so does the relevance of individual risks. An organisation that produces a risk register in January and considers the task complete has done a useful exercise once and then lost most of its value by treating a living document as a finished product.

The second failure point is the absence of a feedback mechanism between risk management activity and operational decision-making. The risk register needs to be consulted, not just updated. When the organisation is evaluating a new supplier, the relevant risks from the register should be in the room. When a budget decision is being made that will reduce staff capacity, the control activities that depend on that capacity should be explicitly acknowledged. Without this loop, ERM becomes an administrative activity running parallel to the real business rather than an embedded part of how decisions are made.

"A risk register that is not consulted is a filing exercise. The test of whether ERM is working in a small organisation is simple: when was the last time a decision was changed because of what the risk register said?" — Salihah Budall, MSc., CFS, CRMP, CSSYB

Regulatory Pressure Is Increasing for Smaller Entities

Regulatory bodies across financial services, healthcare, food safety, and environmental management have progressively extended their expectations about documented risk management to smaller licensed entities. The Financial Action Task Force's Recommendations, which underpin anti-money laundering regimes in over 200 jurisdictions, require risk-based approaches from businesses that handle financial transactions, regardless of size. ISO 9001:2015, the quality management standard used by hundreds of thousands of organisations globally, explicitly requires risk-based thinking as a foundational element of a compliant quality management system.

These are not soft suggestions. An organisation under regulatory review that cannot demonstrate a structured risk management process faces a qualitatively different level of scrutiny than one that can produce a documented risk register, evidence of regular review, and clear records of risk-based decisions. The documentation discipline that ERM requires is also the evidence base that demonstrates regulatory compliance across multiple frameworks simultaneously.

The Case for Starting Before You Feel Ready

Small organisations typically delay implementing structured risk management because they are waiting for a quieter period, a larger team, or a clearer sense of what the process should look like. None of these conditions materialise on schedule. The quieter period does not arrive; the team does not grow in the direction of risk capability without intentional investment; and the clearest possible sense of what the process should look like comes from doing it badly once and improving it, not from planning it perfectly in advance.

A functional ERM process implemented at 60% of theoretical best practice in the first year, reviewed and improved at year two, is worth significantly more than a perfectly designed process that has not started. The value of the discipline accumulates from use, not from design quality alone.