PMGT5891 Chap.10 Enterprise Risk Management and Risk Governance
Enterprise Risk Management and Risk Governance
This chapter moves from the single project to the whole organisation. It explains what enterprise risk management adds to project-level practice, using the COSO definition quoted by EY and Deloitte's three levels of responsibility. You then work through the three lines of defence, risk ownership and escalation, with Minsky's argument that scandals at Wells Fargo and GM grew from root causes nobody acted on.
Evidence from Aon's 2017 survey, Stulz's six ways companies mismanage risk and McKinsey's view of a more predictive risk function round out the governance picture.
What this chapter covers
- 01
ERM compared with project risk management
- 02
Board, executive and business unit responsibilities
- 03
Three lines of defence
- 04
Risk ownership and escalation pathways
- 05
Root-cause risk across the enterprise
- 06
Aon 2017 top risks and readiness
- 07
Six ways companies mismanage risk
- 08
Risk reporting and future trends
Worked example · free
One supplier, three projects: escalating a shared risk
- +1Project view: $60k, $45k and $80k are each below the $100k project limit, so no project escalates on its own.
- +1Enterprise view: the risk shares one root cause, so add the exposures: $60k + $45k + $80k = $185k.
- +1Compare with appetite: $185k exceeds the $150k portfolio limit by $35k, so the risk must be escalated.
- +1Assign ownership at portfolio level, for example the head of procurement, and treat the root cause once, such as qualifying a second supplier.
Key terms
- Enterprise risk management
- Enterprise risk management is an organisation-wide process, run by the board, management and staff, that identifies events affecting the entity and keeps risk within its appetite.
- Three lines of defence
- The three lines of defence is a governance model separating risk owners in the business, an independent risk function, and internal audit providing assurance.
- Escalation
- Escalation is the movement of a risk or decision to a higher level when it exceeds the authority or risk appetite of the level that found it.
- Root-cause risk
- Root-cause risk is an underlying weakness that can produce failures in several parts of an organisation, so treating each symptom alone leaves it in place.
Enterprise Risk Management and Risk Governance FAQ
How is enterprise risk management different from project risk management?
Project risk management looks at threats and opportunities to one project's objectives. ERM, by contrast, takes an organisation-wide view, links risk to strategy and appetite, and finds shared causes across projects and divisions. Most project managers meet it in earnest when they move to programs or portfolios, but its principles apply at any level.
What does each line in the three lines of defence do?
The first line is the business, which owns risks where they arise and manages them day to day. The second line is the independent risk function, which sets frameworks and challenges decisions. The third line is internal audit, which gives the board assurance that the whole arrangement works. The board and senior management sit above all three.
When should a project risk be escalated?
Escalate when a risk exceeds the threshold or appetite set for your level, when its treatment needs authority you do not hold, or when the same cause appears across several projects. Name the person who will own it at the higher level, and keep reporting on any part that stays with the project.
Which risk did organisations feel most ready for in Aon's 2017 survey?
Among the top 10 risks, cyber crime had the highest reported readiness at 79%, while political risk had the lowest at 27%. Average readiness across the top 10 fell from 58% in 2015 to 53% in 2017, and damage to reputation or brand was ranked as the top risk overall.
Why do companies with sophisticated risk models still fail?
Stulz argues that models break down in predictable ways: they lean on history that may not repeat, track narrow measures, miss risks that sit between units, and never see risks people hide. Even accurate analysis fails if it reaches the board too late or in a form nobody understands, and static snapshots miss fast-moving exposures.
Exam move
Build a one-page governance map from memory: board, senior management, and the three lines, with one verb for each (oversee, set up, own, challenge, assure). Next, practise escalation decisions with your own numbers: score a handful of risks, apply a stated threshold, and write who owns each one and why. Always check whether two risks share a cause, since combined exposure can cross a limit that single risks do not.
Learn Stulz's six failure types as a list you can match to short scenarios, and keep one figure from the Aon survey and one from Minsky's cases ready as evidence. In the group case report, use these ideas to explain where ownership or reporting broke down, not just what went wrong technically. A short paragraph naming the missing escalation route often says more than a long list of technical faults.
Working through Enterprise Risk Management and Risk Governance in PMGT5891? Sia is AskSia’s AI Project Management tutor — ask any PMGT5891 Enterprise Risk Management and Risk Governance question and get a clear, step-by-step explanation grounded in how PMGT5891 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
