Enterprise Risk Management and the Role (and Life) of the In-House Counsel

Abstract

Over the past decade, the financial services industry has adopted the language of enterprise risk management, e.g., ERM. Although it can seem otherwise, the mass production of checklists, heatmaps, and risk appetite statements was not ERM’s original purpose. Rather, ERM’s intended upshot was to effect “culture change” within organizations, for it to be embedded with staff, and eventually leave the fold of the assurance functions and run itself. Industry boards and CEOs are still considering ERM’s value and some question whether its reach exceeds its grasp. Meanwhile, regulators have seized on ERM as a powerful vector for monitoring the financial services industry. Rating agencies have likewise made ERM an essential rating component. ERM sits now as a valued monitoring and oversight mechanism -- the question is whether ERM can find its end state and achieve its original purpose of establishing “risk culture.”