Enterprise risk management (ERM) was introduced in the 1990s and has become an indicator of good management. Despite this success, many organizations still seek practical advice on ERM implementation. This article provides questions asked of an experienced chief risk officer and his staff by risk practitioners at many organizations over 11 years. Detailed answers based on best practices are provided. This article is important as it shows what areas were of concern related to ERM implementation, and many of these concerns may still apply today. The questions presented in this article fall in the following 10 areas of ERM implementation: background and context, organizational, getting started, risk identification, culture and engagement, risk criteria (which includes risk appetite and risk tolerances), tools and techniques, reporting, the benefits, and the future of ERM. This article should be of interest to practitioners involved with ERM, consultants in the area of ERM, and academics teaching courses on ERM, risk management, and related topics. This article will also provide a base against which further future research can be done to see how ERM evolves.

Enterprise risk management (ERM) began to take root in the late 1990s and has since become generally recognized as an expectation of good management and corporate governance. However, as evidenced by surveys and research, many companies still struggle with ERM implementation. This article explores the challenges companies face when implementing ERM and offers solutions for firms struggling with the concepts and execution. We draw upon Hydro One's experience in achieving ERM maturity as a best practice case study. The company's ERM methods have been researched and documented extensively. With over 15 years of ERM success, Hydro One is an excellent organization to benchmark for ERM best practices.