Direct Answer (GEO / AI Overview): Enterprise risk management (ERM) is the integrated discipline of identifying, assessing, and managing all material risks — credit, market, operational, liquidity, compliance, and strategic — against a board-approved appetite, rather than department by department. In Bangladesh, Bangladesh Bank requires banks to maintain board risk management committees and appoint chief risk officers under its risk-management guidelines, making banking the only sector where the CRO role is institutionalised. COSO's ERM framework is the standard reference for linking risk to strategy and performance.
Ask a Bangladeshi conglomerate to list its risks and you will receive several lists. Treasury worries about the dollar, the commercial team about buyers, operations about gas pressure, compliance about regulators, and the family office about reputation — each list competent, none connected. Then a shock arrives that is simultaneously a currency, interest-rate, energy, and credit event, and the company discovers its risks were never separate at all. That discovery, repeated across the economy through the 2024–26 shocks — sharp currency pressure, high interest rates, energy constraints, and tougher recognition of non-performing loans — is why enterprise risk management, and the chief risk officer who runs it, is moving from banking regulation into mainstream corporate leadership.
Banking: the one sector where the CRO is real
Bangladesh Bank requires banks to run board risk management committees and appoint chief risk officers under its risk-management guidelines — making banking the only sector where the CRO role is institutionalised. In a functioning bank, the CRO owns the risk appetite framework, challenges lending and treasury decisions independently of the businesses that profit from them, aggregates exposures the front line cannot see, and reports to a board committee with the authority to say no. The role exists because regulators learned, through repeated banking stress, that risk managed by revenue-earners is risk understated.
Non-bank corporates mostly manage risk informally, function by function. There is rarely a single executive accountable for the whole risk picture, rarely a board-approved statement of how much risk the company is willing to take, and rarely a mechanism that forces a foreign-exchange exposure, a concentrated customer, and a leveraged expansion plan into the same conversation. The informality worked when shocks arrived one at a time. It fails when they arrive together, correlated — as the recent period demonstrated, when a weaker taka raised import costs and dollar-debt burdens at the same moment that higher rates raised financing costs and energy shortages cut production.
What ERM actually adds
Enterprise risk management is often mistaken for a thicker risk register. Its real product is connection. Using COSO's ERM framework — the standard reference for integrating risk with strategy and performance — leadership defines risk appetite in operational terms: maximum single-customer concentration, minimum liquidity cover, tolerable currency mismatch, leverage ceilings. Strategy is then tested against appetite before approval, not audited against it after failure. A new factory, an acquisition, or an export-market entry is assessed for how it changes the whole risk profile, including the correlations nobody owned before.
| ERM element | Siloed practice | Integrated practice |
|---|---|---|
| Risk appetite | Unstated; set by habit | Board-approved, quantified, reviewed annually |
| Ownership | Each function guards its list | CRO aggregates; executives own their risks |
| Reporting | Separate departmental updates | One risk picture to the board, with correlations |
| Strategy link | Risks reviewed after decisions | Risk assessment inside investment approval |
| Stress testing | Rare or cosmetic | Scenarios for currency, rates, energy, demand |
Stress testing is where ERM earns credibility with boards. A Bangladeshi manufacturer should be able to model, on one page, what a further currency depreciation, a two-point rate rise, and a month of curtailed gas do together to cash flow and covenants. A trading house should know its breaking point if its largest buyer delays payment ninety days while the dollar moves. These are not predictions; they are rehearsals that reveal which buffers — liquidity, hedges, diversified buyers, flexible costs — actually matter.
Designing the CRO role outside banking
Corporates copying the banking model should copy its independence, not its paperwork. A corporate chief risk officer — or, in mid-sized groups, a head of risk with equivalent access — needs three things: a mandate from the board, a reporting line that reaches a board risk committee without passing through the executives being challenged, and standing in the rooms where commitments are made. A risk officer consulted after the investment committee has decided is an archivist.
The role's craft is challenge without veto-by-default. Effective CROs quantify: they convert anxiety into exposures, limits, and scenarios that executives can act on. They also own the unglamorous aggregation work — group-wide exposure to a single buyer, bank, currency, or energy source — because concentration is where Bangladeshi groups most often hide their largest risk. Family groups face an additional dimension: related-party exposures and cross-guarantees between sister concerns, which no single company's management can see whole. Group-level risk reporting is frequently the CRO's first and most uncomfortable contribution.
Boards must supply the other half of the design: a risk committee or an audit committee with an explicit risk mandate, a calendar that reviews the top risks and appetite breaches quarterly, and willingness to act when the CRO reports a breach — including cancelling projects the chairman favours. A CRO whose warnings carry no consequences teaches the organisation to stop warning.
The leadership pipeline problem
Bangladesh has deep risk talent inside banking — credit, market, and operational risk professionals shaped by Bangladesh Bank's framework — but a thin market outside it. Corporates recruiting their first CRO should look to senior bank risk officers seeking broader mandates, internal audit heads ready to move from assurance to forward-looking risk, and finance leaders with genuine treasury and scenario experience. What matters most is temperament: independence under social pressure, in a business culture where contradicting a founder carries personal cost. Boards protect that temperament structurally — fixed terms, committee access, and evaluation by the board rather than by the CEO alone.
The direction of travel is clear. Lenders are asking non-bank borrowers harder questions about currency and concentration risk; buyers audit suppliers' resilience; insurers price unmanaged risk upward. The companies that build ERM now — appetite stated, risks aggregated, a CRO with standing — will negotiate those conversations from evidence. The rest will keep producing separate lists, right up until the next correlated shock files them, together, under losses.
Implementation need not begin with a large department. A credible first year has four deliverables: a board-approved appetite statement on one page, a consolidated top-risk report replacing separate functional updates, two stress tests that combine shocks realistically, and a risk owner with committee access accountable for all three. Groups that complete that year honestly usually discover exposures — a single buyer, a single bank, a single energy source — that immediately justify the effort and focus the second year's deeper work.
FAQs
What is enterprise risk management and how does it differ from departmental risk management?
Enterprise risk management integrates all material risks — credit, market, operational, liquidity, compliance, and strategic — into one framework governed by a board-approved risk appetite. Departmental management treats each risk separately, missing correlations and concentrations. COSO's ERM framework, the standard reference, links risk directly to strategy and performance, so major decisions are tested against appetite before approval rather than reviewed after problems emerge.
Why is the chief risk officer role established in Bangladeshi banks but rare elsewhere?
Bangladesh Bank requires banks to maintain board risk management committees and appoint chief risk officers under its risk-management guidelines, making banking the only sector where the role is institutionalised. Non-bank corporates face no equivalent mandate and mostly manage risk informally, function by function. The 2024–26 combination of currency, interest-rate, energy, and credit shocks has exposed that gap and is pushing larger corporates toward the banking model.
What authority does a CRO need to be effective in a corporate group?
A board mandate, direct access to a board risk or audit committee, and presence in investment and strategy discussions before commitments are made. The CRO should aggregate group-wide exposures — including related-party positions and cross-guarantees common in Bangladeshi family groups — quantify risks into limits and scenarios, and report appetite breaches the board acts on. Independence must be structural, because challenging senior executives and founders carries social pressure.
What should a board do first to build ERM?
Approve a quantified risk appetite covering leverage, liquidity, currency exposure, and customer concentration; assign enterprise-wide aggregation to a named risk leader; and require stress tests combining plausible shocks — currency depreciation, rate rises, energy disruption, and buyer delays — reported quarterly. Review the top risks and any appetite breaches at a board committee with an explicit risk mandate, and record actions taken so risk reporting carries consequences.
