I. The Orthodoxy Problem
Why ERM Became a Compliance Exercise
There is a moment that most senior risk officers recognize. The Board Risk Committee calendar fills with updates on examination findings, remediation plans, policy attestations, model inventories, and control assessments. Governance processes are functioning as designed. Reports are produced, committees meet, and documentation is maintained. Yet somewhere else in the institution, a strategic decision is being made that may never meaningfully intersect with that governance infrastructure until months later.
This is not necessarily a failure of enterprise risk management. Rather, it is the consequence of how many financial institutions learned to use it. Following the global financial crisis, the economics of risk management became increasingly shaped by regulatory expectations. The costs associated with non-compliance were immediate, measurable, and enforceable. Institutions responded rationally by investing heavily in governance frameworks, risk appetite statements, model inventories, issue management programs, and committee structures designed to withstand supervisory scrutiny. These investments were necessary and, in many cases, successful. Financial institutions today operate some of the most sophisticated risk management infrastructures of any industry.
The challenge is that much of this infrastructure evolved to support regulatory assurance rather than strategic decision-making. Over time, many organizations came to view enterprise risk management primarily as a mechanism for identifying issues, documenting controls, and satisfying examinations. The result was a subtle but important shift in how ERM was perceived. Instead of serving as a source of decision intelligence, it increasingly became associated with governance obligations and compliance outcomes.
For years, this model was sufficient because it aligned with the pace of decision-making. Risks developed slowly enough to be identified, assessed, escalated, and remediated through established governance processes. Strategic decisions unfolded over months, products followed predictable development cycles, and governance reviews could reasonably occur after the fact without materially affecting outcomes.
Artificial intelligence challenges that assumption. Financial institutions are increasingly deploying systems capable of generating recommendations, influencing decisions, and initiating actions at a scale and speed that traditional governance processes were never designed to oversee. What once unfolded over weeks may now occur millions of times per day. In this environment, the question is no longer whether a risk can be reviewed after the fact. The question is whether an institution possesses the governance capability to understand, challenge, and direct decision-making while it is occurring. That challenge is not fundamentally technological. It is a governance challenge, which is precisely why AI is forcing institutions to rediscover the strategic purpose of enterprise risk management.
II. The Reframe
Governance Infrastructure Is Strategic Infrastructure
The COSO 2017 Enterprise Risk Management Framework anticipated this challenge more clearly than many practitioners appreciated at the time. The framework repositioned risk management as a discipline that supports strategy and performance rather than one focused solely on risk avoidance. Its central insight was that uncertainty cannot be separated from decision-making. Organizations create value by taking risks, and the role of enterprise risk management is to help leadership understand which risks are worth taking and under what conditions.
That perspective has become increasingly important as AI moves from experimentation to operational deployment. Much of the discussion surrounding AI governance focuses on technical concerns such as model accuracy, explainability, bias, and validation. These issues are important, but they are ultimately manifestations of a broader governance challenge. Institutions must determine who is accountable for automated decisions, how those decisions are monitored, when human intervention is required, and how risk appetite should be applied to systems that operate continuously and at scale. Those questions fall squarely within the domain of enterprise risk management.
What many institutions are now discovering is that the governance infrastructure they built to satisfy regulatory expectations is also the infrastructure required to govern AI. Risk inventories can be extended to include AI use cases and decision systems. Model governance frameworks can be adapted to address AI development, validation, and monitoring. Third-party risk management programs can evaluate AI vendors and service providers. Board reporting structures can support executive oversight of AI deployment and performance. In many cases, the foundation already exists.
This reality helps explain the growing convergence among regulatory and industry frameworks. Whether examining the EU AI Act, NIST AI Risk Management Framework, IOSCO principles for AI in securities markets, ISO 42001, or emerging supervisory expectations from banking regulators, a common theme emerges. Institutions are expected to identify, assess, monitor, govern, and document technology-enabled decision systems. Organizations with mature ERM programs already possess many of the capabilities required to meet those expectations. Organizations without them will be forced to build them under increasing regulatory and competitive pressure.
The strategic advantage therefore is not AI itself. AI capabilities will become increasingly accessible across the industry. The advantage lies in possessing governance infrastructure capable of supporting innovation without sacrificing accountability. Institutions that recognize ERM as strategic infrastructure rather than compliance infrastructure will be positioned to adopt emerging technologies more quickly, more safely, and with greater confidence than their peers.
III. Where Strategic ERM Creates Competitive Advantage
The argument that enterprise risk management creates strategic value is frequently made but less frequently demonstrated. The distinction becomes clearer when examining situations in which governance maturity directly influences the quality and speed of strategic decision-making. In these circumstances, risk management is not functioning as a control mechanism operating alongside the business. It is functioning as decision infrastructure.
M&A Integration
Acquisition activity provides one of the clearest examples. Traditional due diligence in financial services focuses on credit quality, capital adequacy, liquidity, legal exposure, and regulatory obligations. While those considerations remain essential, they are increasingly insufficient in a market where technology platforms, data assets, and AI-enabled capabilities often represent a significant portion of a target’s value proposition.
Institutions with mature ERM programs enter the due diligence process with a structural advantage. They possess established operational risk taxonomies, model governance frameworks, third-party risk management processes, and issue management disciplines that allow them to evaluate governance maturity as rigorously as they evaluate financial performance. This capability becomes particularly important when assessing organizations that rely heavily on algorithmic decision-making, outsourced technology providers, or AI-enabled customer interactions.
Questions regarding model inventories, training data provenance, vendor concentration, governance accountability, and regulatory classification are no longer technical considerations delegated to specialists after the transaction closes. They increasingly represent factors that can influence valuation, integration timelines, regulatory approvals, and post-acquisition remediation costs. Institutions capable of assessing these exposures during diligence are better positioned to price risk accurately and avoid unpleasant surprises after the deal has been completed.
Innovation and Product Development
The same principle applies to product innovation. Financial institutions increasingly compete on their ability to bring new products, services, and digital capabilities to market quickly. Yet many product approval processes remain heavily focused on commercial viability and regulatory compliance while devoting comparatively less attention to broader governance architecture.
This gap is becoming more significant as AI capabilities are embedded into lending decisions, customer service channels, fraud detection systems, investment platforms, and operational workflows. A product may satisfy legal and regulatory requirements at launch while still introducing substantial operational, model, concentration, or reputational risks that become apparent only after deployment. In many cases, the resulting remediation costs far exceed the original investment required to identify and address those risks during development.
Institutions with mature ERM programs approach innovation differently. They possess the governance mechanisms necessary to assess risk architecture before products reach the market. Rather than slowing innovation, these capabilities often accelerate it by identifying obstacles early enough to address them efficiently. The organizations that consistently innovate successfully are rarely those that ignore risk. They are the ones that understand it well enough to proceed with confidence.
Agentic AI and Autonomous Decision Systems
The emergence of agentic AI introduces an even more consequential governance challenge. Much of the initial discussion surrounding AI focused on systems that generated content, summarized information, or provided recommendations. Increasingly, however, institutions are exploring systems capable of initiating actions, executing workflows, interacting with customers, and making operational decisions with limited human intervention.
This development shifts the governance conversation in important ways. The central question is no longer whether a model produces accurate outputs. The more significant question is how authority is delegated, monitored, and constrained when automated systems begin influencing or executing business activities directly.
Organizations that have developed strong enterprise governance capabilities are better positioned to address this challenge because the underlying disciplines are familiar. Questions regarding accountability, escalation thresholds, decision authority, monitoring requirements, auditability, and risk appetite have long existed within enterprise risk management. What is changing is the speed and scale at which those disciplines must operate.
As institutions deploy increasingly autonomous technologies, governance will become less about reviewing outcomes after they occur and more about establishing clear operating boundaries before decisions are made. The organizations that succeed will not necessarily be those with the most advanced AI capabilities. They will be those with governance architectures capable of supporting advanced AI capabilities safely and consistently.
Board-Level Decision Making
Perhaps the most important application of strategic ERM occurs in the boardroom. Risk committees traditionally spend considerable time reviewing historical information: operational losses, examination findings, control weaknesses, model validation results, and emerging risk reports. These activities remain necessary and continue to serve an important oversight function.
However, the decisions most likely to create or destroy long-term enterprise value are rarely retrospective. Decisions regarding acquisitions, market expansion, technology investments, strategic partnerships, and AI deployment shape the future risk profile of the institution long before they appear in governance reporting.
The challenge for many organizations is that risk information often arrives after strategic commitments have already been made. Risk management becomes a review process rather than a decision-support capability. As a result, boards may receive detailed reporting about the consequences of prior decisions while receiving comparatively little forward-looking analysis regarding decisions currently under consideration.
Institutions that derive strategic value from ERM organize their governance functions differently. They position risk leaders as participants in strategic deliberations rather than reviewers of completed actions. They develop analytical capabilities designed to evaluate uncertainty before commitments are made. Most importantly, they ensure that risk appetite informs strategic choices at the point of decision rather than serving as a retrospective benchmark for evaluating outcomes.
The difference may appear subtle, but its implications are profound. Organizations that consistently integrate risk intelligence into strategic decision-making tend to make better decisions over time because they understand uncertainty before capital, resources, and reputational capital are committed.
IV. What Strategic ERM Demands
Reframing enterprise risk management as a source of competitive advantage is not simply a matter of changing language. It requires an operating model that supports strategic decision-making rather than one focused exclusively on compliance oversight. While individual institutions may implement this model differently, several characteristics consistently distinguish organizations that derive strategic value from their governance infrastructure.
The first is independence combined with meaningful access. Effective challenge requires organizational independence, but independence alone is insufficient. Risk leaders must also possess the credibility, authority, and institutional standing necessary to participate in strategic discussions before decisions become irreversible. A risk review that occurs after a decision has effectively been made may satisfy governance requirements, but it does little to influence outcomes.
The second characteristic is the production of forward-looking risk intelligence. Strategic decisions occur within business timelines, not examination cycles. Boards evaluating acquisitions require governance assessments during diligence. Product committees require risk analysis before launch. Executive management requires scenario analysis before committing capital and resources. Most mature ERM programs already possess the analytical capabilities necessary to produce these insights. The challenge is often organizational rather than technical. Institutions must be willing to direct those capabilities toward future decisions rather than exclusively toward historical reporting.
A third characteristic is the ability to establish provenance and accountability across increasingly complex decision environments. As AI-enabled systems become more deeply embedded within financial institutions, the ability to demonstrate how decisions were made will become increasingly valuable. Institutions that can identify the models involved, the approvals granted, the controls applied, the monitoring performed, and the individuals accountable for oversight will possess significant advantages in regulatory examinations, litigation matters, and operational investigations. What has historically been viewed as documentation increasingly becomes a strategic asset.
Finally, strategic ERM requires governance capabilities that operate at the speed of the decisions they oversee. This may be the most significant shift introduced by artificial intelligence. Traditional governance structures were designed for environments in which decisions occurred slowly enough to permit periodic review and retrospective challenge. AI-enabled decision systems increasingly compress those timelines. Institutions can no longer rely exclusively on governance processes that operate weeks or months after the fact. Effective oversight must increasingly be embedded within decision processes themselves.
V. Conclusion
Enterprise risk management was always intended to support strategic decision-making. Over time, sustained regulatory pressure encouraged many institutions to emphasize its compliance dimensions while underutilizing its strategic potential. The resulting governance infrastructure was not misguided; indeed, much of it remains essential. What has changed is the environment in which that infrastructure must now operate.
Artificial intelligence is exposing the limitations of governance models built primarily around retrospective review. The challenge is not simply that AI introduces new forms of risk. Financial institutions have always adapted to new risks. The more significant change is that AI alters the speed, scale, and complexity of decision-making itself. Decisions that were once observable and reviewable are increasingly automated, distributed, and continuous.
This reality is forcing institutions to confront a fundamental question: Is enterprise risk management primarily a mechanism for satisfying regulatory expectations, or is it a capability that helps organizations navigate uncertainty while pursuing strategic objectives? The institutions that answer that question correctly will possess an important advantage. They will be better positioned to adopt emerging technologies, respond to evolving regulatory expectations, and make strategic decisions with greater confidence.
The future competitive advantage is unlikely to come from artificial intelligence alone. AI capabilities will become increasingly accessible across the industry. The more durable advantage will belong to institutions that possess the governance infrastructure necessary to deploy those capabilities responsibly, adapt them effectively, and maintain accountability as decision-making becomes increasingly automated. In that sense, AI is not diminishing the importance of enterprise risk management. It is reminding institutions why it mattered in the first place
This article reflects the author’s independent professional judgment and does not constitute legal, regulatory, or compliance advice. Readers should consult qualified legal and compliance counsel for their specific circumstances. © 2026 Chimayo Consulting LLC. All rights reserved.