ERM is a common framework applied by business management to identify potential events that may affect the enterprise, report on the associated risks and opportunities, and provide reasonable assurance that risks are managed in accordance with the company’s risk appetite and business objectives.