Enterprise and Financial Risk Management

01Purpose and scope

• This manual supports the course Enterprise and Financial Risk Management. It is written for analysts, controllers, treasury staff, internal audit members, and managers who are asked to identify, measure, and respond to risks that could affect an organization's earnings, liquidity, capital, or reputation.
• The manual covers the full cycle used in most organizations: setting risk appetite, building a risk inventory, quantifying exposures, selecting responses, monitoring indicators, and reporting to the people who own decisions. It focuses on practice, not theory, so the examples come from the situations where risk teams usually spend their time, such as a manufacturer with foreign currency receivables, a regional lender with concentrated commercial real estate exposure, or a software company with large deferred revenue balances.
• The scope is enterprise wide, meaning it looks across business units, functions, and geographies rather than only at a single trading desk or loan book. It does not replace the specialized methods used inside a bank's market risk or credit risk group, although the same concepts carry over. Practice varies with size, sector, and regulatory status. A privately held company with no lenders may need a light register and an annual review cycle, while a listed financial institution faces formal capital and reporting obligations that are set by its supervisors.
• This guidance does not replace qualified professional judgment, approved internal procedures, or required authorization from boards, audit committees, or regulators. Where legal or regulatory requirements apply, confirm them with the current authoritative source in the relevant jurisdiction and with qualified counsel or auditors.

02Core principles

• Risk is the effect of uncertainty on objectives. Most practitioners find it useful to define each risk in terms of the objective it threatens, such as meeting a covenant, funding a capital project, or keeping gross margin above a target. A risk without a linked objective tends to stay vague and rarely gets owned.
• Risk appetite and risk tolerance are different. Appetite is the amount and type of risk the board is willing to accept in pursuit of strategy. Tolerance is the acceptable variation around a specific target. A useful appetite statement names limits in measurable terms, for example a maximum net open foreign exchange position, a minimum liquidity coverage, or a cap on single customer concentration as a share of receivables.
• Exposure should be measured before it is managed. Gross exposure, net exposure after natural offsets, and residual exposure after controls are three different numbers, and mixing them causes confusion in committee discussions. Expected loss, unexpected loss, and tail outcomes also answer different questions, so the method should match the decision being made.
• Responsibility should sit with the business owner of the activity that creates the risk. The risk function sets the framework, challenges assumptions, and reports results, but it should not take over ownership. Separation of duties matters here: the person who approves a hedge should not be the same person who books and values it without review.
• Models and assumptions are simplifications. Value at risk, scenario analysis, and loss distributions all depend on historical data, correlation assumptions, and judgment about what could happen next. Results should be stated with their limitations, and the practitioner should know which assumption would change the answer most.

03Planning and preparation

• Start by confirming the scope and the decision the work will support. A risk assessment for a quarterly board pack is different from a risk assessment supporting a new credit product or an acquisition. Write down the objective, the audience, the deadline, and the data available before building anything.
• Gather the governing documents. These typically include the board approved risk appetite statement, the existing risk register, internal policies for treasury, credit, liquidity, and operational risk, the delegation of authority matrix, and any relevant covenant schedules in loan agreements. If these documents are out of date or missing, flag that first, because a risk framework built on stale policies will drift from practice.
• Identify stakeholders and their roles. Typical roles include the chief risk officer or equivalent, the chief financial officer, treasurer, controller, internal auditor, business unit leaders, and the audit or risk committee of the board. Decide who provides data, who validates it, who challenges conclusions, and who signs off. Name these people in the plan.
• Choose the framework and vocabulary. Many organizations adopt the COSO enterprise risk management framework for governance and integration with strategy, or ISO 31000 for a process oriented approach to risk identification, analysis, evaluation, and treatment. Pick one as the backbone and map other requirements to it, so that teams do not maintain three competing taxonomies.
• Set data standards early. Decide the currency for reporting, the valuation date convention, the source system for each exposure, and the frequency of refresh. Reconciling risk data to the general ledger or to the treasury system is often the most time consuming step, so plan for it explicitly rather than assuming the numbers will tie.

04Recommended workflow

1. 1
   : Define the objective and risk categories. List the business objectives the review must protect, then group risks into categories such as strategic, market, credit, liquidity, operational, compliance, technology, and reputational. Keep the list short enough that owners can remember it and long enough to avoid hiding risks in catchall buckets.
2. 2
   : Build or refresh the risk inventory. Run structured workshops with each business unit, using prompts tied to recent events, budget assumptions, and known concentrations. Record each risk with a clear description, a cause, a consequence, and an owner. Avoid describing risks as absences of controls, since that confuses risk with control weakness.
3. 3
   : Assess inherent and residual risk. Score each risk for likelihood and impact using defined scales that the organization has agreed in advance. Where quantitative data exists, use it, for example historical default rates for a loan portfolio, the percentage move in a commodity price over a holding period, or the number of days of cash on hand. Score the inherent risk before controls, then the residual risk after controls, and document the reason for each control credit.
4. 4
   : Quantify the material exposures. For financial risks, calculate sensitivities such as the change in net interest income for a 100 basis point parallel shift in rates, the change in portfolio value for a 10 percent currency move, or the cash runway under a stressed receivables collection scenario. Use a small number of defined scenarios that management understands, and keep the calculations traceable to source data.
5. 5
   : Select response strategies. For each material risk, choose to avoid, reduce, transfer, share, or accept the exposure. Examples include lowering a credit limit, entering a forward contract to hedge currency, buying insurance for property or cyber losses, or accepting a small expected loss where hedging costs exceed the benefit. Record the cost, the residual exposure, and the approver for each decision.
6. 6
   : Set limits, triggers, and key risk indicators. Translate the appetite statement into limits that the business can monitor. Define early warning triggers that call for escalation before a limit is breached, such as a rising days sales outstanding figure or a drop in the ratio of available liquidity to short term obligations. Assign the data owner and reporting frequency for each indicator.
7. 7
   : Test the plan with stress scenarios. Run at least one combined scenario that reflects how risks interact, such as a currency depreciation that raises the cost of imported inputs while slowing customer payments. Check whether the response strategies still hold under stress. Document any scenario that breaches a limit and the management action proposed.
8. 8
   : Report and escalate. Prepare a concise report for the executive team and the board or audit committee. Show the top risks, changes since the last cycle, breaches or near breaches, and the decisions required. Include a short note on model limitations and data gaps. Escalation paths should be written down so that owners know when to bring an issue upward without waiting for the next scheduled meeting.
9. 9
   : Monitor, update, and close the loop. Track actions to completion, confirm that controls operate as described, and update the register when the business changes. A new acquisition, a product launch, or a change in a key supplier should trigger a targeted reassessment rather than waiting for the annual cycle.

05Quality checks, risk controls and compliance

• Quality begins with data reconciliation. Before reporting exposures, tie the balances to the general ledger, sub ledgers, or treasury system. Record unreconciled differences and their causes. A risk report that does not tie to the books will be challenged, and the challenge will rightly undermine the rest of the analysis.
• Apply model validation proportionate to the risk. Models used for pricing, provisioning, or capital estimates should be reviewed by someone independent of the model developer. Check the input data, the assumptions, the calculation logic, and the back testing results where available. Simple spreadsheet tools used for sensitivity analysis still need version control, locked formulas for key outputs, and a documented owner.
• Control the use of derivatives and hedges. Hedge accounting in many jurisdictions requires formal documentation at inception, including the hedged item, the hedging instrument, the risk being hedged, and the method for assessing effectiveness. The applicable accounting framework, such as US GAAP or IFRS, sets these requirements, and the current authoritative text should be consulted with the company's auditors. Speculative positions should be separated from hedges and subject to their own limits and approvals.
• Address internal control over financial reporting. In US public companies, management's assessment of internal control over financial reporting is required under the Sarbanes-Oxley Act, and risks that affect reported numbers should be linked to controls that address them. Other jurisdictions have comparable requirements. Confirm the obligations that apply to your entity with the current official source and with the external auditor.
• Recognize the limits of generic guidance. Financial institutions face capital, liquidity, and conduct requirements set by supervisors, often based on the Basel framework as adopted in each jurisdiction. Insurers, utilities, and government contractors each have additional obligations. This manual describes common practice, but it cannot tell you which rules apply to your entity. Those answers come from the regulator's current publications and from qualified legal and compliance advisers.
• Protect the independence of the risk function. Risk reports should go to the executive and board level without being filtered by the business units they assess. Where the business disagrees with a risk rating, record both views and the reason for the final decision. Overrides should be rare, approved at the right level, and reviewed later to see whether they were justified.

06Collaboration and documentation

• Good risk work depends on regular contact between the risk function and business owners. A monthly working session with each business unit is often more productive than a single annual workshop. Use these sessions to review indicators, discuss emerging issues, and confirm that actions have progressed.
• Maintain a single risk register with a fixed set of fields: risk identifier, description, category, owner, inherent score, residual score, key controls, indicators, limits, response strategy, action plan, due date, and status. Keep version history so that changes can be explained later. Spreadsheets work for small organizations, while larger ones usually need a governance, risk, and compliance platform, but the structure matters more than the tool.
• Write decision records. When the committee accepts a risk, declines a hedge, or grants a limit exception, record the rationale, the alternatives considered, the approver, and the expiry date of the decision. Accepted risks should be revisited when conditions change, and the record makes that review possible.
• Share information with the external auditor and, where relevant, lenders or rating agencies, but only through agreed channels and with appropriate confidentiality. Covenant compliance reports and liquidity forecasts are common examples. Ensure that the figures shared externally match internal reports, or document the reason for the difference.
• Train owners on their responsibilities. Many risk failures happen because a business leader assumed the risk function was monitoring something that no one had actually been asked to watch. A short onboarding for new owners, with a copy of their risk entries and indicators, prevents this gap.

07Measures and continuous improvement

• Track process measures such as the percentage of material risks with a named owner, the percentage of indicators reported on time, the number of open actions past due, and the share of exposures reconciled to source data in the period. These show whether the framework is operating, not whether risks are being managed well.
• Track outcome measures such as the number of limit breaches, the size of losses against the risk appetite, the variance between forecast and actual cash flows, and the frequency of unplanned escalations. A rising count of breaches may mean the limits are too tight, the business is taking more risk, or the monitoring is improving. The reason should be investigated rather than assumed.
• Review the framework at least annually and after significant events. Look at near misses, actual losses, audit findings, and changes in regulation or in the business model. Compare the realized outcomes against the scenario assumptions and recalibrate where the gap is material.
• Be cautious with benchmarks. Peer comparisons can be useful for spotting outliers, but published industry figures vary in definition and coverage. Do not adopt a target from a survey without understanding how the data was gathered and whether it applies to your size and sector.

08Common mistakes and how to prevent them

• Mistake: treating the risk register as a compliance document. When the register is updated only before an audit, it stops describing reality. Prevent this by tying register reviews to the monthly management meeting and to the cash and liquidity forecast.
• Mistake: listing too many risks at the same level. A register with sixty risks rated high gives no priority. Use the scoring scale consistently, insist on a limited number of top risks for the board, and challenge scores that cluster in the middle.
• Mistake: confusing controls with risks. A statement such as no reconciliation performed describes a control gap, not the underlying exposure. Separate the risk, for example misstated receivables, from the control, for example monthly aging review, so that both can be tested.
• Mistake: relying on a single number. A value at risk figure or an expected loss estimate can look precise while hiding tail outcomes. Pair headline measures with stress scenarios and with a plain language explanation of what could go wrong.
• Mistake: letting hedges run without review. Hedges that are set up for one purpose can become mismatched after a sale, a contract cancellation, or a change in forecast. Review hedge positions against the underlying exposure at each cycle and document any ineffective portion.
• Mistake: ignoring concentration. Two customers, one supplier, or one country may dominate an exposure without triggering any single threshold. Report concentrations explicitly and set limits on them.

09Practical checklist

• Confirm the objective, audience, deadline, and data sources for the review before starting.
• Obtain the current risk appetite statement, risk register, and relevant treasury and credit policies.
• Agree the scoring scales for likelihood and impact and record them in the methodology note.
• Hold workshops with each business unit and record each risk with cause, consequence, and owner.
• Score inherent and residual risk separately and document the basis for every control credit.
• Reconcile exposure data to the general ledger or treasury system and list unreconciled differences.
• Quantify material financial exposures with traceable sensitivity or stress calculations.
• Record the response strategy, approver, cost, and residual exposure for each material risk.
• Set limits and early warning indicators with named data owners and reporting frequency.
• Run at least one combined stress scenario and document any limit breaches and proposed actions.
• Prepare the executive and board report with top risks, changes, breaches, decisions needed, and data gaps.
• Confirm applicable regulatory, accounting, and internal control obligations with current official sources and qualified advisers.
• Log actions with due dates, track them to closure, and schedule a targeted reassessment after major business changes.

★Learning sources

• Micro Degree: Enterprise and Financial Risk Management
• Micro Degree: Accounts Payable Management
• Micro Degree: Bank Reconciliation Operations
• Micro Degree: FinTech Fundamentals