Evaluate what an enterprise risk management framework does well and badly, and propose ways to strengthen it

A sound enterprise risk management (ERM) system sets a board-approved risk appetite, identifies and measures all material risks across the organisation, aggregates them to show interactions, assigns clear ownership, and reports regularly to decision makers. Strengths include an independent risk function with authority, often structured as three lines of defence, integrated stress testing and a healthy risk culture. Weaknesses to look for are silos where risks are assessed separately, reliance on backward-looking models such as value at risk, missing non-financial risks, poor data and risk staff lacking independence. Remedies should fit the gap: add scenario analysis, broaden coverage to ESG risks, strengthen escalation lines or clarify limits. A trap is recommending generic improvements not linked to an identified weakness.