Enterprise risk management
Connect risk to an objective, assess likelihood and impact, choose a response and monitor residual exposure. Expected loss can support the comparison, but it does not capture every severe outcome, dependency or legal constraint.
Evaluate the response and the residual risk
- Expected loss
- Probability × impact for one loss event.
- Cost with a control
- Control cost + expected residual loss.
- Decision check
- Compare the costs, then test risk limits and severe-loss scenarios.
The lowest expected cost is not sufficient when a loss exceeds the organization’s capacity or mandatory requirements.
See the decision
Compare a prevention control on a common basis
A modeled annual disruption has 10% probability and $200,000 loss. A $7,000 annual control reduces probability to 3% without changing severity. Assume only this exposure and no other benefits.
USD expected annual cost including control
- No control$20,000
- With control$13,000
The control lowers modeled expected annual cost by $7,000. A $200,000 loss is still possible; assess whether that residual exposure is acceptable.
How to apply these ideas
1. Define the exposure
Describe cause, event and effect on an objective.
“Cyber risk” is a category, not an actionable scenario. Describe the process, the possible event and the operational or financial consequence. Assign an owner who can influence the response and specify the time horizon.
Watch for: Listing broad risk labels without an affected objective.
2. Assess uncertainty
Use probability and impact with explicit assumptions.
Expected loss is probability times loss for a simple one-event model. More complex exposures need multiple scenarios and dependencies. A low-frequency, high-impact loss may remain unacceptable even when its average is small.
Watch for: Treating expected loss as the worst case or a guaranteed bill.
3. Choose a response
Compare avoidance, reduction, sharing and acceptance.
Risk sharing such as insurance can leave deductibles, exclusions and operational disruption. Compare the cost of a response with residual exposure and risk appetite. Some risks require action even without a favorable short-run expected-value calculation.
Watch for: Calling insured risk completely eliminated.
4. Monitor residual risk
Set a trigger, owner and response time.
A useful indicator changes a decision when it crosses a threshold. Monitor whether the control or insurance still fits the exposure and whether risks are becoming correlated. Escalate exceptions instead of merely updating a colored heat map.
Watch for: Confusing a green rating with proof the risk is controlled.
Study the topic
Enterprise risk management: explanations and applications
Connect enterprise objectives to risk identification, assessment, response and monitoring. Expected loss is one input; severity, dependencies and risk tolerance can change the decision.
By MiloPrep editorial team. Original teaching explanations and illustrative cases; official curriculum references are listed below.
Define the objective and the event that could disrupt it
A risk statement should connect a cause, an event and a consequence for an objective. “Supplier risk” is too vague to guide action. “A regional flood interrupts both qualified suppliers, stopping production after two weeks of usable inventory” identifies the common cause, exposure and timing. The operational owner can then evaluate alternatives.
Include strategic, operating, financial, reporting and compliance exposures where relevant. Classifications help organize the register, but the same event can affect several objectives. A cyber incident can interrupt operations, expose confidential data and damage reporting reliability. Assess the combined consequences rather than allocating the event to a single box and forgetting the rest.
Separate inherent risk from residual risk
Inherent risk is the exposure before the response being evaluated; residual risk remains after controls or other responses. Estimate likelihood and impact for a defined period and scenario. State whether an impact is gross loss, net cash loss, downtime or another measure. Multiplying ordinal labels such as “3 × 4” produces a prioritization score, not a dollar expected loss.
Expected loss equals probability multiplied by loss for a simple single-event model. With multiple mutually exclusive outcomes, sum the probability-weighted losses. This mean does not describe the maximum loss or the funding needed in a severe event. A company can prefer a response that costs more on average because the untreated tail event threatens survival or violates a legal obligation.
| Dimension | Question | Why it changes the decision |
|---|---|---|
| Likelihood | Over what horizon and based on what evidence? | Annual and five-year probabilities are not interchangeable |
| Impact | Cash, safety, downtime or reputation? | Different dimensions may require separate limits |
| Velocity | How quickly does damage occur? | Determines the response time available |
| Dependency | Can one cause trigger several losses? | Standalone estimates may understate combined exposure |
| Residual exposure | What remains after the response? | A control rarely removes every failure path |
Compare avoidance, reduction, sharing and acceptance
Avoidance ends or changes the activity that creates the exposure. Reduction changes likelihood or severity through prevention, detection or resilience. Sharing transfers some economic consequence through insurance, contracts or partnerships. Acceptance retains the exposure deliberately when it is within authorized tolerance. The labels are alternatives to evaluate, not a sequence that every risk must follow.
Insurance can cap some cash losses while leaving deductibles, exclusions, downtime and reputational effects. A hedge can reduce a specified market exposure while introducing basis, counterparty or liquidity risk. Read the response’s mechanism and limitations before calling the risk transferred. A contract does not ensure that the counterparty can perform during the same stress event.
Look for common causes and risk interactions
Two suppliers in the same region may provide less resilience than their number suggests. A recession can weaken customer collections at the same time that a lender reduces available credit. Examine scenarios in which exposures move together, and test whether the proposed response creates another concentration.
Sensitivity analysis changes one assumption to identify a driver. Scenario analysis changes a coherent set of assumptions. Stress testing examines severe conditions and the point at which an objective or limit fails. These tools complement historical data when rare events or structural changes make a precise probability estimate unreliable.
Turn the register into an owned response with a trigger
Assign an owner who can act, define the response, set a completion date and identify evidence of operation. A key risk indicator should provide useful warning, such as inventory coverage falling below replacement lead time. A key performance indicator may describe past outcomes, such as last month’s on-time delivery. Both can be useful, but they serve different monitoring purposes.
Set thresholds and escalation paths before a crisis. Compare residual exposure with authorized appetite or tolerance and review exceptions at the appropriate governance level. Update the assessment after business changes, near misses and control failures. A register that is reviewed only to change its date provides little evidence that risks are managed.
Work it through
Worked example: Compare a prevention control on a common basis
A modeled annual disruption has 10% probability and $200,000 loss. A $7,000 annual control reduces probability to 3% without changing severity. Assume only this exposure and no other benefits.
| Alternative | Expected loss | Control cost | Total modeled cost |
|---|---|---|---|
| No control | $20,000 | $0 | $20,000 |
| Control | $6,000 | $7,000 | $13,000 |
- 1
Without control: 0.10 × 200,000 = $20,000 expected loss.
- 2
With control: 0.03 × 200,000 + 7,000 = $13,000. Expected net benefit = $7,000.
The control lowers modeled expected annual cost by $7,000. A $200,000 loss is still possible; assess whether that residual exposure is acceptable.
Work through the alternatives
More worked cases: enterprise risk management
Original teaching scenarios. Each case states its assumptions, shows the working and explains the limits of the conclusion.
A lower expected cost still leaves a severe event
A 4% annual event would cause $500,000 loss. A $9,000 annual prevention program reduces probability to 1% without changing severity. Ignore other outcomes and benefits.
| Alternative | Expected event loss | Response cost | Expected total |
|---|---|---|---|
| No program | $20,000 | $0 | $20,000 |
| Prevention | $5,000 | $9,000 | $14,000 |
- Expected savings before program cost = (4% - 1%) × 500,000 = $15,000.
- Net modeled benefit = 15,000 - 9,000 = $6,000. The residual loss, if the event occurs, is still $500,000.
What the result means: The program lowers expected cost, but management must also assess whether it can withstand the residual event.
A risk indicator that creates time to act
A factory holds 21 days of usable stock. Qualifying an independent supplier takes 35 days and transport then takes seven days. Current suppliers share one flood zone; assume normal consumption and no immediate substitute.
| Measure | Days |
|---|---|
| Stock coverage | 21 |
| Replacement preparation and transport | 42 |
| Unprotected timing gap | 21 |
- The replacement route takes 35 + 7 = 42 days. Current coverage is only 21 days.
- Begin qualification before disruption, assess buffers and alternatives, and assign a trigger based on coverage relative to replacement lead time.
What the result means: Counting two suppliers is not enough. The common location and 21-day timing gap define the continuity problem.
Practice this topic
Check your understanding
Try each short application before opening its explanation. These are original learning checks, not official exam questions or a score prediction.
1. A heat map assigns likelihood 4 and impact 5. Does the product of 20 mean an expected loss of $20,000?
Show answer and explanation
No.
Ordinal scores prioritize under a defined scoring system. Dollar expected loss requires a probability and a monetary loss model.
2. Insurance covers property damage but excludes lost sales. Has the whole disruption risk been transferred?
Show answer and explanation
No.
Lost sales, waiting periods, deductibles and other consequences may remain. Assess the residual exposure against the actual policy terms.
3. Why test a low-probability scenario that has an unfavorable expected cost of mitigation?
Show answer and explanation
Because expected cost alone may not capture the organization’s survival, compliance or tolerance constraints.
A response can be necessary even when its narrow average financial payoff is negative.
Questions about enterprise risk management
- Why is a risk heat map insufficient?
- Ordinal likelihood and impact categories do not quantify every exposure or capture dependencies. Use the map to organize discussion, then investigate material scenarios and responses.
- What is residual risk?
- The exposure remaining after the response. It can persist because controls fail, insurance has exclusions, or the response reduces only part of the loss.
Sources and scope
Curriculum mapping: Part 2, Section D, Enterprise Risk Management. The official outline assigns 10% to the entire domain, not to this individual technique. These are selected study notes, not complete curriculum coverage.
Official curriculum references establish scope and expected skills. The explanations, diagrams and numerical cases are independent teaching material from MiloPrep, not official questions or source-validated solutions. Curriculum references checked 2026-10-10.
- IMA Content Specification Outlines (effective September 2024) ↗
Supports: Part 2, Section D, beginning on printed page 12. Domain names, weights and curriculum boundaries.
- IMA Learning Outcome Statements (effective September 2024) ↗
Supports: Part 2, Section D, beginning on printed page 25. The calculations, analysis and professional judgments candidates are expected to perform.
Independent US CMA study material. Not affiliated with or endorsed by IMA. This covers management accounting, not medical-assistant certification or the separate ICMAI qualification.