An enterprise risk management system is the set of policies, roles, processes and tools an organisation uses to identify, assess, treat and monitor all of its risks against the same criteria, and to connect them to its strategy. It is usually known as ERM (Enterprise Risk Management). The word that matters is "all": financial, operational, technology, third-party and compliance risks go into the same register and are measured with the same yardstick.
Many companies have the opposite: each department keeps its own list in its own spreadsheet. Security scores from 1 to 5, Finance in euros and Compliance with colours. Each list makes sense on its own, but nobody can answer the question the board asks: what are the company's ten most serious risks, and are they within what we are prepared to accept?
The building blocks of an enterprise risk management system
There is no single model, but every system that works has these pieces, and when one fails it is usually because a piece is missing:
- Governance and risk appetite. Who decides which risk is acceptable and where that line sits. Without a risk appetite approved by senior management, the system measures but does not help anyone decide.
- Taxonomy. The categories each risk is classified into, so the same problem has the same name in every department. We cover this in risk taxonomy.
- A common methodology. The same likelihood and impact scales for everyone, and the same risk matrix to plot the results.
- A register with owners. Each risk assigned to a named person, not to a department.
- Controls and indicators. What is done to reduce each risk and how you find out in time that it is getting worse, using key risk indicators (KRIs).
- Reporting to management. A regular report that compares inherent and residual risk and says what has changed since last time.
ISO 31000 or COSO ERM: which one to use as a reference
Almost every system is built on one of these two frameworks. Neither is certifiable and neither is mandatory in itself: they are guidance. What differs is the approach.
| ISO 31000:2018 | COSO ERM (2017) | |
|---|---|---|
| What it is | An international standard with guidelines for managing any type of risk. | The Committee of Sponsoring Organizations framework, Enterprise Risk Management: Integrating with Strategy and Performance. |
| How it is structured | Principles, framework and process. | Five components and twenty principles. |
| Main strength | A clear process that is easy to roll out across every department. | Linking risk to strategy and performance. |
| Where it is used most | Companies of any size and sector, often alongside other ISO standards. | Listed groups and financial services, close to internal control. |
Our recommendation: if you already work with ISO standards (27001, 22301, 37301), start from ISO 31000, because you will share vocabulary and structure. If the system is being requested by the board or the audit committee and the priority is to tie risk to business objectives, COSO ERM is a better fit. They are not mutually exclusive: many organisations use the ISO 31000 process with COSO's governance language.
What regulation requires in Spain
For most companies the system is voluntary, but in some cases it is required:
- Listed companies. The CNMV Good Governance Code recommends a risk control and management policy that covers financial and non-financial risks and sets the acceptable level of risk (Recommendation 45), and an internal risk control and management function supervised by the audit committee (Recommendation 46). It applies on a "comply or explain" basis.
- Insurers. Article 44 of the Solvency II Directive requires an effective risk management system.
- Financial entities. The DORA Regulation requires an ICT risk management framework (Article 6), which has to fit within the overall risk management system.
How to implement it, step by step
- Agree on appetite and governance. Who owns the system, which committee reviews it and how often, and what level of risk is acceptable.
- Define the taxonomy and methodology. Categories, scales with concrete definitions and the matrix. This is the step that generates the most debate and saves the most time later.
- Build the first map with the main risks. Start with the twenty or thirty risks that genuinely worry senior management, not with an inventory of four hundred.
- Assign controls, owners and indicators. Every risk above appetite needs a plan with an owner and a deadline.
- Report and repeat. A regular report to management and a review that starts from what has changed.
The mistake we see most often is starting at step three: a big workshop to list risks before anyone has agreed on the scale. The result is a huge register that nobody can compare and that gets abandoned by the second review.
Spreadsheet or risk management tool
A small system can start in Excel, and our risk matrix template is there for that. The trouble starts when several departments fill in the register: conflicting versions appear, everyone reads the scales their own way and the consolidated report has to be put together by hand before every committee meeting.
That is the moment to move to enterprise risk management software. In GlobalSuite® Risk Management the methodology comes preloaded (ISO 31000, COSO ERM or your own), every department assesses its risks on the same scale, and the heat map, KRIs and management report are generated automatically, with Monte Carlo simulation if you want to quantify risk in euros.
Want to see what your risk management system could look like? We will show you with a case similar to yours.
Request a demoContent reviewed in October 2026.
