Enterprise Risk Management: what should we learn

Every crisis has a history; it rarely arrives without prior signs. What varies between companies is not the amount of risks they are exposed to, but their ability to perceive these signs and their capacity to manage crises. Enterprise Risk Management (ERM) exists in theory for this purpose. Yet, we still see companies with risk management structures being caught off guard by crises; in this article, we reflect on why this happens.

Why do consolidated Enterprise Risk Management structures fail to anticipate crises?

Some patterns repeat frequently. The first is the fragmentation between risk and strategy; the risk committee exists, but the conclusions rarely influence the strategic planning process with enough weight to alter decisions.

The second is the excess of methodological standardization without updating scenarios, such as heat maps created two years ago that continue to be used as a current reference.

The third, and perhaps the most critical, is the absence of diversity in analyses; when the same people, with the same mental models, analyze the same risks, the result tends to be the confirmation of what is already known. Emerging risks require perspectives that established models have not yet captured.

There is also an incentive problem; depending on the business context, identifying a relevant risk generates additional work, mobilizes resources, and can be interpreted as pessimism.

How has the financial sector transformed Enterprise Risk Management into a competitive advantage, and what can we learn from this?

The failure of Lehman Brothers in September 2008 is the major example that risk models can fail when they do not capture the correlations that really matter. The regulatory response that followed forced the financial sector to make a transition that other sectors still make by choice: treating ERM as a competitive intelligence function rather than merely compliance.

The result is visible; organizations with ERM integrated into their strategic planning display lower volatility in results, raise capital under better conditions, enter new markets more swiftly, and face periods of instability with less improvisation.

For sectors like technology, health, infrastructure, and retail, the transition is underway. The good news is that there is no need to wait for a regulatory crisis to make this move.

How does maturity in Enterprise Risk Management enhance the speed and security of decision-making?

Decision speed is faster because the analytical work has already been done before pressure mounts. When there is clarity and appetite for risk, the executive debate becomes: “Is this risk within our profile, and how do we manage it now?” There is also an accumulated credibility effect; businesses that identify and manage risks effectively have more room for bold decisions because board members and investors trust that the downside is mapped.

At Objective, we see the challenges of risk management every day. We work with large companies that need to make decisions in high-complexity environments. In this journey, we have learned that companies that move faster are those with better visibility over risks, not necessarily those with fewer risks.

We build solutions incorporating data, AI, and governance that transform dispersed information into intelligence, whether to anticipate credit risks, reduce operational risk in core system modernization, or structure data governance with end-to-end traceability. If this is a movement that makes sense for your moment, talk to our experts.