The ERM framework, as proposed, requires an entity to identify the potential events that may affect its operations and requires the entity to systematically manage those risks with a particular emphasis on its risk appetite and strategic direction. The framework is predicated on the existence of sound controls and effective management.
Successful application of the framework requires managers to consider both current and planned or anticipated operational and market changes and to identify the risks arising from those changes. Once these risks have been identified comprehensively, assessed, and evaluated as to their potential impact on the organization, management must determine the effectiveness of existing controls and develop and implement additional mitigating controls where needed.