How can ERM measure and communicate its performance and impact to senior management and the board?

Set clear ERM goals and metrics aligned with the organization's vision and strategy. Goals may include reducing losses, increasing resilience, enhancing reputation, and supporting innovation.

In order to effectively communicate ERM performance, we need to align its goals with the organisation's strategic objectives. First of all we set metrics that resonate with senior management and the board, such as reducing operational losses, improving risk-adjusted returns, or enhancing organisational agility. For example, a key metric might be reducing credit risk exposure by a defined percentage. We align these metrics with performance indicators like growth in lending portfolios while keeping default rates low. By tying ERM results to business outcomes, we make the value of risk management tangible to leadership.

Enterprise Risk is a corporate responsibility and owned by each corporate executive. The execution of the program can and should be within a specific organization responsible for program management. Lastly, the program should not be viewed as punitive and should work in collaboration with the internal controls component.

Organisations must avoid individuals ‘marking their own homework’. The three lines of defence model is useful here. The identification, measurement and management of risk should be subject to independent review, typically by Internal Audit. Likewise control self assessments should be subject to independent review, and should ideally be separate from the risk function.

If you're using metrics - as one should - to communicate cyber risk managment status and gains, you need to choose metrics that your audience understands. For instance, board members and non-technical executives aren't going to understand, in a tangible way, what it means if the average time to threat detection has been reduced. Metrics and goals need to be communicable. For cyber ERM it typically means using event likelihood and financial exposure. Most stakeholders understand probability and money very well.

In this case we gather both quantitative data (e.g., risk tolerance breaches, incident frequency) and qualitative insights (e.g., stakeholder feedback, risk culture assessments) to showcase ERM’s impact. For example, in banking, track the number of successful stress tests or reduced non-performing loans. We normalise this data for context—showing trends over time or comparing against industry benchmarks—and present it in concise dashboards to highlight key risk areas, mitigated threats, and opportunities leveraged. Data storytelling should focus on the relevance of these outcomes to strategic goals.

Risk Management is not a zero sum game. The board should be aware of the risks and solutions that buy down Risk to an acceptable manageable level. In addition to buying down the risks, the internal controls component in tandem should have strategy for monitoring to controls.

Avoid manual data collection when possible. In cyber ERM, it's much better to use platforms and assessments that offer integration opportunities and come equipped with the necessary external data. Effective cyber risk management directly depends on the accuracy of your data, so when relying on subjective sources, your subsequent strategies may miss the mark. Conversely, when harnessing a single source, initiatives are significantly more likely to target the risks most likely to affect the business mission.

This encompasses a wide array of quantitative and qualitative data, including risk indicators, response levels, incidents, opportunities, stakeholder feedback, and more. The data must undergo rigorous verification, validation, normalization, interpretation, and contextualization to guarantee precision and emphasize significant findings. Through this detailed analysis, organizations can gain a deeper understanding of the implications of their ERM practices.

Reporting the results of your risk managment strategy should be done on a quarterly basis and - most importantly- should be delivered in a language your board members and other key stakeholders understand. For the CFO, this is typically straightforward, but for the CISO or respective cybersecurity leader, this requires that technical cyber risk metrics be translated into those broader business terms that can resonate with your audience. With cyber risk quantification, CISOs can ensure that the results of their hard efforts tangibly mean something to the budget and decision-makers. Reporting is not just about presenting the metrics that have improved; it's more about the metrics that demonstrate a contribution to overall business growth.

Agree, at a minimum quarterly meetings should be held with boars and key corporate executives to evaluate and discuss prior reported risks, and emergent risks that require mitigation strategies to buy downbthe risks to a corporate wide risk tolerance level. Executive dashboards are good for at a glance review, but sometime lack context, thus requirement for group meeting is essential.

Risk Management should a measurable element in each corporate executive performance plan to include CEO, - thus a corporate responsibility and ownership of the program.

In cybersecurity, it's important to listen to what stakeholders tell you after reporting your key metrics. I once worked with a CISO who, even after adopting the more 'business-friendly' NIST cybersecurity framework, found his board members still didn't understand how his progress contributed to the overall business success. In response, he looked for an alternative solution, which ended up being cyber risk quantification that could translate complex cybersecurity metrics into financial exposure terms. Once these key stakeholders could tangibly grasp the benefits of cybersecurity initiatives, they were motivated to allocate more budget and resources. The point: Don't get frustrated. Listen. Adapt. Report metrics that resonate.

Too often risk management is seen as a ‘cost centre’ or an activity that does not add commercial value. That perception is wrong and should be challenged. Good risk management keeps organisations safe and helps ensure success by mitigating the effects of risks when they crystallise.

ERM within the cyber realm should be an ongoing process, as the cyber risk landscape changes nearly daily. Processes and risk mitigation strategies, therefore, need to be continuously updated and improved. This rapid evolution calls for on-demand CRQ assessments that can run quantification at will. Factoring in any new changes to the organization - both externally and internally - CISOs can use the results to think of new, innovative ways to mitigate the risk. They can even test the ROI (both in terms of finance and risk reduction) with an on-demand CRQ platform, figuring out the optimal course of action.

Here we use the insights gained from ERM data to continuously refine practices. For instance, after identifying a pattern of cyber incidents, a bank could enhance its cybersecurity risk controls by adopting real-time threat detection tools or blockchain for secure transactions. We benchmark our ERM processes against industry leaders and seek out innovative approaches like predictive analytics or AI-based risk modelling. Continuous improvement not only boosts performance but also demonstrates ERM’s evolving value to management, showing its role in adapting to new risks and business growth.

In addition to required training in employees areas of discipline, employees should have some level of awareness training on the risk management program, what it is, why and purpose of the b program, but most essential their role in the program.

In a banking context, as I am a banking professional, I will consider a scenario where the ERM team helped reduce the bank's capital risk by better assessing customer creditworthiness through machine learning models. This reduced the bank's non-performing loans by 15% within one year, while allowing for more aggressive loan growth in safe sectors. Presenting these results to senior management highlights not only risk reduction but also the value of ERM in supporting business expansion, showcasing a balanced approach to risk and growth. This creates a compelling narrative of ERM as a strategic enabler, not just a defensive function.

The board and senior management have limited time, and you deserve them to understand on a real level the effort you made in managing cyber risk. This is why it's critical to communicate in broader business terms. The universal language of the corporate world is finance, so don't make things complicated by giving them anything other than that. Tell them what your cyber risk mitigation efforts have done to boost business growth and reduce financial loss. They'll be much more likely to invest in future projects and give support when necessary.

Risk Management program must be a horizontal as well as a vertical program and not seen as a nuisance program that digs into the business - non value add. Employees must see how effective management of the Risk program positively impacts the organizations productivity and bottom line.

First off, though ERM can and is useful, the insurance industry existed for more than two millennia withOUT formalized ERM. Second, over the last two centuries or so the industry thrived and grew enormously withOUT a Chief Risk Officer and staff. Third, ERM must be employed so as to NOT to interfere or stifle the primary purpose of the existence of an insurance enterprise, I.e., to do business and make money! Fourth, ERM should not stifle innovation in the insurance marketplace. Fifth, ERM needs to recognize that business is conducted in real time and within an extremely competitive market so the decision-making must occur in a time-sensitive manner. If decisions are extraordinarily delayed by ERM, soon there will be no risk to manage!