Every business leader today is navigating a world that feels increasingly unpredictable. From natural disasters and cyber threats to shifting regulations and reputational risk, the challenges are no longer isolated; they’re interconnected, fast-moving, and often overwhelming. What used to be considered “black swan” events, rare and unpredictable, are now recurring realities. Typhoons, data breaches, regulatory shifts, and public scrutiny are part of the daily backdrop for Philippine enterprises.
This is the new normal, and in this climate, resilience isn’t built overnight. It’s built through foresight, preparedness, and a culture that embraces risk as part of growth. In this environment, resilience isn’t just a buzzword. It’s a survival strategy — and at the heart of that strategy is Enterprise Risk Management (ERM).
ERM is a structured, organization-wide approach to identifying, assessing, and managing risks that could affect strategic objectives. Unlike traditional risk management, which often operates in silos, ERM integrates risk thinking into decision-making across all functions, turning uncertainty into insight and resilience.
BEYOND THE BIGGER PICTURE
Imagine a forest. From above, it looks lush, green, and thriving. But walk through it, and you’ll notice the uneven terrain, hidden predators, fallen branches, and fragile ecosystems beneath the canopy. This is the difference between strategic oversight and operational reality.
Many boards and executives operate from the treetops, focused on growth, performance, and long-term vision. But without a clear view of what’s happening on the ground, they risk missing the subtle but significant threats that lie beneath: compliance gaps, reputational risk, operational bottlenecks, or emerging stakeholder concerns.
ERM acts like a drone flying through the forest, not just hovering above, but scanning across layers. It helps leaders connect what’s happening at the top with what’s unfolding below. It encourages scenario planning, stress testing, and cross-functional collaboration across organizational levels. It prompts leaders to ask:
• What are our blind spots?
• Where are we most vulnerable?
• How do we mitigate the risks identified?
• How do we protect ourselves from risking the future while pursuing growth?
In my experience, the most successful organizations are those that treat risks not as a threat but as a strategic partner. They understand that resilience is built not just from vision, but from visibility.
WHAT ERM CAN AND CANNOT DO
Enterprise Risk Management empowers organizations to navigate uncertainty with clarity, structure, and confidence — but it isn’t a magic solution.
ERM helps leaders view risk holistically, rather than in isolated pockets. For example, when an energy company noticed rising customer complaints and online criticism about service reliability and rate adjustments, its ERM framework flagged these as emerging reputational risks. The company activated its response plan, coordinated across legal, communications, and customer service teams, and engaged stakeholders early before the issue escalated into a full-blown crisis. By treating reputational risk as a strategic concern, not just a PR issue, the company protected its brand and reinforced public trust.
ERM also enables organizations to prioritize what matters most. A retail company, for instance, identified supply chain disruptions as a growing risk ahead of the holiday season. Instead of waiting for delays to impact store shelves, the company used ERM to secure alternative suppliers, improve inventory visibility, and coordinate with logistics partners. This proactive approach minimizes revenue loss and maintains customer confidence.
By aligning risk appetite with strategy, ERM supports bold decisions with thoughtful safeguards. It strengthens governance by embedding accountability into daily decisions. And when organizations manage risk proactively, they build trust internally and externally by showing stakeholders that they address uncertainty rather than ignore it.
ERM is a framework — a compass, not a map. Its value lies in how deeply it’s embedded into the organization’s culture, how consistently it’s applied, and how seriously it’s championed by leadership. But ERM cannot eliminate risk. It won’t predict every crisis or prevent every failure. It doesn’t replace leadership judgment. During the pandemic, even the most robust ERM frameworks couldn’t foresee every disruption, but organizations with embedded ERM adapted faster and communicated more effectively.
When embraced with intention, ERM becomes more than a tool. It becomes a mindset, one that empowers teams to move forward with confidence, even when the path ahead is uncertain.
BUILDING A RISK-READY CULTURE
Culture is the invisible force that shapes how risk is perceived and managed. In many organizations, risk is still seen as a barrier to innovation or a burden to be delegated. ERM challenges that mindset.
By embedding risk thinking into everyday decisions from procurement and project planning to marketing and stakeholder engagement, organizations cultivate a proactive, transparent, and learning-oriented culture. This is especially important in the Philippine setting, where trust, relationships, and reputation play a central role in business success.
A risk-ready culture doesn’t eliminate uncertainty, but it equips people to navigate it with confidence.
A CALL TO ACTION
ERM is not a one-size-fits-all framework. It must be tailored to the organization’s context, maturity, and strategic goals. But what’s universal is the need to start.
Whether you’re a startup scaling fast or a legacy enterprise navigating complexity, the question is no longer “Should we invest in ERM?” but “Can we afford not to?”
If you’re in a position of influence whether in strategy, operations, finance, or governance, now is the time to ask:
• Is risk embedded in our decision-making?
• Do we have a clear view of our top risks and how they interconnect?
• Are we building a culture that sees risk as a source of strength?
ERM is not just a framework or set of documents — it’s a mindset and attitude. And resilience begins when leaders choose to lead and inspire their teams with risk in mind.
The views or opinions expressed in this article are solely those of the author and do not necessarily represent those of Isla Lipana & Co. The content is for general information purposes only and should not be used as a substitute for specific advice.
Grace Abatayo is a manager at the Office of the Chief Risk Officer of Isla Lipana & Co., the Philippine member firm of the PwC network.
+63 (2) 8845-2728