From Separate Risk Practices to an Enterprise View
An insurer may have capable specialists managing underwriting, claims, technology, finance, and compliance risks. The difficulty is that a risk rarely respects an organizational chart. One event can affect several functions, or a decision in one area can create consequences elsewhere. If each function considers only its own responsibilities, the organization may miss the full pathway from cause to enterprise impact.
Enterprise risk management (ERM) means taking a coordinated view of risks across the organization, including how they relate to objectives, how they share causes, and how their consequences can connect. ERM does not replace specialist judgment or require every risk decision to be made centrally. It adds an enterprise perspective to function-specific identification, assessment, and response.
A risk taxonomy can help people use consistent categories and names, but classification alone does not make risk management integrated. Two functions might classify risks consistently and still assess them separately, report different parts of the same scenario, or miss a cause that affects both. ERM asks a further question: what does this combination or connection mean for the organization as a whole?
What Siloed Views Can Miss
A separate functional assessment can be useful: specialists know their processes and can identify controls that others may not see. The limitation arises when a local view is mistaken for a complete view. Three common gaps are:
- A shared cause: one event or control failure can affect multiple functions, even when each function records a different risk.
- A linked sequence: an initial problem can trigger follow-on consequences in other areas, so the ultimate impact is broader than the first loss recorded.
- An incomplete or duplicated total: local reports may omit consequences outside their remit, or count the same cost in more than one function.
These gaps do not mean that every pair of risks must be combined or that every shared cause will produce a large loss. The relevant question is whether a plausible scenario connects the exposures and changes the organization’s understanding or response. The scenario should be described clearly enough to identify what happens, which impacts follow, and which amounts are distinct.
A Simple Way to Reconcile Enterprise Impacts
For a specified scenario, let \(L\) denote the total impact being assessed. Divide the impact into distinct direct costs \(c_j\) and any additional interaction or follow-on impacts \(h_k\). If the items are defined so that no dollar is counted twice, then:
This is an accounting identity for a scenario, not a formula for a probability or a general measure of risk. It holds because the total impact is partitioned into non-overlapping items. If a cost is already included in a direct impact, it cannot also be added as an interaction impact. If a consequence is outside the selected scenario or outside the organization’s defined scope, it should not be silently treated as part of the total.
A siloed report might capture only a subset of the \(c_j\), omit some \(h_k\), or include the same item under multiple owners. An enterprise view reconciles these components and makes the scenario’s boundaries explicit. No assumption that risks are independent is needed to add distinct realized costs within one specified scenario.
Worked Example: One Weather Event, Several Business Impacts
A hypothetical insurer assesses a severe storm that floods its regional claims office. The scenario assumes the following incremental impacts, all measured in millions of dollars: building and equipment damage, $1.20; temporary claims-handling overtime, $0.35; additional funding cost from delayed premium processing, $0.08; and customer concessions for service delays, $0.17. The amounts are defined as distinct costs, with no item included in another. What is the scenario’s total impact, and how much would a property-only report omit?
Method. Treat the stated impacts as non-overlapping components of one hypothetical scenario and add them. This gives the enterprise scenario total rather than the loss recorded by one function.
Step 1: Add the functional impacts. Claims overtime and delayed premium processing together contribute \(0.35+0.08=0.43\) million dollars.
Step 2: Add customer concessions. The non-property impacts total \(0.43+0.17=0.60\) million dollars.
Step 3: Include the property damage. The total is \(1.20+0.60=1.80\) million dollars.
Check. Adding each component in order gives \(1.20+0.35=1.55\), \(1.55+0.08=1.63\), and \(1.63+0.17=1.80\) million dollars.
Answer. The scenario impact is $1.80 million. A property-only report records $1.20 million and omits \(1.80-1.20=0.60\) million dollars of other consequences.
Common mistake avoided. Reporting only the $1.20 million property loss treats the initiating damage as the whole scenario. The correction is to include distinct consequences in claims, finance, and customer service, while checking that none is already included in another amount.
Why the Connection Matters
A shared cause may be recorded under different names by different teams. A technology team might track a system outage, claims might track processing delays, and finance might track late cash receipts. These labels can all be reasonable within their functions. An enterprise view asks whether they are separate events or different manifestations of one scenario, and whether the combined consequences matter for objectives that cut across the functions.
The same principle applies when risks occur in sequence. For example, a data problem might lead to a flawed decision, which then leads to customer or regulatory consequences. Considering only the first event can understate what is at stake; treating every step as an unrelated event can obscure the causal chain. ERM makes the connections visible without assuming that every consequence is certain.
It is also important to distinguish connecting risks from indiscriminately adding every number in different reports. Functional reports may have different time periods, definitions, scenario conditions, or overlapping cost items. A meaningful enterprise comparison first aligns those bases and checks for overlap. It then asks whether the combined scenario changes the organization’s priorities or the action required.
Worked Example: A Product-Launch Chain Across Functions
A hypothetical insurer is reviewing a new small-business product. A scenario begins with a flawed data mapping used in a pricing model. The scenario assessment assigns $0.12 million to model correction and validation, $0.32 million to the underwriting shortfall from affected policies, and $0.21 million to filing rework and customer remediation. Each amount is incremental and non-overlapping. For this exercise, each function escalates an exposure only when its own amount exceeds $0.40 million. What does a siloed threshold review show, and what does the enterprise scenario show?
Method. Trace the stated sequence, add its distinct impacts, and compare the result with both the functional threshold and the enterprise scenario threshold. Assume, separately, that the organization’s hypothetical enterprise review threshold is $0.40 million.
Step 1: Review each function in isolation. Model correction is $0.12 million, below $0.40 million. The underwriting shortfall is $0.32 million, also below $0.40 million. Filing rework and remediation are $0.21 million, again below $0.40 million. Therefore, none of the three amounts crosses the stated function-level threshold.
Step 2: Trace the chain. The data-mapping problem is the initiating cause. It creates a pricing-model correction need; affected pricing then produces an underwriting shortfall; and correcting the product creates filing and customer-remediation work. These are connected consequences in the scenario, not three unrelated scenarios.
Step 3: Add the distinct impacts. The total is \(0.12+0.32+0.21=0.65\) million dollars. The intermediate sum is \(0.12+0.32=0.44\), and \(0.44+0.21=0.65\).
Check. Each component is less than $0.40 million, but the combined $0.65 million is greater than $0.40 million. The enterprise scenario therefore crosses the stated enterprise review threshold.
Answer. A siloed review finds no individual amount above the functional threshold, while the connected scenario totals $0.65 million and exceeds the hypothetical enterprise threshold.
Common mistake avoided. Concluding that there is no material issue because the largest individual amount is $0.32 million ignores the linked sequence. The correction is to assess the complete scenario and add only its distinct impacts. The thresholds here are hypothetical decision rules, not universal standards.
Shared Causes and Organization-Wide Exposure
A different challenge arises when one control, supplier, or service supports several business areas. Each area may assess its own interruption consequence, but the cause is common. If each area plans only for an isolated disruption, the organization may fail to recognize that one event could affect all of them at once.
This does not mean a shared provider makes every loss certain, or that one should add unrelated estimates without checking their assumptions. It means the assessment should state the common-cause scenario and test which distinct impacts could occur together under that scenario. That can reveal a need for coordinated planning, clearer ownership, or a response that spans functions.
Worked Example: A Shared Service Failure Across Business Units
A hypothetical insurer uses one identity service to support three business units. In a scenario where the service is unavailable for a full business day, the units estimate distinct interruption impacts of $180,000, $220,000, and $160,000, respectively. A separate central recovery estimate is $140,000 and is not included in any unit estimate. The hypothetical enterprise review threshold is $600,000. Determine the total scenario impact and whether it crosses the threshold.
Method. Treat the outage as one shared-cause scenario. Add the three distinct unit impacts and the separate central recovery cost, then compare the result with the stated enterprise threshold.
Step 1: Combine the unit estimates. In thousands of dollars, the three impacts total \(180+220+160=560\). The intermediate sum is \(180+220=400\), followed by \(400+160=560\).
Step 2: Include the central recovery cost. The central cost is additional, so the total is \(560+140=700\) thousand dollars.
Step 3: Compare with the threshold. The scenario exceeds the $600,000 threshold by \(700-600=100\) thousand dollars.
Check. In dollars, the same calculation is \(180{,}000+220{,}000+160{,}000+140{,}000=700{,}000\).
Answer. The enterprise scenario impact is $700,000, which is $100,000 above the hypothetical review threshold.
Common mistake avoided. Looking only at the largest unit estimate, $220,000, misses the shared service failure and the separate recovery cost. The correction is to evaluate the common-cause scenario across all affected units and include only costs that are additional rather than already embedded in unit estimates.
Practical Boundaries and Common Traps
An integrated view should clarify accountability, not erase it. Functional owners remain essential for understanding local processes, controls, and consequences. Enterprise coordination helps those owners share relevant information and makes it possible to see connections that do not fit neatly within one reporting line. It should also identify who is responsible for coordinating a cross-functional response.
- Do not confuse a shared label with a shared event. Similar category names do not prove that two exposures have the same cause or occur together.
- Do not assume a shared cause makes every impact additive. Define the scenario and check whether estimates overlap.
- Do not stop at the initiating event. Trace plausible downstream consequences that affect other functions or objectives.
- Do not treat ERM as centralization of every decision. The goal is a coordinated enterprise view alongside appropriate specialist ownership.
For exam-style analysis, state the scenario, identify which functions are affected, distinguish direct from follow-on consequences, and explain how the integrated view differs from each local assessment. If amounts are provided, show how they are reconciled and check for duplicate costs. The central point is not simply that “more risks are present”; it is that relationships among risks can change what the organization sees and how it responds.
Check Your Understanding
For each hypothetical scenario, distinguish the local view from the enterprise view. Answers include the key calculation or conclusion.
- A claims system outage creates $90,000 of overtime cost, $45,000 of vendor support cost, and $35,000 of customer concessions. Assume all amounts are distinct. What is the scenario total, and what does a report that records only overtime omit? (Answer: Total is $170,000; the overtime-only report omits $80,000.)
- A hypothetical process failure produces $0.18 million in policy-administration rework and $0.27 million in claims correction. The two costs are distinct and arise from one shared data error. What is the combined scenario impact? (Answer: $0.18 million + $0.27 million = $0.45 million.)
- Three business areas each estimate a distinct $140,000 impact from failure of the same authentication service. A separate $90,000 recovery cost is not included in those estimates. What is the total impact? (Answer: \(3 \times \$140{,}000+\$90{,}000=\$510{,}000\).)
- A hypothetical product issue creates $0.10 million in technical correction, $0.29 million in underwriting impact, and $0.16 million in remediation. Each function has a $0.30 million escalation threshold, while the enterprise review threshold is $0.50 million. All amounts are incremental. Which thresholds are crossed? (Answer: No function-level threshold is crossed; the $0.55 million combined scenario exceeds the $0.50 million enterprise threshold.)
- A service interruption produces $240,000 in unit A’s direct costs, $190,000 in unit B’s direct costs, and $80,000 in recovery costs. Unit A’s estimate already includes $30,000 of the recovery work, so that amount must not be counted twice. What is the corrected total? (Answer: $240{,}000+$190{,}000+($80{,}000-$30{,}000)=$480{,}000.)