Enterprise Risk Management

How to Size Your ERM Program: Staffing, Time and Budget

A practical method to estimate ERM workload, choose dedicated or shared support, test peak weeks and build a defensible staffing budget.

By Eric Kennedy · Thu Oct 22 2026 · 8 min read

Size your ERM program by estimating the work, assigning it to the right people and checking when those people are actually available. Then build the budget. A revenue-based staffing ratio skips the questions that determine whether the program will work.

For a mid-market company, the useful output is a resource plan: what the central ERM team will deliver, what business owners must contribute, which skills you need occasionally, and what happens during reporting peaks. The method below turns those commitments into hours, full-time equivalents and dollars. The figures are illustrative planning assumptions, not staffing or salary benchmarks.

Start with the work you are buying

Before requesting a position, write down what leadership expects ERM to produce during the next year. Be specific enough that someone could estimate the effort.

“Maintain the risk register” is too vague. “Run the annual assessment, prepare four executive risk reports, review changes with risk owners monthly and bring unresolved decisions to the risk committee” is something you can cost.

Separate the first-year build from recurring operations. Designing the assessment, agreeing on risk ownership and cleaning up the first reporting pack are setup tasks. Updating an agreed process is different work. A temporary build requirement may justify project support rather than a permanent position. Conversely, a cheap launch is not evidence that ongoing monitoring will run itself.

Complexity changes the estimate. Several business models, fragmented data, acquisitions, dispersed operations and substantial regulatory obligations create coordination work that revenue alone does not describe. A narrower program with reliable information may require less central effort than a smaller company with inconsistent reporting and unresolved ownership.

For each deliverable, record its frequency, expected hours, required skill, deadline and accountable person. Ask the people who will do the work to challenge those estimates. If every estimate comes from the person seeking approval, the plan has missed a useful test.

Separate central ERM capacity from everyone else's contribution

Use four work categories so that a small central team does not hide a much larger unfunded commitment:

• Central ERM: coordinate assessments, challenge and consolidate information, prepare reporting, track decisions and escalate gaps.
• Business owners: assess their exposures, choose responses within their authority, maintain controls and deliver mitigation actions.
• Specialists: provide finance, cyber, legal, insurance, operations or other expertise when the work requires it.
• Independent assurance: evaluate governance and risk management without taking ownership of management's decisions.

These are workload categories, not four departments you must create. One person can contribute in several places, provided responsibilities and independence safeguards are clear. Count each person's hours once.

An instructive example comes from NC State's 2019 study, Revamping ERM. Its anonymous retail case describes a chief risk officer, manager, analyst and data scientist, alongside a senior executive risk council. The retailer exceeded $9 billion in revenue. This was an interview-based study of seven large companies, not a representative mid-market staffing benchmark, and the listed roles do not establish four dedicated ERM full-time equivalents. The useful lesson is the combination of central capability and executive participation, not the headcount. See Appendix C of the original study.

Make business participation explicit in your own plan. For example, an illustrative scenario with 12 risk owners contributing two hours each month creates 288 owner-hours annually: 12 × 2 × 12. Those hours sit outside the central-team estimate below. They cover ERM review participation, not the potentially much larger effort to implement mitigation projects.

The sequence matters. Define deliverables, estimate annual hours, assign skills and protected time, test peak weeks, then price the resource plan. Starting with a desired headcount and working backward makes it too easy to conceal work that has no owner.

Build an annual workload estimate

Estimate effort by activity, using recent actual hours where available. Include preparation, analysis, follow-up and revisions, not just meeting time. Use low and high estimates where uncertainty could change the staffing decision.

Illustrative central-team workload

The following constructed example covers recurring central ERM work only. Business-owner participation, mitigation delivery and independent assurance are separate. The assessment line excludes quarterly reporting; the committee line covers agenda and decision follow-up, with report preparation counted only in the reporting line.

The 15% allowance is a chosen assumption, not a recommended universal buffer. Replace it with experience or a stated uncertainty range. Do not use a buffer to disguise a known project that belongs in the base estimate.

Next, calculate the hours one full-time employee can actually devote to this scope after leave, holidays, training and unrelated duties. Suppose that is 1,600 hours annually. The workload equals 1,702 ÷ 1,600 = 1.06 full-time equivalents, rounded to two decimals.

That is an estimate of capacity required, not an instruction to hire two people. Nor does 1.06 FTE tell you which work requires senior judgment and which can be handled by an analyst. Identify the hours needed for facilitation, financial analysis, data preparation and executive challenge before selecting the staffing model.

Avoid double subtraction: if your productive-hours assumption already excludes general administration, do not remove the same hours again when assigning a person's ERM allocation.

Choose dedicated or shared support, then test the calendar

Shared support can be a sensible choice when the work is intermittent and the right people have protected time. It fails as a resource plan when “25% available” means “available after everything else.” Agree on deliverables, deadlines, who can reprioritize the person and what work will stop to make room.

A dedicated lead becomes more compelling when ERM requires frequent cross-functional decisions, sustained challenge or continuous follow-through. Specialist or external support can address a defined build, analytical gap or reporting peak. It still needs an internal sponsor who can obtain information and make decisions. For the broader sourcing decision, see in-house versus outsourced risk management.

Now pressure-test the annual calculation against the reporting calendar.

In the same illustrative scenario, one lead supplies 1,600 annual hours and a quarter-time analyst supplies 400. That is 2,000 hours of annual capacity against 1,702 hours of demand, leaving 298 hours of annual headroom.

But during a reporting week, assume the required work totals 60 hours and the two people have only 40 protected hours available because of other commitments. The week still has a 20-hour gap. Spare hours in another month do not finish this week's board pack.

Resolve that gap explicitly: move preparatory work earlier, reduce the deliverable's scope, reserve more analyst time or secure qualified temporary support. Check dependencies too. An analyst cannot consolidate information that business owners have not supplied, and additional junior hours cannot replace a missing executive decision.

The enterprise risk workshop guide can help define an assessment session's actual preparation and facilitation work. The board-ready risk reporting guide and deck can help you agree on the reporting product before estimating the effort to produce it.

Turn the resource plan into a budget

Show both the cost allocated to ERM and the additional cash you are asking to spend. An existing employee's time is not free, but allocating that time does not automatically create a new payroll expense.

Illustrative annual operating budget

These constructed figures are assumptions for demonstrating the calculation. They are not market compensation data, supplier quotes or KRG service prices.

The external allowance is not included in the 2,000 internal capacity hours. Specify its deliverables and obtain a quote before assuming it covers any remaining gap. Add first-year setup costs separately, and show business-owner time and mitigation budgets outside this central operating subtotal.

If both employees already exist and no backfill is needed, the proposed new cash spending in this example could be the $25,000 for external support, tools and training. That does not eliminate the opportunity cost of $190,000 in allocated employee time. If the lead is a new hire, the additional cash request changes. State the actual staffing situation rather than presenting either total as the only cost.

If internal audit supplies the capacity, show the tradeoff

A CAE considering shared audit resources should identify which audit work will move, shrink or require replacement support. Otherwise, the organization may approve ERM without seeing what it has taken out of the audit plan.

Also distinguish coordination from management ownership. Under IIA Global Internal Audit Standard 7.1, ongoing CAE responsibilities beyond internal audit and their safeguards must be documented in the audit charter. Where those responsibilities are subject to internal auditing, alternative assurance arrangements are required. This can affect the resource plan as well as governance. Our guide to internal audit's role in ERM explains the boundaries in more detail.

Before adding people, remove duplicated assessments, reports nobody uses and meetings that produce no decision. Some programs need less work, not more staff. But do not call a program efficient because risk owners never update their information or overdue actions go unchallenged.

Bring a decision-ready request

Your approval request should show the agreed deliverables, central and distributed hours, named capacity, the worst calendar conflict, allocated cost and incremental spending. Include the consequence of declining the request: a narrower scope, a later delivery date or an explicit coverage gap.

Review the estimate after a complete assessment and reporting cycle. Compare actual effort with the assumptions, including rework and time spent chasing inputs. Adjust the work or the capacity before treating the first estimate as a permanent staffing standard.

If your team cannot agree on the work ERM should own, a more precise headcount calculation will not settle the issue. KRG's ERM Program Diagnostic can help clarify the current program's gaps and priorities before you commit resources.

Explore the ERM Program Diagnostic