Enterprise Risk Management

How to Run a Quarterly ERM Review Meeting

How to prepare and run a quarterly management risk review: choosing decision items, a one-page pre-read, an illustrative 60-minute agenda and the decision record to leave with.

By Eric Kennedy · Wed Nov 11 2026 · 10 min read

A quarterly ERM review meeting is a management meeting, not a reporting ritual. Prepare it by choosing the two or three exposures that need a cross-functional decision this quarter, sending a one-page pre-read for each, and confirming who in the room can decide. Run it so that every item ends with a decision, a named owner, a date and a trigger that would reopen the decision. If nothing on the list needs a decision, shorten the meeting or cancel it.

This guide covers the selection, the pre-read, a 60-minute agenda you can adapt, and the decision record you should leave with. It is about the executive team's own quarterly review. Preparing the board pack is a separate job, covered in Board Risk Report Template, and building the risk list from scratch is a workshop job, covered in Enterprise Risk Workshop.

What the quarterly review is for

The useful purpose is narrow. The meeting gives management a fixed place to settle risk questions that no single function can settle alone: a launch that depends on another team's capacity, a mitigation that has slipped, two plans competing for the same people.

Public sector guidance is consistent on this point. HM Treasury's Orange Book, last updated in July 2026, says risk should be considered as part of the normal flow of management information and in significant decisions, and that there should be agreed triggers for bringing significant issues forward more quickly (paragraph A5). It also says reporting should provide information for decision-making (D11) and that the assumptions behind it should be clear enough to challenge (D13). The Queensland Department of Education's enterprise risk management procedure runs a quarterly risk review and requires the risk owner to decide whether a risk above tolerance is accepted, reassessed or needs further work on controls and actions.

Both are government documents written for their own organizations. They are not rules for a US mid-market company, and neither proves that a particular meeting format produces better results. I use them because they describe sound practice clearly. The agenda and timings below are my practitioner recommendation, based on running an enterprise risk program at a Fortune 50 technology company. They are a starting point, not a standard.

Keep three rhythms separate

A quarterly review only works if it is not asked to do everything.

• Continuous monitoring belongs to the risk and control owners between meetings. The Orange Book describes monitoring as ongoing (D10). If a key indicator crosses its threshold in week three, the owner escalates it then.
• The quarterly review takes the few items that need a cross-functional decision.
• A periodic full refresh revisits the whole risk profile, appetite and assumptions. I recommend once a year as a starting point, adjusted to how fast the business changes. That is where a fresh assessment or workshop fits.

A quarterly meeting can absorb the other two. When it does, it becomes a slow walk through the whole register, and urgent items wait for the next date on the calendar. An exposure that cannot wait should go to the person with authority now, with the quarterly meeting reviewing the decision afterward.

Choose what earns a place

Select items with the same three questions as the Agenda Test, applied to management rather than the board: what changed, what could break the plan, and what needs a decision. For a management meeting, add a fourth filter. Does the decision need more than one function in the room? If one executive can settle it alone, it belongs in that executive's normal meeting.

In practice that usually leaves two decision items. More than three and the meeting turns back into a status review.

The one-page pre-read

Each decision item gets one page, sent far enough ahead that people read it. It should contain six things:

1. The objective at stake. Which plan, target or commitment is affected.
2. What changed and the date of the evidence. A stale number presented as current is the fastest way to lose the room.
3. Current exposure compared with the proposed target. Use the same terms the company already uses for appetite.
4. The alternatives. At least two real options, including doing nothing.
5. The decision requested and who has authority to make it.
6. The proposed owner, deadline and revisit trigger.

If the author cannot fill in item five, the item is not ready. That is a useful finding in itself, and it is often the reason the issue has been circulating for months. Risk Owner vs. Action Owner explains why the person chasing the work is often not the person who can accept the exposure.

An illustrative 60-minute agenda

The 25 minutes for decisions is deliberate. It is the largest block because it is the reason to meet. Everything before it sets context, and everything after it confirms the result. If the decision block keeps getting squeezed by the update segments, cut the updates rather than the decisions.

What each agenda block must produce

Start with follow-through because it shows whether last quarter's decisions were carried out. Keep it to five minutes by asking for status in one word per decision. An item that is off track but within its agreed limits can move to a later slot. An item that has hit its reopen trigger should not wait for the next quarter. Escalate it now to the person with authority, using the trigger already in the record.

The ten minutes on change is not a tour of the register. It covers shifts in objectives, assumptions or exposure that the room needs to know about before deciding. The conflicts segment is where someone should ask what is missing. Two mitigations that rely on the same small team, or a sales target that assumes a supplier will hold, are typical examples.

The read back matters more than it looks. The chair, or whoever keeps the record, reads each decision aloud with its owner and date. Disagreements surface here rather than two weeks later in an email thread.

Who decides, and who challenges

Decisions stay with management. The executive with authority over the exposure approves it, and the record should name that person rather than "the committee."

The chief audit executive is useful in the room, but in a different role. The CAE can challenge the evidence, point out where assurance coverage is thin, and bring what audit work has found. The CAE should not be recorded as the person accepting the risk. The IIA's Three Lines Model says responsibility for managing risk remains within the scope of management, and that internal audit's independence from management responsibilities is critical to its objectivity (Principles 3 and 5, page 3). A CAE who accepts a risk would later be auditing their own decision. If you are unsure who should sit where, ERM Team Structure covers the sponsor, lead and contributor roles.

Worked example: a decision record

ILLUSTRATIVE SCENARIO. This is a constructed example for teaching. It does not describe a client or a real result.

Sales wants to launch in a new region next quarter. The pre-read shows that customer service does not yet have trained coverage for that region. The service lead says hiring is under way but training will not finish before launch. Sales argues that delaying the whole launch gives a competitor the opening.

A weak record of that discussion reads: "Discussed launch readiness." No one knows afterward what was agreed or what would change the plan.

A reopen trigger and an approval do different jobs. The approval says who accepted the plan and its remaining exposure. The trigger says what evidence would put the decision back in front of that person before the planned date. A record with an approver and no trigger leaves the decision standing even after its assumptions fail.

Completed decision record

Three details make this usable. The approver has authority over both sales and service, not the head of sales alone. The example uses a role title. Your own record should name the actual person, because a title can be vacant or change hands before the deadline. The proof is something someone can check, not a statement that training is complete. And the reopen trigger means nobody has to wait for the next quarterly meeting if the service backlog grows during the first phase. If coverage is missing at the deadline, the record already says the decision comes back, and to whom. If Phase 2 is delayed and the business wants to proceed anyway, that is a risk acceptance question, which Risk Acceptance: Who Approves an Overdue Mitigation? addresses.

You may not need another meeting

The honest counterpoint: many companies already have a monthly or quarterly operating review with the right executives in it. If that meeting already records decisions with owners and dates, has a clear escalation route for urgent exposures, and covers the cross-functional risks, adding a separate ERM committee creates duplication. Put a standing 25-minute risk decision slot in the existing meeting instead.

What you cannot skip is the record. A meeting of any name that ends without decisions, owners and triggers is an update. The record does not show who must act or when management should revisit the decision.

Before your next review

Look at the minutes of your last risk discussion and count the items that ended with a named approver, an owner, a date and a reopen trigger. If the count is low, the issue is probably not the agenda. It is what management receives beforehand and how decisions get recorded and reported upward. The Risk Reporting Scorecard is a short way to see where that reporting chain breaks.

Take the Risk Reporting Scorecard