The current conditions of the company must be acknowledged when developing a framework, Mr. Muzzy said, explaining that this includes processes or tools within the organization that can be leveraged.

"A good example of this is the significant investments made by companies under Sarbanes-Oxley compliance," he said, referring to the federal financial and accounting disclosure requirements.

After a strategy has been developed, Mr. Muzzy added, the company needs to establish how it will integrate ERM into the organization. This requires a critical review of the organization's culture, skills necessary to implement ERM and the organization's ability to adopt it.

The process used to adjust enterprise risk, Mr. Muzzy said, includes identification and an understanding of what risks have occurred in the past, what may occur in the future, and what has not happened to the organization but still may be relevant.

"This collective data segment may not be easy to establish," he said. "For example, a history of risk data may not be readily available. Moreover, companies may not have the expertise necessary to derive possible risk scenarios, or have the knowledge of risk faced by competitors that may be relevant to them."

The next step in evaluating risk is the assessment. This requires determining how likely the risk is to occur, and if it does occur, the impact on the organization. "The goal here is to be as descriptive as possible," he said.

Mr. Muzzy explained that the evolution of ERM stems from the need to understand how all facets of risk impact an organization. "Well-publicized corporate scandals further exacerbated the need for ERM. Two examples are Enron and Arthur Andersen." Events such as these, he said, have "caused many to wonder how risk was being dealt with in the organizations."

He said that members of the financial community--investors, analysts and ratings agencies--had been looking for greater transparency in the disclosure of risk in risk management. Now, he said, more companies are responding, with explicit disclosures of risk management activities in their 10(k) and annual reports.

He said organizations must respond by developing effective corporate governance and processes that align with the issues arising from stakeholder groups.

Christopher Bohn, also a director of Aon ERM, said other drivers for ERM programs are the desire for management to establish a competitive advantage and institute stronger protocols to manage the total cost of risk.

He said that a key success factor for ERM is for management to quantitatively understand a risk and how its treatment impacts the organization.

The analysis, said Mr. Bohn, can be ultimately tied into the company's financials by building models that examine cash flow, income statement and the balance sheet.

Mr. Muzzy noted that a company needs to evaluate how its business environment is changing and examine such factors as "what new competitors have entered into this space, are suppliers squeezing the markets, what new products have been introduced, and how has the regulatory environment changed."

He said that each of these questions is answered "with a new set of risks, which is how we get the process started all over again."

A replay of the presentation is available at: www.aon.com/us/about/events/web_seminar.jsp