Introduction
An ERM framework can be extensive and still fail to help an organization make better decisions. A large register, frequent reports, and detailed procedures may create the appearance of control while leaving managers unsure which risks matter, what information to trust, or what action to take. Conversely, a short framework may be useful if it directs attention to material uncertainties and supports timely decisions.
The practical task is to identify the design problem from evidence, then recommend a correction that addresses its cause without making the framework heavier than necessary. This tutorial focuses on four recurring failures: excessive complexity, compliance-only design, disconnected processes, and weak strategic relevance. These are diagnostic categories, not mutually exclusive labels; one organization can exhibit several at once.
Four Common Design Failures
A sound diagnosis distinguishes what the framework produces from what it enables. For example, a long risk report is evidence of reporting activity, but not by itself evidence that the framework is too complex. The stronger evidence is that users cannot identify the important issues, decisions are delayed, or the information is not used. Similarly, a risk register that cites regulatory requirements may be appropriate; the failure occurs when the framework is limited to recording compliance and does not help manage material business uncertainty.
| Failure | Typical evidence | Practical correction |
|---|---|---|
| Excessive complexity | Repeated data requests, unclear priorities, large reports with little use, or control steps that exceed available capacity. | Remove duplication, focus reporting on decision-relevant information, and scale procedures to the organization’s size and risk profile. |
| Compliance-only design | Activity is organized around completing checklists or submitting required documents, with little connection to managing changing exposures. | Retain necessary compliance controls while adding a forward-looking process for material risks, choices, and actions. |
| Disconnected processes | Different functions use inconsistent risk definitions, assumptions, reporting periods, or escalation practices. | Connect existing processes through agreed definitions, compatible information, and a workable cadence for sharing and acting on risk findings. |
| Weak strategic relevance | Risk reporting focuses on routine issues but overlooks uncertainties that could affect strategic objectives or major decisions. | Translate objectives and proposed changes into specific uncertainties, exposures, indicators, and decision points. |
Corrections should be proportionate. The goal is not to eliminate necessary documentation or standardization, but to make the framework usable for the decisions it is meant to support. A useful correction therefore specifies what changes, who will use the result in their work, and what observable evidence would indicate improvement. This is different from simply recommending “more training,” “more reporting,” or “a new policy.”
A Practical Diagnostic Method
In a case, first separate the stated concern from the evidence. “ERM is bureaucratic” is a concern; repeated submissions of the same information, long reporting delays, and unused reports are evidence. Next, identify the likely design cause and test whether another cause could explain the same symptom. Then recommend a targeted change, considering whether the organization can maintain it. Finally, name an indicator that would show whether the correction helped.
Identify where risk information is created, interpreted, communicated, or used. Look for concrete evidence rather than relying only on labels such as “immature” or “bureaucratic.”
Ask what feature of the framework produces the observed problem. For example, duplicate reports may reflect disconnected processes, excessive information requirements, or both.
Change the process, information, or scope that causes the problem. Preserve requirements that remain necessary and avoid adding a new layer without a clear purpose.
Use observable signs such as fewer duplicate requests, clearer prioritization, earlier discussion of emerging exposures, or documented changes to a decision.
Why Decision Linkage Matters
A risk process can influence action only if its output is available and usable when a relevant decision is made. It also needs to identify an issue clearly enough that decision-makers can interpret its importance. This gives a simple justification for testing each link: if information arrives after the decision, it cannot inform that decision; if it is not understood, it cannot guide a response; and if the framework does not connect it to a decision, collecting more of it may not change management.
This is not a claim that every risk can be reduced to a single indicator or that every decision will be changed by a report. It is a diagnostic test: when the framework repeatedly produces information that is late, unclear, or unused, examine the process that is supposed to connect information to decisions before proposing more data collection.
Worked Example: Reducing Excessive Complexity
A hypothetical regional insurer requires 18 business units to submit 40 risk indicators every month. The central team receives 720 indicator submissions per month. Many repeat prior information; the monthly report is delivered six weeks after month-end, and unit leaders say they cannot tell which items need action. The insurer has limited staff to validate the submissions. Diagnose the failure and recommend a correction.
Method. Separate the volume from the evidence of ineffectiveness, then tailor the reporting process to the decisions it is intended to support.
Step 1: Identify the evidence. The submission count is \(18 \times 40 = 720\) indicators per month. More important than the count alone, the report arrives six weeks after month-end, repeats information, and does not make priorities clear. Limited validation capacity adds a risk that reported figures will not be checked consistently.
Step 2: Diagnose. These facts support a diagnosis of excessive complexity and low decision usability. The problem is not simply that there are 40 indicators; it is that the volume, duplication, delay, and lack of prioritization prevent the reporting process from serving its intended users.
Step 3: Recommend a proportionate correction. Review the indicators against the decisions they support. Retain indicators that provide distinct, timely information about material exposures; remove duplicate or unused items; and assign clear definitions and reporting frequency to those retained. Use exception reporting for indicators that remain within agreed ranges, while requiring explanation and action plans for significant deviations. The insurer should confirm that the smaller set can be validated with available staff before adopting it.
Step 4: Check the result. Track report timeliness, the number of duplicate submissions, validation completion, and whether users can identify the items requiring action. If the revised report remains late or unused, reducing indicator count alone has not fixed the process.
Common mistake avoided. “Add a dashboard” does not address the underlying problem if it displays the same excessive, delayed, or poorly defined information. The correction simplifies and prioritizes the information before changing how it is displayed.
Compliance and Process Disconnection
Compliance is a legitimate component of ERM, but it is not a substitute for managing risk. A compliance-only framework tends to ask whether required documents exist or whether specified controls were completed. A broader risk process also considers whether exposures are changing, whether assumptions remain valid, and whether planned actions are sufficient for the organization’s objectives. The correction should preserve applicable compliance work while using its information as an input to risk decisions.
Disconnected processes create a different problem. Planning, operations, and risk reporting may each function on their own but fail to exchange comparable information. Simply assigning each process a risk label does not integrate them. Integration requires enough common language and timing for information from one process to be understood and used in another.
Worked Example: Moving Beyond a Compliance-Only Framework
A hypothetical insurer’s annual ERM package is built around a checklist of regulatory submissions and evidence that required policies were reviewed. A product team proposes selling a new add-on through a digital partner. The package does not prompt discussion of the partner’s service reliability, the insurer’s ability to handle customer complaints, or how the new product could change claims patterns. Identify the design failure and propose practical changes.
Method. Test whether the framework addresses only completion of formal requirements or also identifies uncertainties relevant to a proposed business choice.
Step 1: Name what works and what is missing. The checklist may support necessary compliance activities, so it should not automatically be discarded. However, it is backward-looking and does not surface several uncertainties associated with the proposed product and distribution arrangement.
Step 2: Diagnose. The primary failure is compliance-only design. The framework does not translate the proposed change into risks that could affect implementation, customers, or the insurer’s intended results. The examples in the case are not assumed to be realized losses; they are issues to assess before and during the change.
Step 3: Recommend a correction. Keep the submission and policy-review checklist, but add a focused risk assessment at the point of product approval and periodically after launch. It should consider partner service continuity, complaint handling capacity, and plausible changes in claims experience. For each issue, identify the evidence to monitor, the condition that would prompt review, and the response available to the business. The assessment should be proportionate to the product’s scale and uncertainty.
Step 4: Check the result. Evidence of improvement could include timely review of partner performance, clear escalation of service problems, and documented changes to implementation when monitoring identifies a material concern. Completing another checklist without these connections would not correct the design failure.
Common mistake avoided. Replacing all compliance work with a broad risk discussion would discard useful obligations. The correction supplements necessary compliance processes with forward-looking assessment; it does not treat the two purposes as interchangeable.
Worked Example: Connecting Disconnected Processes
A hypothetical mutual insurer has three processes. Underwriting reports exposure by policy count each quarter. Finance plans premium income using written premium by month. The claims team reports open claims by accident quarter. Each process is internally consistent, but the reports use different periods and definitions, and an emerging concentration in one territory is not visible in the combined management discussion. Recommend a correction without creating a large new reporting system.
Method. Identify what must be made comparable for the existing processes to inform one another, then preserve the useful detail within each team.
Step 1: Diagnose the connection gap. The teams report different measures and time bases. Policy count, written premium, and open claims describe different aspects of exposure and performance; none should be treated as a direct substitute for another. Their separate reporting also makes it difficult to recognize a developing territorial concentration.
Step 2: Define a focused shared view. Agree on a consistent territory classification and a common reporting cut-off for a concise periodic discussion. Each process can retain its specialist measures, but the shared view should explain what each measure counts and its time basis. Where a common exposure measure is feasible, define it consistently; where it is not, show the measures side by side with clear definitions rather than combining unlike quantities.
Step 3: Connect the information to review. Set a practical schedule for comparing territory exposure, premium, and claims indicators. Identify conditions that prompt investigation, such as a material change in territorial concentration or a divergence between exposure growth and claims experience. The relevant teams should investigate the signal and document whether an operating or planning action is warranted.
Step 4: Check the result. Assess whether the shared definitions are used, whether reports arrive in time for the scheduled review, and whether material differences lead to investigation. If the common view merely adds another report without changing comparison or follow-up, the process remains disconnected.
Common mistake avoided. Adding all three measures into one total would be invalid because they have different units and meanings. The correction standardizes what needs comparison and makes the distinctions explicit.
Strategic Relevance and the Limits of Templates
A framework has weak strategic relevance when its attention is directed toward routine or historically familiar issues while the organization’s objectives and major choices create different uncertainties. This is not necessarily a failure of risk measurement. It may be a failure to ask which risks could affect the strategy, or to revisit the assessment when the strategy changes.
A practical test is to start with a strategic objective or proposed change and work outward: what assumptions must hold, what could prevent the objective from being achieved, what evidence could signal that the assumptions are changing, and what decisions could respond? This approach does not require every strategic uncertainty to be precisely measurable. It does require the framework to make the uncertainty visible and to support an appropriate discussion.
Worked Example: Restoring Strategic Relevance
A hypothetical property insurer plans to expand into a coastal market over two years. Its ERM report consistently emphasizes office expenses, routine processing errors, and existing policy administration issues. It contains no assessment of the new market’s exposure characteristics, the assumptions behind expected growth, or the insurer’s capacity to serve the new area. Recommend a focused correction.
Method. Trace the strategic objective into its important assumptions, uncertainties, and decision points, without assuming that expansion should or should not proceed.
Step 1: Identify the mismatch. The report includes operational issues, but it does not address uncertainties that could materially affect the expansion objective. The absence of these issues from the report is evidence of weak strategic relevance, not proof that the expansion is necessarily too risky.
Step 2: Translate the objective into risk considerations. Identify assumptions about the market’s exposure profile, expected growth, available data, and operational capacity. Consider what could cause actual experience to differ from those assumptions and what information would be available before and after entry. Treat these as questions for analysis rather than as established facts about the hypothetical market.
Step 3: Connect assessment to decisions. Establish review points during the expansion, using agreed indicators and thresholds to prompt reassessment. For example, a material departure from planned growth or a capacity constraint could prompt further analysis before the next phase proceeds. The framework should make clear what evidence will be considered and what options are available, such as revising the pace or scope.
Step 4: Check the result. The revised process should show that strategic assumptions are reviewed, relevant information is monitored, and significant changes are brought into expansion decisions. A longer risk register is not evidence of success unless it captures and informs those choices.
Common mistake avoided. Declaring the expansion unacceptable based only on the existence of uncertainty confuses risk identification with a decision conclusion. The correction ensures relevant uncertainty is assessed and monitored; the decision depends on the organization’s objectives and evaluation of the evidence.
Common Diagnostic Traps
- Equating volume with complexity. A large organization may need extensive information. Diagnose excess by whether the information is duplicative, late, unusable, or beyond the capacity to maintain it—not by count alone.
- Equating compliance with risk management. Required controls and submissions may be necessary, but their completion does not establish that changing exposures or strategic uncertainties are being managed.
- Combining unlike information. Standardization helps comparison only when definitions, units, and time periods are clear. Do not add or compare measures as if they were equivalent when they are not.
- Prescribing a new structure before understanding the cause. A new committee, system, report, or policy can add cost without fixing poor information or weak decision linkage. First identify the failure mechanism.
- Recommending “more communication” without a process. State what information needs to be shared, when it is needed, and what review or action it should support.
- Assuming that a risk list proves strategic relevance. Test whether important objectives and changes are reflected in the assessment and whether emerging information can affect decisions.
Check Your Understanding
For each case, identify the principal design failure and select a practical correction that addresses its cause.
- A hypothetical insurer’s quarterly risk report contains 30 pages of indicators, but its business units receive it after planning decisions are finalized. What is the strongest diagnostic evidence, and what should be examined before adding indicators? (Answer: The report is untimely for planning decisions; examine which indicators are decision-relevant and how to deliver them before the decisions.)
- A risk team records completion of required policy reviews, but a proposed claims-processing change is not assessed for service disruption or operational capacity. What failure is present, and what should the correction add while retaining necessary policy reviews? (Answer: Compliance-only design; add a focused, forward-looking assessment of disruption and capacity, with monitoring and review points.)
- Underwriting and finance each report growth, but one uses policy counts and the other written premium, with different reporting periods. What is the trap in combining the figures, and how should the processes be connected? (Answer: The measures and periods are not directly comparable; define a shared reporting basis where feasible, explain remaining differences, and review the measures together.)
- A hypothetical insurer’s strategy includes entering a new region, but its risk reporting continues to focus only on existing administrative issues. Identify the failure and give two elements of a correction. (Answer: Weak strategic relevance; assess assumptions and uncertainties tied to the expansion, then monitor indicators at decision points that can prompt reassessment.)
- A small organization adopts a reporting process designed for a much larger institution. Staff submit overlapping information that is not validated, while key operating risks receive little attention. State a proportionate response and one measure of whether it worked. (Answer: Remove duplicative requests, focus on material decision-useful information, and scale validation to available capacity; measure whether reporting is timely and validated or whether material issues receive follow-up.)