Design Enterprise Risk Management Committee

---
name: design-enterprise-risk-management-committee
description: Use when a board wants to establish a dedicated board-level committee (or full-board process) for overseeing the company's enterprise-wide risk profile — distinct from the audit committee's financial-reporting-specific mandate — integrating risk appetite, major risk categories, and management's risk response into a single board-level oversight function, rather than leaving enterprise risk oversight scattered across committees with no unifying view.
source: COSO, "Enterprise Risk Management — Integrating with Strategy and Performance" (2017); NACD board risk oversight guidance
tags: [law, corporate, enterprise-risk-management, board-risk-oversight, coso-erm, corporate-governance]
related: [design-audit-committee-charter, apply-iso-31000-risk-framework, design-risk-appetite-framework]
---

# Design Enterprise Risk Management Committee

Establish a dedicated board-level committee (or defined full-board process) for overseeing the company's enterprise-wide risk profile — distinct from the audit committee's financial-reporting-specific mandate — integrating risk appetite, major risk categories, and management's risk response into a single board-level oversight function.

## Why This Is Best Practice

**Adopted by:** The COSO Enterprise Risk Management framework (2017) explicitly identifies board risk oversight as a distinct governance function requiring dedicated structure, and the National Association of Corporate Directors documents an increasing number of large public companies establishing a dedicated risk committee distinct from the audit committee, particularly in financial services and other risk-intensive industries where risk oversight has outgrown what the audit committee's financial-reporting mandate can reasonably absorb.
**Impact:** Companies relying solely on the audit committee for enterprise risk oversight are documented to experience gaps in non-financial risk categories (operational, strategic, cybersecurity, reputational risk) that don't map naturally onto the audit committee's core financial-reporting expertise and already-full agenda, while companies with a dedicated risk oversight structure demonstrate more comprehensive, integrated risk visibility across these broader categories.
**Why best:** The audit committee's mandate and expertise are specifically oriented toward financial reporting and internal controls — asking it to also serve as the primary venue for enterprise-wide risk oversight (strategic risk, operational risk, cyber risk, reputational risk) stretches its bandwidth and expertise beyond its core function, while a dedicated committee (or clearly defined full-board process) provides the specific structure and bandwidth this broader oversight function actually requires.

Sources: Committee of Sponsoring Organizations of the Treadway Commission (COSO), "Enterprise Risk Management — Integrating with Strategy and Performance" (2017); National Association of Corporate Directors (NACD), board risk oversight guidance

## Steps

### Step 1: Decide between a dedicated risk committee and a full-board process

Decide whether the company's risk profile and scale warrant a dedicated risk committee, or whether a clearly defined full-board risk oversight process (with specific agenda time and reporting structure) is more proportionate — larger, more complex, or more risk-intensive organizations (particularly financial institutions) more commonly warrant a dedicated committee.

### Step 2: Define the committee's scope distinct from the audit committee

Define the committee's scope to cover enterprise-wide risk categories — strategic, operational, cyber, reputational, and other major risk categories — explicitly distinct from (and coordinated with, not duplicating) the audit committee's financial-reporting and internal-controls-specific mandate.

### Step 3: Establish the committee's connection to the organization's risk appetite

Establish the committee's responsibility for reviewing and recommending the organization's overall risk appetite — how much risk the organization is willing to accept in pursuit of its objectives — as the reference standard against which specific risks and management's risk responses are evaluated.

### Step 4: Establish management reporting lines into the committee

Establish clear reporting lines from a Chief Risk Officer or equivalent risk management function into the committee on a defined cadence, ensuring the committee receives substantive, structured risk information rather than only ad hoc or crisis-driven updates.

### Step 5: Coordinate explicitly with other committees to avoid gaps or duplication

Explicitly coordinate the risk committee's scope with the audit committee, ESG/sustainability committee, and any other risk-adjacent committees to ensure risk categories are clearly allocated without gaps (a risk category no committee owns) or duplication (multiple committees separately, redundantly covering the same risk).

## Rules

- Decide deliberately between a dedicated committee and a defined full-board process, based on the organization's actual risk profile and scale — not by default assumption either way.
- Define the committee's scope explicitly distinct from the audit committee's financial-reporting mandate, covering the broader enterprise risk categories.
- Connect the committee's oversight explicitly to the organization's defined risk appetite, not an undifferentiated general risk discussion.
- Coordinate explicitly with other risk-adjacent committees to avoid both oversight gaps and duplicated coverage.

## Examples

**Dedicated committee providing focused oversight the audit committee couldn't sustain:** A financial services company establishes a dedicated risk committee specifically because its audit committee's financial-reporting workload had left insufficient bandwidth for genuine strategic and operational risk oversight. The new committee's dedicated focus surfaces and addresses a cybersecurity risk gap that had received only cursory attention under the prior audit-committee-only structure.

**Explicit coordination avoiding a scope gap:** A board explicitly allocates climate-related risk to its risk committee and financial-reporting risk to its audit committee, documenting the boundary in both committees' charters. When a climate-related regulatory risk emerges with financial reporting implications, the two committees coordinate directly rather than each assuming the other has ownership — a coordination the explicit allocation specifically enabled.

## Common Mistakes

- **Relying solely on the audit committee for all enterprise risk oversight** — this stretches the audit committee's financial-reporting-oriented mandate and bandwidth beyond what it can reasonably absorb for broader risk categories.
- **Establishing a dedicated risk committee without clearly distinguishing its scope from the audit committee's** — overlapping, undifferentiated scope produces confusion and potential duplication rather than genuine additional coverage.
- **Failing to connect risk oversight explicitly to a defined risk appetite** — without this reference standard, risk discussions lack a consistent basis for evaluating whether a specific risk or response is actually acceptable.
- **Neglecting to coordinate explicitly with other risk-adjacent committees** — this risks either gaps (no committee owning a specific risk category) or duplication (multiple committees separately covering the same ground).

## When NOT to Use

- For a smaller or less risk-intensive organization where a dedicated risk committee is disproportionate to actual risk complexity — a defined full-board risk oversight process may be more appropriate at this scale.
- As a substitute for the audit committee's specific financial-reporting and internal-controls oversight — enterprise risk committee oversight complements, but doesn't replace, the audit committee's distinct mandate (see `design-audit-committee-charter`).
- As a substitute for the organization's own operational risk management process — board-level committee oversight provides governance accountability; it doesn't replace the management-level work of actually identifying and managing specific risks (see `apply-iso-31000-risk-framework`).

> **Legal disclaimer:** This skill encodes professional best practices for educational purposes. It is not legal advice. Board risk oversight structure requirements vary by industry (particularly for regulated financial institutions) and jurisdiction — consult licensed corporate governance counsel for requirements specific to your organization.