Why Risk Management? Enterprise Risk Management has become a mandated business function involving the security of the entire organization. If you are tasked with designing an ERM you may be wondering “is my goal to determine if we are secure or if we can enable a more secure enterprise? Am I expected to engage business partners, to provide meaningful metrics, to inform choices and decisions? Does the organization expect me to account for security responsibilities or am I the provider of a business service?"