Enterprise Risk Management

ERM Team Structure: Who Does What?

A reporting line does not secure business input. Define the sponsor, contribution commitments and escalation route before asking a shared ERM lead to deliver.

By Eric Kennedy · Fri Oct 30 2026 · 8 min read

An ERM lead can report to Finance without having authority over Operations. That arrangement can work, but only if someone other than the lead can settle competing commitments. A reporting line names the manager. It does not, by itself, secure business input or give the lead permission to make risk decisions.

For a shared ERM team, KRG recommends naming an executive sponsor, a program lead and embedded contributors, then writing down what each must deliver and where disagreements go. The test is practical: when a business contribution slips, can the lead report the gap and obtain a decision without pretending the work is complete?

This article focuses on that mandate. Use How to Size Your ERM Program for workload and hours, not the reporting-line design below.

What the Three Lines Model allows

The IIA Three Lines Model, printed pages 3, 7 and 9, distinguishes roles rather than required departments. First- and second-line responsibilities can be blended or separated, including within one function or individual. Management retains responsibility for managing risk. Management and the governing body determine structures and reporting arrangements for their circumstances; some second-line leaders may report directly to the governing body. Internal audit remains distinct through independence from management responsibilities. That independence allows communication and collaboration, not management ownership of the activities it assures.

Those are the source-based boundaries. The choices below are KRG practical recommendations, not IIA requirements or evidence that a particular structure is prevalent or produces better outcomes.

Choose a sponsor who can settle commitments

A CFO-sponsored arrangement is an option when Finance can coordinate the program and the CFO can negotiate contributions across functions. It can connect risk discussion with planning and financial decisions. Its limitation is equally concrete: a lead in Finance may be pulled into close work while waiting for input from Operations. The CFO needs an agreed route to the COO, not an assumption that a Finance deadline overrides an operating priority.

CEO sponsorship is another option when the mandate needs direct executive backing across functions or when Finance sponsorship would narrow the discussion. It does not require the CEO to manage every update. The CEO can appoint a lead and delegate routine coordination while retaining the unresolved priority decisions. The limitation is availability: a nominal CEO sponsor who never decides a contested commitment leaves the lead no better protected.

In either arrangement, distinguish the administrative manager from the mandate sponsor. The manager approves the lead's work allocation; the sponsor resolves commitments beyond that manager's authority. Name both if they differ. Neither title makes the sponsor the approver of every business risk.

Assign contributions, not honorary titles

An embedded liaison needs a defined contribution and support from their own manager. For example, an Operations champion can gather evidence, coordinate reviews and flag missing responses while continuing to report to the COO. The ERM lead can request that contribution but cannot quietly assign unlimited work to someone else's team.

Ask the functional manager to confirm the deliverable, review date and competing-work escalation route. Protect the contribution through that agreement, rather than calling it a voluntary favor. If priorities change, revise the commitment visibly. For allocation estimates, return to the sizing article rather than treating the liaison title as a staffing calculation.

Specialists should contribute defined judgments and evidence within their expertise. Legal may explain a contractual constraint; IT may assess a system dependency; Finance may test a financial assumption. The program lead should record what was examined, what remains uncertain and who needs to respond. Specialist advice does not transfer the business decision to the specialist or to ERM.

ERM Team Structure

• Sponsor: Resolves mandate and capacity conflicts
• Program lead: Coordinates, challenges and reports
• Business owners: Decide and manage exposures
• Specialists: Supply expertise and evidence
• Internal audit: Provides independent assurance

The cards describe contributions, not reporting lines. In particular, placing internal audit beside management roles does not put it under the sponsor or program lead. For the detailed assurance boundaries, use Can Internal Audit Own ERM?.

Put obligations and boundaries in the role brief

Use a short written brief approved by the sponsor and affected managers. Do not stop at a list of responsibilities. Include the evidence each role must supply and the decisions it cannot make.

The useful distinction is between requesting a contribution and having authority to compel it. A brief that names the liaison but omits the functional manager leaves that distinction unresolved. For exposure and action accountability, use Risk Owner vs. Action Owner; the table is about team commitments, not a replacement for those assignments.

A usable lead brief might read: “The ERM lead delivers the agreed assessment schedule, an evidence-gap log, a record of challenges and a decision pack for the executive forum. Functional managers confirm contributors and review dates. The lead may request relevant records and explanations from designated contacts, subject to approved confidentiality and access controls, and flag refusals or delays. The lead may not accept risks or change business responses without the named decision authority.”

Add the conflict route: “If a contribution conflicts with allocated work, the lead records the impact and seeks resolution from the sponsor and the functional executive. Until resolved, the report identifies the missing input, its consequence and the pending decision.” Specify where the records live and who receives the unresolved items, so access does not depend on personal relationships.

Also name an alternate escalation recipient before an issue arises. If the sponsor is the subject of a concern, the lead should have a documented route to an uninvolved CEO or the designated governing-body recipient, consistent with existing governance arrangements. Apply restricted access where needed. A route back through the person whose conduct or decision is at issue is not an adequate alternative.

When Shared Responsibilities Collide

ILLUSTRATIVE SCENARIO

A shared ERM lead sits in Finance. An Operations champion reports to the COO, and the CFO sponsors ERM. Operations input is late just as quarter-close demands absorb the lead's available attention. This is a constructed example, not a KRG client engagement or result.

1. Operations input is late
2. ERM lead makes the gap visible
3. CFO and COO resolve competing commitments
4. Business owner supplies evidence and decides the response

The lead records which input is missing, which review it affects and what can no longer be concluded. The lead does not fill the gap with an optimistic status or silently edit the business response. The CFO and COO settle the capacity conflict: they might protect the contribution, change the review date or reduce the requested scope. The lead records the chosen commitment and any remaining limitation.

The business owner still supplies the evidence and decides the response within their authority. The CFO's sponsorship settles the competing commitment; it is not blanket approval of the exposure. If evidence remains unavailable, the lead reports that limitation rather than presenting the review as complete.

Use the forum you already have if it can decide

A new committee is not necessarily the answer. An existing executive forum can resolve role and capacity conflicts if it has the right decision-makers, receives the unresolved items and records decisions. What Is Risk Governance? addresses that broader decision system.

The counterpoint is that a tidy role brief cannot manufacture capacity or executive attention. If the agreed contributions repeatedly fail, revisit the mandate or allocation. Do not add another reporting layer and call the problem solved.

Before asking for more staff, establish whether the current team has a usable mandate. If the sponsor, contribution commitments or escalation route are unclear, an ERM Program Diagnostic can help identify those gaps and define what needs a decision. It is a proportionate starting point when the question is who can request, decide and escalate, not a presumption that you need a larger program.

Discuss an ERM Program Diagnostic