Enterprise Risk Management Roadmap: 12-Month Plan to a Working ERM

9 min read ยท 2026-10-25

An enterprise risk management roadmap is a phased plan for building or maturing the way your organization identifies, assesses, responds to and reports its biggest risks. It moves you from scattered risk lists in different departments to one risk register, clear owners, an agreed risk appetite and regular reporting to the executive team and the board.

The 12-month template below suits a company starting ERM for the first time or rebuilding a program that exists only on paper. It follows the logic of the major frameworks, such as COSO ERM and ISO 31000, without trying to copy either one. Use it to plan the work, assign owners and show the board when it will see results. Confirm the exact framework requirements against the official texts or with your auditors if you need formal alignment.

The roadmap at a glance

Goal: By month 12, the organization has an approved risk policy and appetite, one enterprise risk register with named owners, response plans for the top risks and a quarterly risk report the board reviews. Duration: 12 months

  1. Mandate and current state (Weeks 1-6)

    Get a clear mandate and see what risk work already exists.

    • Agree the scope and goals of ERM with the CEO, CFO and the board or audit committee chair.
    • Collect existing risk material: department risk lists, audit findings, insurance reviews, compliance registers and incident logs.
    • Interview senior leaders on the risks that keep them up at night and how they handle them today.
    • Assess current maturity against a simple scale, from ad hoc to embedded.

    Milestone: Board-approved ERM charter with scope, sponsor, risk lead and a current-state maturity rating.

  2. Framework and policy (Weeks 5-12)

    Set the rules everyone will use to talk about risk.

    • Choose a reference framework, such as COSO ERM or ISO 31000, and adapt it to your size.
    • Define risk categories, such as strategic, operational, financial, compliance and technology.
    • Build scoring scales for impact and likelihood with plain descriptions for each level.
    • Draft a risk appetite statement for each main category with the executive team.
    • Write the risk policy: roles, escalation thresholds and review frequency.

    Milestone: Risk policy, scoring scales and risk appetite statement approved by the executive team and the board.

  3. Risk identification and assessment (Weeks 11-20)

    Build the first enterprise risk register.

    • Run risk workshops with each business unit and support function using the shared categories and scales.
    • Write each risk with a cause, an event and a consequence so it is clear and testable.
    • Score inherent risk, then note existing controls and score residual risk.
    • Consolidate into one register and agree the top ten enterprise risks with the executive team.

    Milestone: One enterprise risk register with every risk scored and owned, and a top ten list agreed by the executive team.

  4. Response plans and controls (Weeks 19-30)

    Decide what to do about the top risks and who does it.

    • For each top risk, choose a response: accept, reduce, transfer or avoid.
    • Write action plans with owners, due dates and the expected change in residual score.
    • Define key risk indicators with thresholds for the top risks.
    • Link actions to the internal audit plan and the budget cycle where they need funding.

    Milestone: A response plan and at least one key risk indicator for each top ten risk, with every action owned and dated.

  5. Reporting and governance (Weeks 27-40)

    Make risk part of the management and board calendar.

    • Set up a risk committee or add a risk agenda item to the executive meeting every month or quarter.
    • Build a quarterly risk report: heat map, top risks with trend, key risk indicators and overdue actions.
    • Agree with the audit committee how and when it receives the report.
    • Clarify the three lines: management owns risks, risk and compliance oversee, internal audit gives assurance.

    Milestone: First quarterly risk report reviewed by the executive team and presented to the board or audit committee.

  6. Embed and improve (Weeks 38-52)

    Make risk thinking part of everyday decisions.

    • Add a risk section to the strategic planning template and to business cases above a set threshold.
    • Train risk owners and department heads on the register, scoring and escalation.
    • Review the register and the appetite statement against what changed in the year.
    • Reassess maturity and set next year's ERM goals.

    Milestone: Risk review built into strategy and investment decisions, maturity reassessed and next-year plan approved.

What goes in the enterprise risk register

The register is the backbone of the program. Keep it in one place, whether that is a GRC tool, SharePoint list or a controlled spreadsheet. One row per risk. The columns below are a good starting point for most organizations.

Resist the urge to log every small risk. An enterprise register with 300 entries is not readable by an executive team. A common practice is to keep the enterprise register to the risks that could affect strategy or the company as a whole, and let departments keep their own operational lists that roll up into it.

  • Risk ID and title: a short, clear name.
  • Description: cause, event and consequence in one or two sentences.
  • Category and owner: the risk category and one named executive owner.
  • Inherent and residual scores: impact and likelihood before and after current controls.
  • Appetite check: whether the residual score is inside or outside appetite.
  • Response and actions: the chosen response, action owners and due dates.
  • Key risk indicators: the measures and thresholds that give early warning.
  • Trend and last review date: up, stable or down since the last review.

Example: an ERM roadmap for a regional logistics company

Picture a logistics company with warehouses in three countries, a fleet of trucks and a growing e-commerce client base. It has insurance reviews and a health and safety register, but no enterprise view. The audit committee asked for one within a year.

The cyber and key client risks rose to the top in the workshops even though no department owned them before. That is a typical result of the first enterprise view, and a good story for the first board report.

  • Q1, Mandate and framework (owner: CFO as sponsor, Head of Risk): ERM charter approved by the audit committee, ISO 31000 chosen as reference, five risk categories and a five-by-five scoring scale agreed.
  • Q2, Assessment (owner: Head of Risk with business unit heads): nine workshops held, 46 risks logged, top ten agreed, including warehouse fire, cyber attack on the transport system, driver shortage and loss of a key client.
  • Q3, Responses and reporting (owners: risk owners on the executive team): action plans for the top ten, key risk indicators such as open driver positions and patching backlog, first quarterly report to the audit committee.
  • Q4, Embed (owner: CEO and Head of Strategy): risk section added to the annual plan and to capital requests, owners trained, register reviewed, next-year goals set.

Who owns what

ERM fails when the risk team owns all the risks. The risk team designs the process, facilitates and challenges. Business leaders own their risks and the actions to manage them. The board oversees.

Write the roles into the risk policy and repeat them in the kickoff deck. Every risk in the register needs one named owner at executive level, even when several teams work on the actions.

  • Board or audit committee: approves the appetite, reviews the top risks and oversees the program.
  • CEO and executive team: own the top risks and decide on responses.
  • Chief Risk Officer or Head of Risk: designs the framework, runs workshops, maintains the register and writes the report.
  • Risk owners: keep scores current, deliver actions and watch their key risk indicators.
  • Internal audit: gives independent assurance that key controls work.
  • Department risk champions: collect local risks and keep their unit's list up to date.

How to present it to the board

For the roadmap itself, use one slide with the six phases on a 12-month timeline and three marked dates: policy approval, first top ten list and first quarterly report. Add a small box with the current maturity level and the target for year end. Boards want to know when they will see something useful, so put those dates in bold.

For the quarterly report, lead with a heat map of the top ten risks and arrows showing movement since the last quarter. Then show one line per top risk: owner, residual score, appetite status, key indicator trend and overdue actions. Keep detailed workshop outputs and the full register in the appendix. Ask the board for a decision when a risk sits outside appetite, rather than only reporting it.

Metrics that show the program is working

Measure the program itself, not only the risks. A full register is not proof that ERM works. Proof is that risks are owned, actions get done and leaders use the information in decisions.

Report these metrics at each phase gate and in the year-end review. Pick a small set and keep it stable so the trend is clear.

  • Ownership coverage: share of enterprise risks with a named executive owner and a review in the last quarter.
  • Action completion: risk actions completed on time against actions due.
  • Key indicator coverage: top risks with at least one indicator and a threshold.
  • Risks outside appetite: count and how long each has been outside.
  • Decision integration: share of major business cases that include a risk assessment.

How to adapt the roadmap

A smaller company can merge phases and run ERM with a part-time risk lead, a simple spreadsheet register and a risk agenda item at the monthly management meeting. Keep the policy short and the scoring simple. A large group should add a phase to roll the framework out to subsidiaries, plan for a GRC tool and set up a risk committee with a formal charter.

Regulated organizations, such as banks, insurers and public bodies, often face specific rules on risk governance. Plan the roadmap with your compliance team and confirm what your regulator expects. Use the frameworks as a planning reference and check exact requirements in the official documents or with your auditors.

Common mistakes to avoid

  • Treating ERM as a compliance exercise produces a register nobody reads, so tie the top risks to the strategy and to real decisions.
  • Letting the risk team own every risk removes accountability, so assign each enterprise risk to one named executive.
  • Using vague risk descriptions like cyber makes scoring inconsistent, so write each risk with a cause, an event and a consequence.
  • Skipping the risk appetite leaves no basis for decisions, so agree an appetite statement per category before the first report.
  • Reporting only heat maps hides whether anything changes, so add actions due, key indicator trends and risks outside appetite.
  • Running workshops once a year lets the register go stale, so review the top risks every quarter with their owners.

Frequently asked questions

What are the main steps to implement enterprise risk management?

Get a mandate from leadership, choose a framework and write the risk policy, identify and assess risks in workshops, agree response plans for the top risks, set up regular reporting and then embed risk review into planning and investment decisions.

How long does it take to implement ERM?

A first working program often takes around a year: policy and register in the first half, response plans and reporting in the second. Reaching a mature, embedded program usually takes several years of review and improvement.

What is the difference between COSO ERM and ISO 31000?

Both are widely used references for risk management. COSO ERM focuses on linking risk to strategy and performance and is common in organizations with US reporting ties. ISO 31000 offers broad principles and a process that fits any organization. Many companies take ideas from both, so check the official texts for details.

Who is responsible for enterprise risk management?

The board oversees ERM and approves the risk appetite. The CEO and executive team own the main risks. A Chief Risk Officer or Head of Risk designs and runs the program, and internal audit provides independent assurance.

What should an ERM roadmap include?

It should include the mandate and scope, the framework and policy work, the risk assessment schedule, response plans, reporting and governance, embedding steps, owners for each phase and the dates when the board will see results.

Generate this roadmap with AI