Charta is on Google Play: practise on the go. Get the app
Charta

Explain what Enterprise Risk Management (ERM) is and how an ERM program differs from the silo-based approach to risk management traditionally followed.

FRM® Part I · Foundations of Risk Management · Enterprise Risk Management and Future Trends · FRM1.FR.8.a

The idea

Enterprise risk management is a firm-wide framework for identifying, measuring, aggregating and managing all the material risks the firm faces, judged against its strategy and its stated risk appetite, with oversight at board and senior-management level. The traditional silo approach lets each business unit or risk type (market, credit, operational, liquidity) run its own tools, limits and reports, so nobody sees the combined position or how risks interact. ERM adds a common risk language, a consistent aggregated view that allows for dependence between risks, central oversight such as a chief risk officer, and links between risk-taking, capital allocation and strategy. A frequent mistake is to treat ERM as a hedging program, or as a central department that replaces business-unit risk ownership. It does not: units still own their risks. The exam contrast is integrated and aggregated versus fragmented and unit-by-unit.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which feature is most typical of the traditional silo approach to risk management?

  1. A single senior committee sets one aggregated risk limit for the whole firm and allocates it to the units.Why not: Describes an ERM feature: centralised, aggregated limits.
  2. A common risk taxonomy and language is used by every business line, with consistent definitions.Why not: A shared risk language is an ERM best practice, the opposite of silos.
  3. Risk is reported only to the board and never to business-unit managers.Why not: Invents a reporting rule; the silo problem is fragmentation, not who receives reports.
  4. Each unit or risk type is managed on its own, with little aggregation. - correct

In silos, risks are handled by separate functions without a consolidated view, so interactions between risks and the total exposure to a single driver go unseen.

A harder one

A bank's credit-risk team measures its derivative counterparty exposures with one model, while the market-risk team hedges the same trades using a different model, and no one reports the combined position. Which benefit of moving to ERM does this case most directly illustrate?

  1. One firm-wide view of the combined exposure, with market and credit risk managed together. - correct
  2. Regulatory capital requirements would fall automatically because the two models would be merged into one framework.Why not: Nothing guarantees lower capital; ERM improves information and decisions, it does not mechanically cut requirements.
  3. Business-unit risk managers would no longer be needed because the CRO would manage all risks.Why not: ERM does not remove unit-level risk ownership; the units remain the first line that owns their risks.
  4. Diversification benefits would be guaranteed, so that firm-wide risk is always below the stand-alone risk measures added together.Why not: Diversification depends on dependence between risks and can vanish in stress; ERM does not guarantee it.

The weakness is fragmentation: two functions see parts of one exposure. ERM supplies a common view and aggregation, which is its core contrast with silos.

The hardest tier

A firm's silo-based reports show a market-risk VaR of USD 30 million and a credit-risk VaR of USD 40 million, both at the same confidence level and horizon. Risk management wants a firm-wide figure for the board and assumes the two losses are jointly normal with zero means and a correlation of 0.5. The firm-wide VaR is closest to:

  1. USD 60.8 million - correct
  2. USD 70.0 millionWhy not: Simple addition of the two silo VaRs, which assumes perfect correlation and ignores the dependence between risks.
  3. USD 50.0 millionWhy not: Aggregates with zero correlation, ignoring the stated correlation of 0.5.
  4. USD 55.7 millionWhy not: Leaves the factor 2 out of the covariance term: sqrt(30² + 40² + rho x 30 x 40).

With zero-mean, jointly normal losses and the same confidence level, VaR is proportional to standard deviation, so aggregate VaR = sqrt(30² + 40² + 2 x 0.5 x 30 x 40) = sqrt(900 + 1,600 + 1,200) = sqrt(3,700) = 60.8. Simple addition overstates total risk when correlation is below one; ERM aggregation must reflect dependence.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Enterprise Risk Management and Future Trends