Updated October 1, 2026.
Enterprise risk management (ERM) is the disciplined process of finding what can hurt your organization, recording those risks in a living register, scoring them against your stated appetite, assigning owners, and choosing responses—avoid, reduce, transfer, or retain—so property damage, liability, and financial shocks do not arrive as surprises. For property owners and mid-size operators, the register is the spine; insurance is one transfer tool inside a broader mitigation framework, not a substitute for governance.
What ERM Means Outside the Fortune 500
ERM is not a binder of charts for the board alone. It is how you connect physical assets, contracts, people, and cash flow to decisions someone can defend six months later. Regulators and rating agencies expect documented risk identification and oversight; NAIC enterprise risk management materials describe how insurers and, by extension, their commercial policyholders are pressed to show coherent risk governance. State departments of insurance continue to tighten market conduct and financial examination standards, which flows through to what your carriers ask for at renewal.
If you own or operate commercial property, your ERM scope usually includes:
- Property and business interruption exposures (fire, wind, flood, equipment failure)
- General and specialty liability (tenant operations, contractors, products where relevant)
- Contractual risk (leases, indemnity, additional insured requirements)
- People and process (security, life safety, key-person dependency)
- Financial and strategic risks (concentration of tenants, capex timing, acquisition debt)
A solid risk assessment feeds the register; ERM turns that assessment into owned actions and measurable residual risk.
Building the Risk Register
Risk identification workshops
Start with structured workshops, not solo spreadsheet sessions. Pull facilities, finance, legal, operations, and—where you use them—brokers or risk consultants into the same room (or the same video call) with a pre-read of loss history, inspections, and open claims.
Work through asset classes and scenarios: what stops revenue, what injures people, what triggers regulatory notice, what voids coverage. Capture risks in plain language (“roof nearing end of life on Building 3”) rather than policy jargon. Tie each entry to a location, process, or legal entity so ownership is obvious later.
Property-specific hazard work should align with a thorough property risk assessment so insurable hazards are documented before you argue about limits and deductibles.
Likelihood and impact scoring
Score each risk on likelihood and impact using a scale your leadership will actually use—often 1–5 for each axis. Impact should reflect more than repair cost: include downtime, reputational harm, regulatory fines, and deductible outlays. Multiply or map the pair to a band (low, medium, high, critical) and document the definitions in a one-page scoring key so scores stay comparable year to year.
When you prepare for carrier meetings, recognize that underwriters run parallel logic; understanding how carriers evaluate property and liability exposures helps you align register priorities with what will actually move terms at renewal.
Risk appetite and tolerance
A risk appetite statement is leadership’s written answer to “how much of this risk do we choose to carry?” It is qualitative and quantitative: maximum uninsured property values in flood zones, acceptable days of business interruption without full indemnity, or caps on retained liability per occurrence.
Tolerance bands sit below appetite—yellow flags before you breach a hard line. Example: appetite might allow $500,000 per-location retained property loss; tolerance triggers review at $250,000 of identified gap. Appetite belongs in the register header or a linked policy memo; every high-rated risk should show whether it is inside or outside appetite.
Assigning owners and review cadence
Every register row needs a named owner, a target date for mitigation, and a status (open, in progress, accepted, closed). “The team” is not an owner. Facilities owns life-safety findings; finance owns covenant and liquidity risks; legal owns contract gaps.
Review cadence by tier: critical and high risks monthly or quarterly in a standing risk committee; medium at least semi-annually; full register refresh annually and after any acquisition, major loss, or material change in operations. Minutes should show what changed, not merely that a meeting occurred.
From Register to Mitigation Framework
Each material risk gets a primary response from the four classic strategies. Document the choice and the residual risk after the control or transfer is in place.
Avoid
Remove the activity or asset that creates the exposure. Exit a hazardous line of business, decline a tenant use that violates fire code, or cancel a project where geotech failure is probable. Avoidance is underused because it feels like giving up revenue; it is often the cheapest capital decision.
Reduce
Engineering, maintenance, training, and contractual controls lower likelihood or impact. Sprinkler upgrades, backup power, cyber segmentation for building systems, tighter contractor qualification, and documented COPE data all belong here. Reduction should reference standards you can prove in a claim—photos, test certificates, work orders.
Transfer
Shift financial consequence to another party. Commercial insurance is the dominant transfer for property owners: property, casualty, umbrella, flood where available, and specialty lines where generic policies gap. Program design matters more than shopping one line at a time; see commercial insurance program design for how packaged policies and specialty coverages fit together.
Transfer also includes contracts—indemnity, hold harmless, additional insured status, and risk transfer to vendors who are better positioned to control the hazard. Insurance and contract transfer should appear on the same register row so nobody assumes a certificate fixes a structural defect.
Capital markets transfer catastrophe risk far upstream of your policy. Catastrophe bond issuance reached roughly $18 billion across 83 Rule 144A and private transactions in the first half of 2026, per Artemis tracking—evidence that insurers and reinsurers are actively laying off peak cat exposure. That does not replace your coverage; it explains why cat-prone accounts face sharper questions, higher retentions, and more granular engineering data at renewal.
Retain
Keep the risk inside the organization, deliberately. Retention shows up as deductibles, self-insured retentions, captive participation, or unfunded acceptance of low-frequency risks. Match retention to liquidity: if paying a $250,000 deductible would strain covenants, your appetite statement is fiction.
Retention decisions should cite loss runs and forward spend; carriers price large accounts with the same history—loss runs, COPE data, and large-account underwriting are the mirror image of your retain-or-transfer math.
Connecting ERM to Insurance Purchasing
Insurance buying without a register is guesswork. The register tells you which risks must transfer now, which reductions unlock better terms, and which retentions are intentional.
Practical sequence:
- Rank register items by residual score after controls.
- Map mandatory transfers (leases, loans, statutory requirements).
- Compare transfer cost to retained expected loss plus volatility you cannot fund.
- Align limits and deductibles to appetite; document acceptances where you retain above standard deductibles.
- Reconcile with total cost of risk reporting so the board sees premium, retained losses, and risk reduction capex together.
Brochures and line-of-business cheat sheets do not set priorities; the register should drive the shopping list, not the other way around.
When a loss happens, the register and mitigation trail support coverage positions and settlement speed; weak documentation still kills claims regardless of premium spent. Keep evidence aligned with property claim filing and documentation practices from first notice onward.
Governance, Reporting, and Common Failures
ERM dies in static spreadsheets. Version the register, tie changes to tickets or capex projects, and report leading indicators (open high risks, overdue mitigations) not only lagging loss ratios.
Typical failures: scoring without definitions, listing risks with no owner, treating insurance renewal as the only annual risk review, and ignoring low-likelihood catastrophic hazards until a carrier non-renews. Fix those before buying another policy endorsement.
FEMA flood maps and building codes change exposure over time; NAIC and state regulatory attention to insurer solvency and market conduct keeps pressure on documentation quality throughout the chain. Your register is how you show counterparties—and yourself—that someone is paying attention.
Frequently Asked Questions
What is the difference between a risk register and an insurance schedule?
A risk register lists threats, scores, owners, mitigations, and residual risk across the enterprise. An insurance schedule lists policies, limits, deductibles, and dates. The register should drive what appears on the schedule; if a high-rated risk is absent from both mitigation and transfer rows, that gap is a governance failure, not a coverage mystery.
How often should a mid-size property owner update its risk register?
Review high and critical risks at least quarterly, medium risks semi-annually, and run a full register refresh at least once per year. Update immediately after acquisitions, dispositions, major losses, code violations, or material tenant changes. Insurance renewal calendars are a poor substitute for this cadence because they ignore risks that never touch a policy form.
What belongs in a risk appetite statement?
State which categories of risk the organization is willing to accept, which require board approval, and any numeric caps—maximum uninsured property values, downtime tolerance, or retained liability per occurrence. Link appetite to financial capacity so retained deductibles and self-insured amounts are fundable without breaching loan covenants or operating reserves.
When should retained risk stay on the balance sheet instead of buying insurance?
Retention makes sense when expected loss cost plus the cost of volatility you can fund is lower than premium, when coverage is unavailable or uneconomic, or when the exposure is truly immaterial to solvency. Document the analysis on the register row. If you cannot pay the deductible or absorb a shutdown without external capital, you have not retained the risk—you have ignored it.
Who should own enterprise risks on the register?
Assign each risk to a single accountable executive or manager who controls budget and decisions for that area—facilities for life safety, operations for process risks, finance for liquidity and insurance structure, legal for contract and compliance exposures. The risk committee coordinates; it does not replace named owners.