The need for effective risk assessment is increasing. The 2026 State of Risk Oversight report from NC State University’s ERM Initiative and the AICPA & CIMA indicates that 69% of executives and board members believe risk volume and complexity have grown in the past five years, yet only 30% consider their risk oversight processes mature. Similarly, COSO’s 2026 ERM guidance emphasizes moving from documentation to action-oriented, strategically relevant risk management that supports confident decision-making.
A valuable enterprise risk assessment does more than list risks or create heat maps. It provides a sound basis for comparing exposures, setting priorities, determining necessary actions, and informing management and board oversight.
Contents
What Is an Enterprise Risk Assessment? What Should Be Established Before the Assessment Begins? Who Should Participate in an Enterprise Risk Assessment? The Enterprise Risk Assessment Process Common Enterprise Risk Assessment Mistakes What Should a Good Enterprise Risk Assessment Produce? From Risk Assessment to Enterprise Risk Management References and Further Reading
What Is an Enterprise Risk Assessment?
A risk assessment involves a systematic approach to identifying uncertainties that might affect objectives, analyzing their significance, and assessing the implications for decision-making. The ISO 31000:2018 standard includes risk assessment as part of a more comprehensive risk-management process that also encompasses identification, analysis, evaluation, treatment, monitoring, review, and communication.
Enterprise risk assessment applies this approach throughout the organization. Its aim is not to replace more specialized assessments, such as those related to cybersecurity, compliance, projects, suppliers, or safety. Rather, it establishes a common language and enables comparison, so that senior management can understand the significant exposures across the portfolio.
The importance of that distinction lies in the fact that risk assessment is not the entire scope of ERM. While it provides information on exposure, ERM uses that information, along with governance, risk appetite, responses, monitoring, reporting, and review, to support the achievement of objectives and decision-making.
The question regarding the enterprise is not just ‘How serious is this risk?’ but also ‘How does it compare to the other exposures, what is left after the present responses, and does it call for action?’
↑ Back to Contents
What Should Be Established Before the Assessment Begins?
Do not start an enterprise risk assessment with a scoring worksheet. Begin by defining objectives, specifying the assessment scope, determining the time horizon, agreeing on assessment criteria, and establishing a shared risk language before ranking risks.
Risk is meaningful only in relation to objectives. The team must understand all relevant objectives—strategic, operational, financial, compliance, and resilience. Clarify whether the assessment covers the entire enterprise, a business unit, a geographic area, a strategic initiative, a major transformation, or another defined area.
The time horizon is critical. A risk unlikely in the next 12 months may be plausible over five years. Distinguish between near-term, medium-term, and long-term exposures as appropriate.
Before assigning risk ratings, ensure the team understands the common criteria. Participants should be familiar with terms such as impact, likelihood, inherent risk, residual risk, risk appetite, risk tolerance, control, response, and risk owner as defined by the organization’s methodology. Consistency is more important than terminology.
↑ Back to Contents
Who Should Participate in an Enterprise Risk Assessment?
Enterprise risk assessment is a management process, not just the responsibility of the risk management function. Senior management provides strategic perspective, business and functional leaders contribute operational knowledge, and risk owners describe exposures and current responses. The ERM or risk function coordinates the methodology and ensures it is rigorously challenged.
Internal audit should be able to contribute assurance and insight. However, it should not automatically assume ownership of risk decisions. The board has an oversight role. It should understand whether management has an effective process, whether material exposures are considered in relation to strategy and appetite, and whether the resulting information supports governance decisions.
Participation in the risk assessment is not a simple voting exercise. The process may reveal differing assumptions, such as incomplete information, dependencies, control effectiveness, or time horizons. Leaders should understand the reasons behind divergent conclusions, as this insight is often more valuable than averaging scores.
↑ Back to Contents
Identify Risks to Objectives
Risk identification should start with the objectives rather than with a general list of risk categories. A good question to ask is: What might happen – either positively or negatively – that could significantly affect our ability to achieve this objective?
Use multiple sources instead of relying on a single workshop or survey. Inputs may include strategic plans, executive interviews, operating and financial data, previous assessments, audit findings, legal and regulatory developments, cybersecurity and resilience information, supplier exposures, customer and market intelligence, incidents, near misses, and emerging risk research.
Once risks are identified, provide clear descriptions. Labels like “cybersecurity” or “supply chain risks” may help identify topics, but are not sufficient to identify risks or exposures. Effective statements should link the cause or condition, the uncertain event, and the potential effect on objectives.
Identify causes, risk events, consequences, and controls. Also look across organizational boundaries for common dependencies, shared causes, concentrations, cascading effects, and risks that may amplify one another. Historical experience is valuable, but the process should also consider emerging or unfamiliar risks that may not yet appear in loss data.
It is advisable not to score too early. A better approach is to identify the items, then understand, assess, compare, and finally prioritize them.
↑ Back to Contents
Establish clear and consistent criteria for assessment
An organization needs a common basis to evaluate risks meaningfully. Once it identifies and understands its significant risks, it must establish well-defined criteria. Without the common criteria, ratings may look comparable while reflecting different assumptions.
The impact and likelihood usually form the basis of the assessment. The impact relates to the extent to which a risk could affect the objectives, while likelihood deals with how probable the event or situation is over the relevant time period. Impact should not be limited to financial loss; for the organization in question, consequences could include strategic disruption, operational interruption, harm to customers or employees, legal or regulatory effects, technology impacts, reputational impacts, resilience impacts, or other significant outcomes.
You should include additional assessment dimensions to the extent they improve the process. COSO guidance highlights several factors to consider, including vulnerability and velocity. Organizations may also consider persistence, concentration, and other relevant characteristics. Avoid adding dimensions solely because they are available.
You must use scales that are easy to apply and should avoid excessive numerical details. If you use a scale, you must define each level clearly. Use numerical scores to support comparison. Do not imply scientific precision when using judgment to perform the assessment.
IEC 31010:2019 also notes that organizations can select risk-assessment techniques based on the decision, available information, uncertainty, and context. There is no single universal scoring method.
↑ Back to Contents
Build Your ERM Implementation Capability
The AGTC Academy ERM Course provides a structured implementation path
Assess Inherent Risk
A typical starting point is the inherent risk—that is, the amount of exposure before accounting for measures used to alter it. Residual risk refers to the exposure remaining after those measures have been taken into account. This distinction enables leaders to separate the nature of the risk from the effectiveness of the response.
Assess a specific risk scenario rather than a general topic. When doing so, use the agreed criteria to assess the plausible consequences and their likelihood over the relevant time period. Available evidence may include past incidents, internal performance data, external events, forecasts, scenario analyses, expert judgment, and changes in exposure.
It can be challenging to determine inherent risk given that organizations rarely operate without any controls. Safeguards are often built into technology, regulations, contracts, procedures, or business design. Clearly establish and consistently apply the inherent-risk baseline, rather than assuming unrealistic scenarios.
Use good and reliable information to guide assessments. However, be mindful that data does not replace the need for judgment. If ratings differ, investigate the reasons—such as assumptions, time horizons, evidence, interpretations, or uncertainty—instead of simply averaging them.
While you should judiciously consider inherent risk, be mindful that the scores are simply analytical inputs. They are not the final decision. When evaluating response options, you should also consider other factors. These may include current actions, remaining exposure, risk appetite, costs and benefits, available alternatives, and objectives.
↑ Back to Contents
Review Responses, Controls, and Residual Risk
Once you have understood the underlying exposure, you should evaluate the actions management is taking and consider what remains. The fact that a policy, a control, an insurance arrangement, a contingency plan, or another response has been put in place does not mean the risk has been meaningfully reduced.
It is necessary to differentiate the broader risk response from specific controls. Management has the option to avoid, reduce, share, transfer, accept, or otherwise modify the level of exposure. Controls are one type of action that falls within that broader response.
When it comes to important controls, both their design and their operating effectiveness should be taken into account. A control might be well-designed but still implemented inconsistently, or it could operate precisely as intended yet fail to address the most significant source of exposure. Evidence can be obtained from control testing, assurance activities, incidents, near misses, key risk indicators, scenario exercises, cybersecurity testing, supplier performance, or other relevant information.
It is important to identify control dependence. Some exposures may appear acceptable. This is so because the organization may rely heavily on a small number of critical controls or capabilities. Leadership should know which responses are essential, how their effectiveness is validated, whether there are single points of failure, and what signs would indicate deterioration.
Assess residual risk using the same criteria as inherent risk. Do not calculate it mechanically by subtracting a control score. Responses may affect multiple dimensions, such as likelihood, impact, velocity, vulnerability, duration, or concentration. Where confidence in the response is limited, make that uncertainty visible.
Your decision should not be based only on the residual risk findings. Management must compare the remaining exposure against the organization’s risk appetite, risk tolerance, objectives, available alternatives, and its ability to absorb and monitor risk.
↑ Back to Contents
Take Into Account Risk Interaction and Concentrations.
It is necessary but not enough to consider risks one at a time when performing an enterprise assessment. Risks may share causes, depend on the same resources, trigger one another, or become more significant when several exposures occur together. COSO’s ERM framework explicitly calls for a portfolio view.
Check for common drivers and concentrations. Pay particular attention to reliance on a single supplier, technology platform, geography, customer, financing source, facility, or a small group of key employees. A risk that appears modest in one business unit can become material when similar exposure exists across the enterprise.
Be mindful of cascading effects and other amplification patterns. A technology outage, for example, may have multiple effects. Depending on the organization, it may affect operations, customers, regulatory obligations, financial performance, reputation, and strategy. An economic downturn may become more consequential when combined with high leverage, weak demand, supply disruption, or reduced liquidity.
You do not need complex quantitative models to perform interaction analysis. There are many useful techniques such as facilitated discussion, dependency mapping, scenario analysis, stress testing, bow-tie analysis, and correlation analysis when credible data are available. When data are limited, qualitative analysis may be more defensible than unsupported numerical relationships.
Consider how different responses interact. Reducing one type of exposure may increase another. Enterprise risk management should use a portfolio approach rather than addressing risks in isolation.
↑ Back to Contents
Compare exposure with risk appetite and tolerance.
The assessment does not answer the most important question facing management: whether the remaining exposure is acceptable. It must be compared with the kind and extent of risk the organization is willing to take to achieve its objectives.
Risk appetite provides broad direction about the risks an organization is willing to accept. Risk tolerance translates that direction into acceptable performance ranges and exposures. Thresholds or limits help the organization identify points at which risk personnel should take action, escalate, or approve the risk.
Risk appetite is not the same as risk aversion. Every organization takes risks to pursue its objectives, and risk appetite may differ by risk type. An organization may accept substantial uncertainty around innovation while maintaining very little appetite for employee harm, deliberate noncompliance, or financial misstatement.
An organization should not have to reduce risk appetite to a single number. Some exposures can be quantified. Others are not. Examples of quantifiable exposures may include liquidity or downtime, while others require qualitative boundaries. The goal is to provide enough clarity for consistent decisions.
A practical sequence is as follows: appetite → tolerance → threshold → escalation → and then action. If residual exposure exceeds boundaries, management should decide whether to reduce, transfer, accept, escalate, or modify the exposure. Revisit appetite and tolerance when strategy, financial capacity, technology, stakeholder expectations, or other key conditions change.
↑ Back to Contents
Prioritize Risks With No False Precision
Risk prioritization involves more than sorting risks using a numerical score. COSO’s Risk Assessment in Practice treats prioritization as a distinct part of the assessment because management must interpret scores in the context of objectives, appetite, interactions, control reliance, uncertainty, and the decisions to be made.
Heat maps can serve as useful communication tools, but they are representations of the assessment, not the assessment itself. A two-dimensional impact-likelihood matrix cannot show every factor that may matter, such as velocity, concentration, interdependency, control dependence, uncertainty, or direction of travel.
Multiplying ordinal scores is a useful way to organize information. However, it does not produce an exact measure of risk. A rating of 4 is not inherently twice the exposure represented by a 2. Color should not determine the decision either: a ‘green’ risk may still warrant attention if consequences are severe, the exposure is worsening, or critical controls are uncertain.
When prioritizing risks, you need to consider several factors. These include: residual exposure, proximity to appetite or tolerance, strategic significance, severity, velocity, concentration, and interactions. You should also take into account control dependence, evidence quality, uncertainty, direction of travel, and whether a management decision is required now. These factors do not all need additional numerical scores; they can be structured questions.
Prioritization should lead to action. It may be more useful to classify risks as requiring an immediate decision, additional response, enhanced monitoring, further analysis, or no additional action within current boundaries than to produce a simple league table from Risk #1 to Risk #20.
↑ Back to Contents
Prepare the Enterprise Risk Profile
The output of an enterprise risk assessment should give management a clear view of significant exposures, objectives at risk, what is changing, where exposures sit relative to acceptable boundaries, and where action or decisions are needed. That broader view is the enterprise risk profile.
A risk register documents individual risks; a risk profile helps see the overall pattern. It may summarize elements such as exposure, affected objectives, inherent and residual risk. It may also show position relative to appetite, trend, important concentrations or interactions, critical dependencies, ownership, and next management action.
When preparing a risk profile, you should consider both direction and position. This is important because a moderately rated risk that is rising rapidly may need more attention than a higher-rated exposure that is stable, well understood, and effectively controlled.
When reviewing the profile, leaders should be able to see what has changed, why it matters, what management is doing, and whether a decision or escalation is required. The level of detail you provide must fit the audience’s needs. Management may need actionable details to support day-to-day operation while executives may need a consolidated enterprise view. The board may need focused information that supports oversight without pulling directors into day-to-day risk management.
↑ Back to Contents
Keep the Assessment Current
The frequency with which you conduct an enterprise risk assessment may vary depending on your organization. Some organizations may conduct a formal enterprise-wide assessment annually or as part of strategic planning. Others may follow a different schedule. Regardless of your approach, a calendar-based cycle alone may be insufficient because risks, objectives, or operating conditions may change materially.
As a matter of principle, you should assess formally at appropriate intervals, monitor continuously where needed, and reassess when material changes occur. Material changes may be triggered by acquisitions, market entry, regulatory developments, geopolitical disruptions, cyber events, or loss of a critical supplier or customer. Triggers may also include restructuring, changes in financing, major incidents, emerging technologies, or evidence that an important response is no longer effective.
Not every change requires a full reassessment. Ongoing monitoring – through key risk indicators, performance measures, incidents, control information, external developments, assumptions, and emerging-risk intelligence – helps management determine when targeted reassessment is necessary.
Assessment timing should support your decision cycles. Risk information is more useful when connected to strategic planning, capital allocation, budgeting, major investments, transactions, and executive and board discussions than when produced after those decisions have already been made.
The frequency with which you conduct assessments does not automatically translate into quality. A quarterly assessment that reflects minimal changes may add little value. On the other hand, a less frequent assessment supported by high-risk management practices may provide very useful information. This is particularly true for organizations with strong risk monitoring, timely escalation, and event-driven reassessment. Best practices suggest treating enterprise risk assessment as a living process that follows this sequence: assess -> monitor -> detect changes -> reassess as needed -> update the risk profile -> act.
↑ Back to Contents
Common Enterprise Risk Assessment Mistakes
There are several mistakes that can diminish the validity of an assessment. These mistakes often reflect a disconnect from the decisions the process is supposed to support. Some of the most obvious ones include:
Starting with a generic risk list instead of objectives. Risk categories can stimulate discussion, but the assessment should begin with what the organization is trying to achieve and the uncertainty that could affect those objectives.Scoring before understanding the risk. Often organizations move straight to scoring risks without first clarifying the scenario, causes, consequences, dependencies, and time horizon. This is a mistake that can cause participants to rate different interpretations of the same exposure.Using inconsistent criteria. Ratings are not comparable when participants interpret impact, likelihood, or the assessment horizon differently. As a best practice, you should define the scales and assumptions before conducting a risk workshop.Averaging away meaningful disagreement. Differences in informed judgment may reveal hidden assumptions, information gaps, control uncertainty, or genuine ambiguity. It is important to explore the reason before averaging the scores.Assuming documented controls are effective. Simply because a control is listed in a register is not evidence that it works. Before accepting the residual risk as given, you must consider the design, the operating effectiveness, and the quality of the supporting evidence.Treating the heat map as the assessment. Impact and likelihood alone can be misleading. They do not tell the whole story about the risk level and exposure. They may hide other factors such as velocity, concentration, interdependencies, control reliance, uncertainty, direction of travel, and position relative to appetite.Assessing risks only in silos. Departmental assessments may be useful for providing a limited understanding of risk on a stand-alone basis. However, enterprise risk requires a view of shared drivers, concentrations, interactions, and aggregated exposure across business units.Failing to compare exposure with appetite. Simply because a risk has a high rating does not automatically mean it is unacceptable. Without appetite, tolerance, or escalation boundaries, management may not know when action is required.Allowing the assessment to become stale. It is important to update the assessment with changes in the business environment. Material changes in strategy, technology, regulation, suppliers, markets, financing, incidents, or assumptions can make a prior rating obsolete before the next formal cycle.Producing a report without producing action. The assessment creates little value if leadership cannot determine what requires action, who is accountable, what should be monitored, and what decisions need to be made.
↑ Back to Contents
What Should a Good Enterprise Risk Assessment Produce?
A good enterprise risk assessment should produce decision-useful risk information, not just a completed worksheet. The exact format will vary, but leadership should emerge with a clearer understanding of the organization’s most significant exposures and what those exposures mean for objectives.
At a minimum, the process should produce:
a clearly defined set of significant enterprise risks linked to objectives;
consistent inherent and residual assessments supported by documented assumptions;
an understanding of the most important controls, responses, dependencies, and uncertainties;
a view of material interactions, concentrations, and portfolio effects;
comparison of residual exposure with relevant appetite, tolerance, or escalation boundaries;
priorities that distinguish risks requiring action, monitoring, deeper analysis, or acceptance;
clear management ownership and next actions; and
an enterprise risk profile that can support executive and board discussion.
The quality test is simple: can leadership use the results to make better decisions? If the assessment produces a sophisticated score but does not drive decisions, the process should not be considered to deliver its full value.
The assessment should also help the organization to surface uncertainty. A risk profile that identifies assumptions, evidence limitations, and areas requiring further analysis is more useful to management than an assessment in which every rating is equally certain.
↑ Back to Contents
From Risk Assessment to Enterprise Risk Management
Enterprise risk assessment is a fundamental element of ERM, but it is only part of the process. It is used to identify and assess the exposure; ERM then links this information to governance, appetite, responses, monitoring, reporting, review, and decisions.
Organizations that stop after scoring risks may produce useful documentation. However, this information is meaningless unless integrated in an operating risk-management system. The next step is to connect the risk profile to accountable action, indicators, escalation, management reporting, board oversight, and continual improvement.
For the broader implementation sequence, see How to Implement Enterprise Risk Management: A Practical Guide to Building an ERM System .
Build Your ERM Implementation Capability
The AGTC Academy ERM Course provides a structured implementation path
↑ Back to Contents
References and Further Reading
International Organization for Standardization (ISO). 2018. ISO 31000:2018 – Risk management – Guidelines
International Organization for Standardization / IEC. 2019. IEC 31010:2019 – Risk management – Risk assessment techniques
Committee of Sponsoring Organizations of the Treadway Commission (COSO). Current guidance library. Enterprise Risk Management Guidance, including Risk Assessment in Practice
COSO. 2020. Risk Appetite – Critical to Success
COSO. 2026. From Guidance to Action: Exploring Practical Enterprise Risk Management
The Institute of Internal Auditors (IIA). 2026. Enterprise Risk Management 101
NC State ERM Initiative and AICPA & CIMA. 2026. 2026 State of Risk Oversight: Enterprise Risk Management Trends and Key Findings
RIMS. 2026. Board Risk Reporting: How to Deliver Insights That Matter
Source note: This guide draws on recognized risk-management standards and current professional guidance. Examples and AGTC implementation recommendations are provided for educational purposes and should be adapted to each organization’s objectives, governance, risk environment, and applicable requirements.
↑ Back to Contents
