Risk Management & Enterprise Resilience

What enterprise risk management covers

Enterprise risk management (ERM) is the structured discipline of identifying, assessing, treating and monitoring risks that could prevent an organisation from achieving its objectives. Modern ERM covers strategic, operational, financial, compliance, cyber, climate and reputational risks - moving well beyond traditional operational risk registers.

Core risk management frameworks

COSO ERM Framework

The COSO ERM Framework (updated 2017) integrates risk management with strategy setting and performance. It is the most widely adopted framework globally, particularly for organisations with US regulatory exposure.

ISO 31000

ISO 31000 provides principles and generic guidelines applicable to any type of risk. It is widely adopted in Europe, Africa and Asia, and is often paired with sector-specific standards.

Risk appetite and tolerance

Setting explicit risk appetite - the aggregate level of risk an organisation is willing to take - is now standard board practice. Well-designed risk appetite statements translate into operational risk tolerance limits that give managers clear decision authority.

Business continuity and crisis management

COVID-19 exposed how many organisations had business continuity plans that only worked for narrow scenarios. Modern business continuity practice emphasises:

• Scenario planning across multiple simultaneous disruptions
• Dependency mapping across critical business services
• Regular live testing rather than paper exercises
• Crisis command structures with pre-authorised decision rights
• Stakeholder communication playbooks tested in advance

Financial risk management

Financial risk covers credit, market, liquidity and operational risk in financial contexts. In African markets, currency risk and sovereign risk are additional dimensions that require active management by any organisation with cross-border exposure.

Cyber and technology risk

Cyber risk has moved from IT department concern to board-level oversight. Every executive team should understand ransomware exposure, data breach implications, third-party technology risk, and cyber insurance economics.

Climate and environmental risk

Physical and transition climate risk now feature in every serious risk register. Organisations with agricultural exposure, coastal infrastructure, or fossil-fuel value chains need particular attention here - discussed further in our sustainability portfolio.

Internal controls and audit

Effective internal controls are the mechanism by which risk management translates into daily operations. Modern internal controls emphasise design effectiveness (controls that address actual risks) over operating effectiveness (controls that pass audit tests).

Risk management for central banks and financial regulators

Central banks and financial-sector regulators face particular risk management challenges: managing systemic risk, foreign exchange reserves, monetary policy transmission, and integrated risk-compliance-governance frameworks. TrustGate delivers specialist training for central bank risk teams across the region.

Risk management training with TrustGate

Our risk portfolio serves risk officers, chief risk officers, internal audit teams and executive teams responsible for enterprise risk oversight. Programmes cover both foundational frameworks and specialist areas (financial risk, cyber risk, ESG risk, business continuity), with case studies from African corporate and public-sector contexts.