Risk Decision Making

The third step in the Enterprise Risk Management (ERM) process cycle, risk decision making, is the pinnacle of the value-based ERM approach. This chapter discusses two major categories of risk decision making: defining risk appetite and risk limits and integrating ERM into decision making. The first step in risk decision making is to define risk appetite and risk limits. The ERM infused decision-making protocol is agnostic as to the initiating driver behind a proposed decision. It uses a single standard for evaluating any decision: whether or not it increases company value. Risk culture–the way in which ERM is embraced by company employees–is measured by the extent to which ERM is integrated into key internal company processes. By integrating ERM information into the internal audit process, the internal audit plan can be prioritized to focus more resources on the key risks, which are those with the largest potential impact on company value. The internal audit team elevates their focus to items of more strategic importance to the firm. This is valuable, because the company benefits through more efficient prioritization of risk mitigation resources.