Risk can be created by any event or outcome that has the potential to interfere with an agency’s ability to achieve its mission on time.
Enterprise Risk Management (ERM) is the discipline and its associated processes of applying a risk evaluation to each agency goal, identifying root causes of these risks, determining—as an enterprise—what changes (i.e., risk treatments) are best to address the root causes, and then monitoring the success of the risk treatments. Treatments can include:
For example, insurance transfers the possible cost of risk to the insurance company. An early resolution program minimizes the cost of negligence by resolving claims before they become lawsuits. Changing a policy and procedure so that employees know what to do in certain situations can prevent negative outcomes. Abandoning an activity that had resulted in injury eliminates the risk posed by the activity.
When you have completed steps 1 through 6 you have started the ERM process