{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-130","name":"Enterprise Risk","level":1,"parent_id":null,"l1_id":"BC-130","industry":"cross-industry","macro_id":"MC-10","path":["Enterprise Risk"],"description":"Know what could stop the enterprise from meeting its objectives, decide how much of that uncertainty it is willing to carry, and make sure the biggest exposures have an owner, a response and a number that leadership sees.","aliases":["Enterprise Risk Management","ERM","Risk Management Framework","Integrated Risk"],"in_scope":["The risk framework, taxonomy and appetite the board signs off on","Identification and assessment of strategic, operational, financial and reputational risk","Risk responses, the controls that reduce exposure, and insurance for what remains","Risk monitoring, key risk indicators and reporting to leadership and the board"],"out_of_scope":["Testing whether controls actually work (see BC-160)","Cyber threat and vulnerability management (see BC-760)","Continuity and crisis response when a risk materializes (see BC-830)"],"csdm_note":"Lands as a Business Capability record realized by risk-register and control-library applications; the risk and control objects it manages attach to Business Services and Business Applications, which is where the CMDB earns its keep.","status":"active","successor_id":null,"child_ids":["BC-130.10","BC-130.20","BC-130.30","BC-130.40","BC-130.50"]},"crosswalk":{"realized_by":[{"product_id":"PR-100","product":"ServiceNow","pc_id":"PC-100.80","pc":"Governance, Risk and Compliance","maturity":"partial","via":"BC-130.30"}],"used_in":[],"patterns":[],"stacks":[],"books":[]},"ancestors":[],"children":[{"id":"BC-130.10","name":"Risk Framework & Appetite","level":2,"child_count":3},{"id":"BC-130.20","name":"Risk Identification & Assessment","level":2,"child_count":4},{"id":"BC-130.30","name":"Risk Response & Controls","level":2,"child_count":4},{"id":"BC-130.40","name":"Risk Monitoring & Reporting","level":2,"child_count":3},{"id":"BC-130.50","name":"Insurance & Risk Transfer","level":2,"child_count":3}]}