Enterprise risk management focuses on maximizing shareholder value or ensuring business continuity by creating a single view of all risks(internal and external) and an executive-level strategy to deal with those risks.

At AAMI, as at every other insurance company in this post-Enron, post-HIH, Sarbanes-Oxley/Financial Services Reform Act-saturated world, enterprise risk management has become a major preoccupation as the organization strives to build a powerful risk management culture. So with insurance now one of the most administered industries, with the Australian Prudential Regulation Authority (APRA) maintaining a keen watching brief on the effectiveness of corporate risk management approaches, and with every area subject to risk controls and required to report monthly on potential risks to the business, e-business manager David Jones has found his responsibilities have expanded considerably over recent times.

"It has made me very much more aware that the Web site processes have to be scrupulously aligned with what we're doing on the telephone," Jones says. "It has enforced a discipline on us, because before if the Web site was slightly different it didn't matter, but now under the Financial Services Reform Act we pretty well have to be aligned.

"It's very difficult sometimes to do that, simply because our processes are aligned to our mainframe, which requires programming, which takes some time to change. Whereas the business can often just change a code file and start doing something immediately, it takes the Web site about eight weeks to catch up. We're trying to address that now. We're not there yet. It's about pre-warning, because at the moment e-business is still an emerging business for us, and hasn't been fully embraced as an alternate channel."

In the new space-time reality born out of the ashes and dust of 9/11, keeping corporate executives out of jail and corporate activities off the front page, keeping customers onside and continuing to reward shareholders, have become the main games in town and the responsibility of everyone. When corporate executives can face up to 20 years in jail and a $US5 million fine for making false statements in corporate financial certifications under the new US Sarbanes-Oxley regime, financial information must be both valid and verifiable. Mix in the incentive to outsource offshore in the face of ever-increasing global competition, which creates all manner of new types of corporate operational and strategic risks that must be managed - many of them political in nature - and enterprise risk management and governance (ERM&G) is becoming the new imperative.

Cutter Consortium senior consultant Robert Charette believes the force pushing ERM&G to the forefront of corporate-level concerns can be traced to the "confluence of three rushing rivers of high anxiety": the loss of trust in corporations, the shock of the September 11 terrorist attacks, and the dynamic shift in the view of risk and how it should be managed in society. He says the rapid rise of ERM&G comes as business works to limit liability and related management costs, and accepts that an organization's total risk spectrum - regulations, capital markets, financial reporting, globalization, intellectual capital, not to mention IT - must be assessed and managed as a unified whole.

"The urgency in implementing ERM&G is a direct outgrowth of governmental and societal demands for better corporate governance as well as of recent world events that have changed the types of risks and their potential effects, which organizations must now face," Charette wrote in a Business Advisory earlier this year called 'The Rise of Enterprise Risk Management and Governance'.

"As a consequence, the CIO's role in identifying and managing enterprise risk and supporting the organization's risk governance requirements has grown dramatically since 2000."