Enterprise risk management (ERM) has evolved from a compliance exercise into a strategic business function that helps organizations anticipate uncertainty, strengthen resilience, and support long-term growth. But what does it take to build an ERM program from scratch?
In a recent episode of Alliance Insights, Noelle Codispoti spoke with Emily Buckley, Risk Manager at Specialized Bicycle Components, about her experience establishing an enterprise risk management program as the company’s first dedicated risk manager. Her insights offer valuable guidance for risk managers, insurance professionals, and business leaders looking to implement or mature an ERM framework.
Industry leaders from Microsoft, HSB, and Covenir gathered to discuss the future of AI in insurance, covering topics ranging from AI liability insurance and emerging risks to insurance operations, underwriting workflows, and customer experience. Their insights provide a valuable roadmap for carriers, MGAs, agencies, and insurance professionals seeking to navigate an increasingly AI-driven marketplace.
Building an Enterprise Risk Management Foundation
One of the first challenges in developing an enterprise risk management program is determining where to begin. For Buckley, success started with understanding the organization and identifying its most significant risks before developing solutions.
With support from company leadership, she partnered with outside experts to conduct risk assessments, interview stakeholders, evaluate financial exposures, and facilitate enterprise-wide discussions. The result was a prioritized list of the organization’s most critical risks—a foundation that continues to guide strategic decisions today.
For organizations launching ERM initiatives, this highlights an important lesson: effective risk identification and risk analysis must occur before implementing risk treatments, controls, or insurance solutions.
Why Executive Buy-In Matters in ERM
A successful enterprise risk management framework requires leadership support. According to Buckley, executive sponsorship was instrumental in helping Specialized invest in consultants, business continuity planning, and strategic risk initiatives.
Leadership buy-in also made it easier to communicate the value of risk management across the organization. Rather than viewing risk management as a compliance requirement, employees began to see it as a tool for improving decision-making, supporting growth, and protecting organizational objectives.
This alignment between leadership and risk management often separates successful ERM programs from those that struggle to gain traction.
Breaking Down Silos Through Relationship Building
Risk managers often discover that risk-related responsibilities are distributed throughout an organization. Human resources, finance, operations, legal, and supply chain teams all play a role in managing risk.
As Buckley explained, building relationships was one of the most important elements of her ERM journey.
By meeting stakeholders, learning departmental processes, and understanding operational challenges, she was able to create collaboration around shared goals. These relationships helped strengthen risk culture while improving visibility into operational and strategic risks.
For many organizations, risk management and organizational resilience improve significantly when departments stop managing risks in isolation.
Business Continuity Planning and Supply Chain Resilience
A key component of Specialized’s enterprise risk management strategy is business continuity planning.
Operating within a global supply chain, the organization needed to understand how disruptions could affect operations and revenue. Through business continuity exercises, supply chain mapping, and operational assessments, Buckley’s team identified critical dependencies and prioritized resilience initiatives.
One of her strongest recommendations is simple: get out from behind the desk.
Visiting facilities, meeting employees, and observing operations firsthand provides insights that cannot be captured through reports alone. For risk professionals responsible for business continuity, operational resilience, and supply chain risk management, firsthand knowledge can significantly improve decision-making.
Insurance Is One Part of Risk Management
While insurance remains a vital risk financing tool, Buckley emphasized that risk management extends far beyond purchasing insurance policies.
As Specialized grew, she evaluated the existing insurance program and worked with brokers and carriers to create a structure that aligned with the organization’s future needs. Strong relationships with brokers, underwriters, and service providers allowed the company to better communicate its risk profile and business story.
The result was a more strategic approach to insurance—one that supported broader enterprise risk objectives while helping the company manage growth and complexity.
Lessons for Future Risk Managers
For professionals building an enterprise risk management program, Buckley’s advice centers on three themes:
- Build relationships across the organization.
- Partner with trusted risk management service providers.
- Focus on the risks that matter most.
As organizations face increasing operational, technological, and global challenges, the demand for skilled risk professionals continues to grow. Whether supporting business continuity, insurance strategy, or enterprise risk management initiatives, risk managers play a critical role in helping organizations become more resilient and better prepared for the future.
Watch or Listen:
Advance Your Enterprise Risk Management (ERM) Expertise
Interested in strengthening your knowledge of enterprise risk management, risk assessment, business continuity planning, and organizational resilience?
The Practice of Risk Management course from the Risk & Insurance Education Alliance’s CRM designation program, provides practical tools and frameworks to help professionals identify, analyze, treat, finance, and monitor risk in today’s complex business environment. Explore the program and take the next step in your risk management journey.
