Why ERM Needs Explicit Boundaries
An enterprise-wide view is not a promise to monitor every possible event everywhere. It is a deliberate definition of which parts of an organization, which objectives and decisions, and which risks are included in the enterprise risk management framework. Without clear boundaries, separate teams may use incompatible assumptions about what “enterprise-wide” means. A risk may be missed because it arises in an outsourced activity, or a local issue may be escalated without a clear connection to the organization’s objectives.
The earlier material on ERM’s objectives and value proposition establishes why an organization uses ERM. Defining scope makes that purpose operational: it states where the framework applies and what it is intended to help decision-makers understand. Scope should be broad enough to capture material threats and opportunities, but sufficiently explicit that responsibilities and exclusions can be understood.
Three Dimensions of Scope
A useful scope statement addresses three distinct dimensions. They are related, but they are not interchangeable: covering an entity does not automatically mean that every objective or risk connected to it has been considered.
- Organizational scope: which legal entities, business units, geographies, functions, and relationships are included. An organization may include its parent and controlled subsidiaries, for example, while separately describing joint ventures or service providers.
- Strategic scope: which objectives, plans, decisions, and time horizons the framework supports. This may include financial resilience, policyholder service, growth plans, regulatory obligations, or a proposed product launch.
- Risk scope: which sources, events, and consequences are considered because they could affect those objectives. It includes the activities that create exposures and may also include external events or dependencies outside the organization’s control.
The risk categories established in the earlier material on enterprise risk taxonomies can help organize the risks within scope. They do not, by themselves, set the boundary. A category such as operational risk may be relevant to an included outsourcing arrangement, but the category label alone does not determine whether that provider, service, or resulting exposure is covered by the framework.
Worked Example: Setting Scope for a Controlled Subsidiary
A hypothetical insurer owns a controlled subsidiary that administers claims for the parent and two external clients. The insurer’s ERM framework is intended to support its group solvency objective and its objective of providing timely service to policyholders. Determine how to describe the subsidiary’s scope and identify a risk that crosses the boundary.
Method. Separate the organizational perimeter from the objectives and the risks. Then distinguish the subsidiary’s activities that serve the parent from its activities for external clients.
Organizational scope. The controlled subsidiary should be explicitly listed as included, or its relevant activities should be explicitly included. A group-wide framework that says only “the insurer” leaves an avoidable ambiguity about the subsidiary.
Strategic scope. The parent’s solvency and policyholder-service objectives are in scope. If the subsidiary’s external-client work can affect its capacity to administer the parent’s claims, that work is relevant to the parent’s objectives even though the external clients’ objectives are not themselves part of the parent’s ERM scope.
Risk scope. Consider a staffing shortfall at the subsidiary that delays claims for the parent. The source is a shortage of trained staff; the event is delayed claim processing; the consequence may be poorer policyholder service and increased operating costs. This is in scope because it can affect an included parent objective.
Boundary treatment. The external clients’ unrelated business risks need not be managed as if they were the parent’s own risks. However, the subsidiary’s shared systems, staff, and service capacity are dependencies that may transmit risk to the parent. The common mistake is to exclude all external-client activity merely because it is outside the parent’s direct business. The correction is to include material connections to the parent’s objectives while keeping the clients’ separate objectives outside the parent’s scope.
Check. The scope statement identifies the subsidiary, the parent objectives, and the material service dependency; it does not claim that the parent controls the external clients’ risks.
Drawing the Organizational Boundary
The organizational boundary is often based on legal ownership and control, but legal structure is not the only relevant consideration. A framework may need to address an entity or activity that is not controlled by the organization if it can materially affect an included objective. Conversely, an entity within a corporate group may require a clear description of its role if its objectives, regulation, or operating model differ from those of the parent.
For each boundary decision, identify the entity or relationship, the reason for including or excluding it, and any material connections that remain relevant. Examples include:
- Controlled subsidiaries: state whether they are included directly or through group-level oversight.
- Joint ventures and associates: distinguish ownership from control, and explain how shared decisions or exposures are addressed.
- Outsourced providers: the provider may be outside the legal perimeter, while the service dependency and risks to the organization’s objectives remain inside the risk scope.
- Branches and geographies: specify whether the framework covers all locations and whether local requirements create distinct considerations.
- Temporary arrangements: acquisitions, divestitures, major projects, and transitions may need explicit treatment while they are underway.
An exclusion should not be a silent gap. Record its rationale, the decision-maker, any conditions under which it will be revisited, and the route for raising a risk that crosses the boundary. Excluding an activity from routine reporting does not make its effects irrelevant if those effects could reach an objective within scope.
Drawing the Strategic and Risk Boundaries
Strategic scope clarifies which objectives and decisions the framework serves. If the organization is considering entry into a new market, for example, a framework limited to current operations may fail to provide a useful view of the risks of that strategic decision. Scope should therefore identify relevant planning horizons and significant decisions, not merely list current departments.
Risk scope then asks which risks could affect the included objectives. A risk does not have to originate inside the organization to be in scope. A natural catastrophe near a key service provider, a change in law, or a disruption to a critical supplier may affect the organization through a dependency. In contrast, an event with no plausible material connection to an included objective need not be tracked as an enterprise risk merely because it is imaginable.
Earlier material on risk sources, events, and consequences helps make these connections precise. For each candidate risk, state the source, event, and potential impact, then identify the objective that could be affected. This avoids a boundary decision based only on a broad label or on the physical location where the risk arises.
Worked Example: Evaluating an Outsourced Technology Service
A hypothetical regional insurer outsources its customer portal to a technology provider. The insurer’s objectives include maintaining access to policy information and meeting its customer-service commitments. A provider’s subcontractor hosts a database in another country. Decide what belongs within the insurer’s ERM boundary.
Method. Trace the service dependency from the provider to the insurer’s objectives. Do not confuse legal control of the provider with responsibility for understanding the insurer’s exposure.
Organizational scope. The provider and subcontractor are not assumed to be controlled entities. They can be identified as external dependencies rather than included as insurer business units.
Strategic scope. Access to policy information and customer service are included objectives. The portal supports both, so its availability and integrity are relevant to the framework.
Risk scope. A subcontractor outage could interrupt database access; customers might then be unable to retrieve policy information, affecting service commitments. A data-access failure could also create confidentiality or compliance consequences, depending on the facts. These potential impacts are in scope because they connect the external service to insurer objectives.
Boundary treatment. Include the insurer’s dependency, its exposure to interruption, and the process for obtaining relevant information from the provider. Do not imply that the insurer’s ERM framework governs all of the provider’s other clients, systems, or objectives. A common mistake is to treat “outsourced” as equivalent to “outside ERM.” The correction is to distinguish the provider’s organizational status from the insurer’s in-scope reliance on its service.
Check. The boundary includes the material risk pathway to the insurer’s objectives without extending the insurer’s framework to unrelated provider activities.
A Simple Scope-Completeness Diagnostic
A practical review can test whether the stated strategic scope is connected to risk ownership. This is a diagnostic, not a universal ERM performance measure: it indicates whether objectives have an explicit risk-management connection, not whether the risks are well controlled or the organization is safe.
The ratio follows from the question being asked: the numerator counts objectives that meet the stated coverage condition, and the denominator counts all objectives within scope. For example, if eight objectives are in scope and six have an identified owner and escalation route, then \(n/N=6/8=0.75\), or 75%. The remaining two objectives are visible gaps to investigate. This does not establish that the framework is effective: an owner may be named without adequate analysis, and the diagnostic says nothing about the quality of risk assessment.
The count also depends on a consistent definition of an objective. If one team counts a broad goal as a single objective while another divides it into several sub-objectives, comparisons will be misleading. The organization should define the unit being counted and use the same scope date and inclusion criteria throughout the calculation.
Worked Example: Testing Coverage Across Objectives
A hypothetical insurer lists five approved objectives in the scope of its ERM framework: preserve capital adequacy, maintain claims service, complete a claims-system migration, comply with new reporting requirements, and expand distribution through brokers. The framework has named owners and documented routes for material risks for the first four, but not for broker expansion. Calculate the diagnostic and state what it does and does not show.
Method. Count all in-scope objectives for the denominator, then count only those meeting both stated conditions for the numerator.
There are \(N=5\) approved objectives. Four have an identified owner and a documented route, so \(n=4\). Therefore:
The calculation shows that 80% of the listed objectives meet the diagnostic’s coverage condition. Broker expansion is the identified gap because it lacks the required owner and route. The result does not show that the other four objectives have adequate controls, nor does it indicate how much risk the unassigned objective creates.
Common mistake. Counting only the four objectives that already have owners gives \(4/4=100\%\), but that omits the uncovered objective from the denominator. The correction is to use all five approved, in-scope objectives, so the reported proportion is 80%.
Check. The numerator is a subset of the denominator, and the missing objective remains visible rather than disappearing from the assessment.
Maintaining the Boundary
Scope is a management choice that should be explicit and revisited when the organization or its objectives change. An acquisition may add a new entity; a new product may introduce unfamiliar activities; outsourcing may create a critical dependency; or a strategic change may make a previously immaterial exposure relevant. A boundary that was reasonable at one point can become incomplete.
When reviewing scope, ask:
- Are all relevant entities, activities, and important external dependencies identified?
- Are the objectives and decisions the framework supports stated clearly?
- Can a material risk be traced to an objective, even if its source lies outside the organizational perimeter?
- Are exclusions, shared responsibilities, and escalation routes documented?
- Have changes in strategy, structure, geography, or critical services been considered?
The common exam trap is to equate “enterprise-wide” with either “everything in the legal group” or “every risk imaginable.” Neither definition is sufficient. The first may overlook material external dependencies or strategic decisions; the second offers no workable criterion for relevance. The stronger approach is to define organizational, strategic, and risk scope separately, then connect them through plausible effects on objectives.
Check Your Understanding
For each problem, identify the relevant scope decision and show the key reasoning before checking the final answer.
- A hypothetical insurer includes its parent and controlled subsidiaries in its ERM scope. A joint venture is not controlled, but it provides a shared claims platform used by the parent. Should the joint venture be treated as an included subsidiary? What should the framework capture? (Answer: Do not label it a controlled subsidiary; capture the material shared-platform dependency and risks to the parent’s in-scope objectives.)
- A company’s ERM statement covers current operations but not a proposed entry into a new region. The board will decide on the entry this year. Is the decision necessarily outside strategic scope because operations have not begun? (Answer: No; the proposed entry is a material strategic decision and should be included if the framework is intended to inform it.)
- A service provider has a cyber incident affecting a system used by an insurer. The provider serves many unrelated clients. Which boundary is relevant to the insurer, and which part need not be treated as the insurer’s own exposure? (Answer: The insurer’s dependence on the affected system and resulting impacts on its objectives are in scope; unrelated provider-client activities need not be treated as insurer risks.)
- A framework lists 12 objectives, of which 9 have both a named risk owner and a documented route for material risks. Calculate the illustrative objective-coverage proportion. (Answer: \(9/12=0.75\), or 75%.)
- A business unit is excluded from routine enterprise reporting because its risks are considered immaterial. A new acquisition makes its systems critical to a major in-scope service. What should happen to the boundary? (Answer: Reassess the exclusion; the new dependency may make the unit or its relevant activities and risks material to an in-scope objective, so document the revised boundary and responsibilities.)