Which one of the following statements is correct about the enterprise-wide risk management process?

Enterprise-wide Risk Management (ERM) is a dynamic and cyclical process, not a static project with a defined end. The final step, "Monitor and Assure," ensures the process is continuous. This involves regularly reviewing risk treatments, scanning for new risks, and revising the framework to adapt to changes in the internal and external environments. This iterative nature allows an organization to continuously improve its risk management capabilities and ensure the process remains aligned with its strategic objectives. The goal is to embed risk management into the organization's culture and decision-making at all levels.

A. Risk analysis is the third step in the ERM process, following environmental scanning and risk identification.

B. ERM is an ongoing and dynamic process that must adapt to changing conditions, not a static, one-time assessment.

D. ERM has a holistic scope, addressing all major risk categories—strategic, operational, financial, and hazard—not just pure or insurable risks.

1. The Institutes. (2022). CPCU 500: Managing Evolving Risks (1st ed.).

For Correct Answer (C) and Incorrect Answer (B): Chapter 2, "The Enterprise-Wide Risk Management Process," section "Monitor and Assure," describes this final step as making the process a "continuous loop" and emphasizes that ERM is a "dynamic process."

For Incorrect Answer (A): Chapter 2, "The Enterprise-Wide Risk Management Process," Exhibit 2-1, "The ERM Process," visually depicts the five steps in order, showing "Analyze Risks" follows "Identify Risks."

For Incorrect Answer (D): Chapter 1, "Foundations of Risk Management," section "Scope of Risk Management," explains that ERM expands beyond traditional risk management to include strategic, operational, and financial risks in addition to hazard (pure) risks.