James Lam’s Enterprise Risk Management: From Incentives to Controls is a practitioner’s manual by the risk manager who, by his own account, first proposed the title chief risk officer. First published by Wiley in 2003 and fully revised in a second edition in 2014, it argues that risk management should be integrated across the risk types and business units of a firm, built into how the business is run and paid rather than set up as a control function beside it, and balanced between the hard side of risk management, its measures, limits, policies and systems, with the soft side of culture, people, incentives and trust. In our reading, the subtitle carries the argument: the controls an organisation builds will fail if its incentives pull the other way. For internal auditors the book matters for three reasons. Internal audit is asked, by the Global Internal Audit Standards and, in banking, by supervisors, to understand and evaluate the organisation’s risk management; the book supplies a framework detailed enough to audit against. Its lessons, written before the 2008 crisis and revisited after it, describe the failures that later scandals repeated. And it describes the chief risk officer’s role from the perspective of the person who, on his own account, first held the title. This guide summarises the second edition without reproducing it, sets out its structure from the printed contents, explains its lessons and framework, reads three later failures against them, sets the book beside COSO’s 2017 framework, ISO 31000:2018 and the US bank rules as they stand in October 2026, maps it to audit practice and ends with a worked example in which a $62 billion bank’s audit function audits its ERM framework.
In this guide
- The book in one page
- Who James Lam is, and how the book came about
- The structure: five sections and twenty-five chapters
- The seven lessons: from incentives to controls
- The framework: seven components of ERM
- Applications, predictions and implementation
- After the book: three failures read through its lessons
- The frameworks and rules the book now sits beside
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: auditing ERM against the book
- The criticisms, and what the book leaves out
- Editions, companions and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Thornwick Bank audits its ERM framework
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is ERM, in Lam’s sense? | An integrated framework for managing credit, market and operational risk, economic capital and risk transfer in order to maximise the value of the firm, as Lam put it when presenting the first edition in 2003; the opposite of managing each risk in its own silo. |
| What is the argument of the subtitle? | That risk management has a hard side, measures, limits, policies and systems, and a soft side, culture, people, incentives and trust, and that controls fail when the incentives work against them. Paying for the performance you want is one of the book’s seven lessons. |
| What are the seven lessons? | Know your business; establish checks and balances; set limits and boundaries; keep your eye on the cash; use the right yardstick; pay for the performance you want; balance the yin and the yang. |
| What is the framework? | Seven components, each with its own chapter: corporate governance, line management, portfolio management, risk transfer, risk analytics, data and technology, and stakeholder management. |
| What did the second edition add? | A fifth section on implementing ERM, with chapters on implementation and maturity, the role of the board, risk assessment, risk-based decision making and dashboard reporting, and new material visible in the contents, including lessons from the BP oil spill and a 2013 look back at the first edition’s predictions. |
| Who wrote it? | The risk manager who says he proposed the title chief risk officer for himself at GE Capital in 1993, later chief risk officer of Fidelity Investments, the founder of ERisk, a partner at Oliver Wyman and, since 2002, head of his own advisory firm; GARP’s first Risk Manager of the Year, in 1997. |
| What has changed since 2014? | COSO updated its 2004 ERM framework in 2017, ISO revised ISO 31000 in 2018, the IIA updated the three lines of defence into the Three Lines Model in 2020, and the Global Internal Audit Standards took effect in 2025. The book predates all four. |
| Why read it as an auditor? | Because it gives a component-by-component framework to audit ERM against, because its lessons are a ready-made test of whether a risk function would catch the failures that recur, and because it explains what a board should expect from a chief risk officer. |
Who James Lam is, and how the book came about
Lam began his career in market risk, asset-liability management and hedging and moved into credit and operational risk; in the early 1990s, he told Insurance Business in 2020, he concentrated on economic capital, which he describes as the inspiration for what became ERM. At GE Capital, where he was setting up a new capital markets business, he asked what title to put on his business cards and, modelling it on the chief information officer, proposed chief risk officer; Baruch College’s alumni magazine, profiling him in 2017, dates this to 1993. He was later chief risk officer of Fidelity Investments, founded ERisk, of which he was president, was a partner at Oliver Wyman and in 2002 founded James Lam and Associates, the advisory firm he still leads. The Global Association of Risk Professionals named him its first Risk Manager of the Year in 1997, and his publisher describes him as widely regarded as the first chief risk officer. He joined the board of E*TRADE Financial in November 2012 as an independent director and chair of its risk oversight committee, has served on COSO’s ERM advisory board, and is now, according to his National Association of Corporate Directors biography, an independent director and risk committee chair at BlackRock’s iShares funds.
The first edition appeared in 2003, in Wiley’s finance series; in October of that year the Society of Actuaries’ Actuary of the Future newsletter printed an excerpt containing its ten predictions for risk management, and in December Lam presented the framework to an actuarial seminar. The second edition, published in early 2014, is described by its publisher as a full revision prompted by a decade of change in business and finance. Comparing the two editions’ contents shows what changed in structure: the first edition’s four sections and twenty chapters became five sections and twenty-five, with a new fifth section on implementation, and the chapter defining ERM moved into the first section. Within the chapters, the contents show material that could only be new, such as lessons from the BP oil spill, which followed the Deepwater Horizon explosion of April 2010, a case study of JPMorgan Chase in the new chapter on the board and a section looking back from 2013 at the 2003 predictions. Lam’s next book, Implementing Enterprise Risk Management: From Methods to Applications (Wiley, 2017), is a practical guide to implementation; we found no third edition of the 2014 book.
The structure: five sections and twenty-five chapters
The table follows the printed contents of the second edition. The descriptions are drawn from the section headings within each chapter, which the publisher’s ebook listing reproduces, and are ours in wording; we name a case only where the contents do.
| Section | Chapters | What the contents show | What it contributes |
|---|---|---|---|
| Section One: Risk Management in Context | 1 Introduction; 2 Lessons Learned; 3 Concepts and Processes; 4 What Is ERM? | The benefits of risk management and of integration, and cautionary tales; the seven lessons; risk awareness, measurement and control, and risk as a bell curve; definitions and benefits of ERM, the chief risk officer and the components of ERM | The case for ERM and its vocabulary |
| Section Two: The Enterprise Risk Management Framework | 5 Corporate Governance; 6 Line Management; 7 Portfolio Management; 8 Risk Transfer; 9 Risk Analytics; 10 Data and Technology; 11 Stakeholder Management | One chapter per component, from codes of conduct and the relationship between line and risk functions to alternative risk transfer, analytics for each risk type and GRC systems, data architecture, and the expectations of employees, customers, regulators and rating agencies | The framework an auditor can test against |
| Section Three: Risk Management Applications | 12 Credit Risk Management; 13 Market Risk Management; 14 Operational Risk Management; 15 Business Applications; 16 Financial Institutions; 17 Energy Firms; 18 Non-Financial Corporations | The three main risk types, each with a case study, and Basel requirements in the credit chapter; three stages in the evolution of risk management; industry chapters with lessons from Enron and the BP oil spill and cases from banks, technology and manufacturing companies | The framework applied by risk type and industry |
| Section Four: A Look to the Future | 19 Predictions; 20 Everlast Financial | The profession of risk management, ten predictions and a look back from 2013; a fictional case study | The author’s forecasts, and how they fared |
| Section Five: ERM Implementation | 21 ERM Implementation; 22 Role of the Board; 23 Risk Assessment; 24 Risk-Based Decision Making; 25 Dashboard Reporting | Implementation requirements, maturity models and risk culture; board oversight requirements and practice, a JPMorgan Chase case and a section on the last line of defence; risk assessment methods with a self-evaluation checklist; creating value through ERM, with a Duke Energy case; traditional versus dashboard reporting | The section new to the second edition |
The case studies named in the contents are worth listing because they show where the book’s evidence comes from: Honeywell and Barclays in the chapter on risk transfer, Export Development Corporation in the credit risk chapter, market risk management at Chase, Heller Financial in the operational risk chapter, CIBC among financial institutions, Microsoft, Ford, and Airbus and Boeing among non-financial corporations, JPMorgan Chase in the board chapter and Duke Energy in the chapter on decisions. Six of the eleven are banks, finance companies or, in the case of Export Development Corporation, Canada’s government export-finance agency, which is consistent with the author’s career, and an auditor in another industry should expect to do more of the translation.
The seven lessons: from incentives to controls
The second chapter sets out seven lessons, and their titles, as printed in the contents, are in our view the book’s most portable content. When Lam presented them in 2003, he summarised them as knowing the business, checks and balances, setting limits, managing cash, using the right performance measure, paying for the performance wanted, and balancing the hard and soft sides of risk management, where the hard side means measures, limits, policies and systems and the soft side means culture, people, incentives and trust. The table gives each lesson, what it asks in our words, and the test an auditor can apply.
| Lesson | What it asks, in our words | The audit test |
|---|---|---|
| Know your business | That the people managing risk understand how the business makes money and where it could lose it | Can the risk function explain the economics of the riskiest business line, and did it challenge the last significant new product? |
| Establish checks and balances | That no one controls a transaction from start to finish, and that the risk function is independent of the business it oversees | Segregation between front office, risk and operations; the chief risk officer’s reporting line and access to the board |
| Set limits and boundaries | That risk-taking is bounded by limits that mean something, and that breaches have consequences | How many breaches occurred, how they were resolved, and how often limits were raised to fit the position |
| Keep your eye on the cash | That accounting profit is no substitute for cash and liquidity, which is where many failures first show | Reconciliation of reported profit to cash, and liquidity stress results against actual collateral and funding needs |
| Use the right yardstick | That performance is measured after the risk taken to achieve it, for example as return on economic capital | Whether pricing, capital allocation and business reviews use a risk-adjusted measure, or revenue and volume alone |
| Pay for the performance you want | That incentives reward risk-adjusted, sustainable results rather than volume or short-term profit | Whether bonus pools are adjusted for risk and conduct, and whether the risk function has an input |
| Balance the yin and the yang | That the hard side of controls and the soft side of culture are managed together | Whether culture and incentives are within the scope of risk reporting, not only metrics and limits |
The lessons look modest, but they are precise about where controls fail. Three of them, the limits, the yardstick and the pay, are about how the firm measures and rewards risk-taking, and two, checks and balances and the soft side, are about whether anyone is in a position to say no. In his 2003 presentation Lam illustrated risk-adjusted return on capital, net income divided by the economic capital held against losses beyond those expected, and showed how a modest cut in the margin on an exposure can sharply reduce the return on the capital it consumes. The trading floor controls guide describes the controls behind the second and third lessons in a capital markets business, and the conduct risk guide covers the territory of the sixth.
The framework: seven components of ERM
The second section devotes a chapter to each of seven components of an ERM framework. Lam’s 2003 presentation summarised what each is for in a phrase, and the second edition’s contents show what each chapter covers. The table combines the two and adds the question an auditor should ask; the components are Lam’s, the audit questions are ours.
| Component | Its purpose, as Lam summarised it in 2003 | What the second edition’s chapter covers | The audit question |
|---|---|---|---|
| Corporate governance | Establish top-down risk management | Codes of conduct, best practices, the link between governance and ERM | Does the board set risk appetite and oversee it, or receive it? |
| Line management | Align risk with business strategy | The relationship between line and risk functions, the challenges and best practice | Do business heads own their risks, with limits set before new business is written? |
| Portfolio management | Act like a fund manager across the firm’s risks | The theory and benefits of active portfolio management and practical applications | Is concentration managed across the whole firm, or only within each desk and book? |
| Risk transfer | Transfer out concentrated or inefficient risks | The history, advantages and pitfalls of alternative risk transfer, with Honeywell and Barclays cases | Are hedging and insurance decisions judged by cost against the capital they release? |
| Risk analytics | Build advanced analytical tools | Control and optimisation analytics, market, credit and operational risk analytics, credit portfolio models, GRC systems | Are the models validated, and do their outputs drive decisions? |
| Data and technology | Integrate data and systems | Data management, interfaces, middleware and distributed architectures, and success factors for implementation | Can the firm aggregate its exposure to one counterparty, quickly and accurately? |
| Stakeholder management | Make risk transparent to key stakeholders | Employees, customers, regulators, rating agencies, shareholder service providers and business partners | Do disclosures and supervisory reports tell the same story as the board pack? |
Two features of the framework matter for audit. The first is that it starts with governance and ends with stakeholders, so that the risk function’s analytics sit inside a chain that runs from the board’s appetite to what outsiders are told; a weakness anywhere in the chain is a weakness in ERM, whatever the quality of the models. The second is that portfolio management and risk transfer treat the firm’s risks as a portfolio to be shaped, not merely a list to be monitored. Lam’s 2003 slides proposed a test for risk transfer that compares the change in return with the change in economic capital, so that a hedge or an insurance programme is judged by the capital it releases against what it costs. The guide to auditing the ERM programme and the guide to internal audit’s role in ERM describe how internal audit approaches the framework as a whole.
Applications, predictions and implementation
The third section applies the framework to credit, market and operational risk, each chapter with a case study and the credit chapter with the Basel requirements, and then by industry. Its chapter on business applications describes three stages through which risk management evolves, which its headings call minimising the downside, managing uncertainty and performance optimisation; the progression is a useful scale for an auditor asking how far a firm’s ERM has developed. The industry chapters cover financial institutions, including systemic risk, energy firms, with lessons from Enron and the BP oil spill, and non-financial corporations. The site’s guides to market risk and operational risk frameworks cover the risk-type material for audit purposes.
The fourth section is the author’s view of the future, and it includes a test of his own judgment. The first edition made ten predictions, which the Actuary of the Future printed in 2003: that ERM would become the standard approach; that chief risk officers would become common in risk-intensive businesses; that audit committees would evolve into risk committees; that economic capital would replace value at risk as the preferred measure; that risk transfer would be decided at the level of the enterprise; that technology would transform risk management; that a measurement standard would emerge for operational risk; that mark-to-market accounting would become the basis of financial reporting; that risk education would spread through corporate training and university courses; and that the pay gap among risk professionals would widen. Writing in 2010, in an article reprinted in 2013, Lam judged that the predictions were generally consistent with how ERM had evolved, some on target and others less so, and the second edition’s contents add a section looking back from 2013. The record since bears out some of them. COSO published an ERM framework in 2004 and updated it in 2017; US rules now require large bank holding companies to have both a board risk committee and a chief risk officer; and in its 2016 market risk standard the Basel Committee moved from value at risk to an expected shortfall measure of risk under stress, a shift away from value at risk, though not to economic capital. The fifth section, new to the second edition, turns from forecasts to practice: implementation requirements, maturity models and risk culture; the board’s oversight duties; risk assessment, with a self-evaluation checklist; risk-based decisions; and dashboard reporting, which contrasts traditional risk reports with dashboards built for decisions.
| Prediction in 2003 | The audit question it raises in 2027 |
|---|---|
| ERM becomes the industry standard | Is ERM in the organisation a framework that changes decisions, or a document that satisfies a standard? |
| Chief risk officers become prevalent in risk-intensive businesses | Does the chief risk officer have the independence, access and authority the role requires? |
| Audit committees evolve into risk committees | Where a separate risk committee exists, are the boundaries with the audit committee clear, and does each see what it needs? |
| Economic capital replaces value at risk | Which measure of risk drives capital allocation, pricing and pay, and is it the same one the board sees? |
| Risk transfer is decided at the enterprise level | Are hedging and insurance decided against the firm’s total exposure, or desk by desk? |
| Technology transforms risk management | Can the firm aggregate its exposures across systems in the time a crisis allows? |
| A measurement standard emerges for operational risk | Are operational losses, near misses and scenarios captured consistently enough to measure? |
| Mark-to-market becomes the basis of reporting | Are the valuations behind risk reports independently verified? |
| Risk education becomes widespread | Do directors on the risk committee have the expertise to challenge management? |
| The pay gap among risk professionals widens | Can the risk function attract the people it needs to challenge the business? |
After the book: three failures read through its lessons
Three failures since the second edition appeared show how closely its lessons describe what goes wrong. They are our illustrations, not cases from the book, and the findings quoted are those of regulators or independent reviewers. Each turned on a lesson whose title Lam had printed years earlier.
| Case | What the official or independent record found | The lessons it tests | The audit test it suggests |
|---|---|---|---|
| Wells Fargo sales practices (2016) | The Consumer Financial Protection Bureau fined the bank $100 million in September 2016, alongside $35 million from the OCC and $50 million to the City and County of Los Angeles, after the bank’s own analysis found that about 1.5 million deposit accounts and about 565,000 credit card applications may not have been authorised by customers; employees had been pushed by sales targets and pay tied to meeting them. In February 2018 the Federal Reserve restricted the firm’s growth, citing widespread consumer abuses and compliance breakdowns and a firm that had pursued growth without managing key risks and lacked an effective firm-wide risk framework. The restriction was lifted in June 2025. | Pay for the performance you want; establish checks and balances | Test whether sales incentives are monitored for the behaviour they reward, and whether complaints and conduct data reach the board |
| Archegos and Credit Suisse (2021) | Credit Suisse lost about $5.5 billion when Archegos collapsed in March 2021. The report by the law firm Paul, Weiss, published with the bank’s results in July 2021, found a fundamental failure of management and controls in the prime services business, large and persistent limit breaches that were not acted on, and a lackadaisical attitude towards risk; nine people were dismissed, including the chief risk officer, and about $70 million of pay was cancelled or clawed back. | Set limits and boundaries; balance the yin and the yang | Count limit breaches and how they were resolved; test whether repeated breaches were escalated or simply accommodated |
| Silicon Valley Bank (2023) | The Federal Reserve’s review, published on 28 April 2023, found that the board and management did not adequately manage the bank’s risks; that senior management’s pay was tied to short-term earnings and equity returns and did not include risk metrics; that in April 2022 the bank made counterintuitive assumptions about the duration of its deposits to address a limit breach and over the same period removed interest rate hedges; and that the board did not receive adequate information about risk. | Use the right yardstick; pay for the performance you want; keep your eye on the cash | Test whether changes to model assumptions that cure a limit breach are independently validated and reported to the risk committee |
The pattern across the three is the one the subtitle describes. In each case there were limits, policies or a risk function on paper; what failed included the soft side, the incentives that rewarded the behaviour the controls were meant to prevent, a culture that accommodated breaches, and escalation that did not reach, or did not move, the people with the authority to stop the business. For an auditor, the lesson is that a test of whether controls exist will usually pass, and a test of whether the incentives and the escalation paths work is where the findings are. The culture audit guide and the risk acceptance guide cover the soft-side tests, and the deposit behaviour guide covers the modelling assumptions that mattered at Silicon Valley Bank.
The frameworks and rules the book now sits beside
The second edition was written before the frameworks that now dominate ERM practice were revised, and an auditor using it in 2027 needs to know what has changed. COSO’s Enterprise Risk Management: Integrating with Strategy and Performance, released in June 2017, updated the 2004 framework with five components and twenty principles and placed more emphasis on integrating risk with strategy. ISO 31000:2018, published in February 2018, offers principles, a framework and a process, is not certifiable, was reviewed and confirmed in 2023 and is marked in ISO’s catalogue for revision. The IIA updated the three lines of defence and renamed it the Three Lines Model in July 2020. In US banking the rules have also moved, and in 2025 and 2026 some moved again. The table summarises where each stands; the frameworks comparison and the bank thresholds guide give the detail.
| Framework or rule | What it requires or offers | Where Lam’s framework maps (our mapping) | Status in October 2026 |
|---|---|---|---|
| COSO ERM (2017) | Five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting; twenty principles | Corporate governance to governance and culture; line and portfolio management, risk transfer and analytics to performance; data and technology and stakeholder management to information, communication and reporting | Current |
| ISO 31000:2018 | Principles, a framework and a process for managing risk; guidance, not a certifiable standard | Lam’s lessons sit closest to the principles; his components to the framework | Current; reviewed and confirmed in 2023 and marked for revision |
| IIA Three Lines Model (2020) | Governing body oversight; management’s first- and second-line roles; internal audit’s independent assurance | Line management is the first line, the risk function the second; the board chapter sits with the governing body | Current |
| Regulation YY, subpart C | For bank holding companies with $50 billion or more of assets (and under $100 billion): a board risk committee with an independent chair and at least one member with risk expertise at large, complex firms, meeting at least quarterly; a risk-management framework that integrates risk management and its controls with management goals and compensation; a chief risk officer reporting directly to the risk committee and the chief executive | Corporate governance, line management and the chief risk officer, in law | In force |
| OCC heightened standards (12 CFR 30, Appendix D) | For national banks with average assets of $50 billion or more: a written risk governance framework, independent risk management led by a Chief Risk Executive with unrestricted access to the board, a risk appetite statement approved at least annually, a risk-based internal audit plan, and an independent assessment of the framework at least annually, by internal audit, an external party or both | Most of the framework, with the board chapter and dashboard reporting | In force at $50 billion; the OCC proposed in December 2025 to raise the threshold to $700 billion, and the regulation’s text still showed $50 billion in October 2026 |
| SR 13-1 (2013, revised 2025) | For Federal Reserve-supervised institutions above $10 billion: internal audit should analyse the effectiveness of all critical risk management functions, evaluate the reasonableness of risk tolerance limits and test adherence, and give the audit committee at least annually an opinion on the adequacy of risk management processes | The audit side of every component | In force; revised in October 2025 to remove references to reputational risk |
| Global Internal Audit Standards (2024) | The chief audit executive must understand how the organisation identifies and assesses significant risks and selects controls (Standard 9.1), and base the plan on a documented risk assessment (Standard 9.4) | The book’s framework as a model of what to understand | Effective since 9 January 2025 |
The mapping to COSO is ours and imperfect, because the two frameworks are built on different logic: COSO’s 2017 components follow the cycle from governance through strategy and performance to review and reporting, while Lam’s follow the organisation from the board through the business lines to the analytics and the outside world. The practical point is that an ERM programme can conform to COSO’s language and still fail Lam’s lessons, and the second is the better guide to where the failures will be. The Three Lines Model guide covers the roles, and the risk appetite guide and the appetite, tolerance and capacity guide cover the statement that the rules now require at large banks.
The nine ideas worth keeping
- ERM is integration. Credit, market and operational risk, capital and risk transfer managed together, so that the firm sees its total exposure and its concentrations, not a set of silo reports.
- Incentives come before controls. A control that works against the pay plan will lose; the sixth lesson, pay for the performance you want, is the subtitle in miniature.
- Know the business. Risk managers who cannot explain how the business makes money cannot say where it will lose it.
- Limits must bind. A limit that is raised whenever it is breached is a description of the position, not a control over it.
- Watch the cash. Accounting profit can mislead for years; cash and liquidity are where many failures first become visible.
- Measure performance after risk. Risk-adjusted return on economic capital, or a measure like it, belongs in pricing, capital allocation and pay.
- Manage the hard and soft sides together. Measures, limits, policies and systems on one side; culture, people, incentives and trust on the other.
- Give the chief risk officer standing. Independence, direct reporting to the board’s risk committee and unrestricted access to the board, features US rules now require at large banks.
- Report for decisions. Dashboards that show the risk profile against appetite, and feedback loops that judge risk management by measurable results such as unexpected earnings volatility, as Lam argued in 2010.
The vocabulary: fourteen terms defined for practitioners
| Term | What Lam means | What it looks like in an audit |
|---|---|---|
| Enterprise risk management | An integrated framework for managing credit, market and operational risk, economic capital and risk transfer to maximise firm value | The object of the audit: a framework that should change decisions |
| Chief risk officer | The senior executive responsible for enterprise-wide risk management | Reporting lines, access to the board and the authority to say no |
| Economic capital | Capital held against unexpected losses beyond those already expected and provided for, a common measure across risk types | The model behind capital allocation and risk-adjusted returns |
| Risk-adjusted return on capital | Return measured against the economic capital a business consumes | Whether pricing and performance reviews use it |
| Hard side | Measures, limits, policies and systems | The controls a conventional audit tests |
| Soft side | Culture, people, incentives and trust | The conditions that decide whether the controls are followed |
| Line management | The business units that own and take risk | The first line, and whether it owns its risks in practice |
| Active portfolio management | Managing the firm’s risks as a portfolio, adjusting concentrations deliberately | Firm-wide concentration limits and the decisions taken when they are approached |
| Alternative risk transfer | Insurance and capital-markets structures for transferring risk | Whether a transfer programme is judged against the capital it releases |
| Risk analytics | The models and measures for each risk type and for the portfolio | Model validation, and whether model outputs drive decisions |
| Risk tolerance | The level of a critical risk the board and management agree to accept, documented in an ERM policy | Limits that cascade from the appetite statement to desks and products |
| ERM maturity model | A scale for judging how far an ERM programme has developed | A way to report progress to the audit committee without a pass-or-fail verdict |
| Dashboard reporting | Risk reporting designed for decisions, contrasted with traditional reports | A board pack that shows risk against appetite on a page |
| Feedback loop | Judging risk management by measurable results rather than by the absence of losses | Evidence that the framework has improved outcomes |
What it means for internal audit: auditing ERM against the book
Internal audit’s role in ERM is assurance on whether the framework works, not ownership of it, and the book supplies a structure detailed enough to test. The Global Internal Audit Standards require the chief audit executive to understand how the organisation identifies and assesses significant risks and selects its controls (Standard 9.1); at Federal Reserve-supervised institutions above $10 billion, SR 13-1 asks internal audit to analyse the effectiveness of all critical risk management functions and to give the audit committee, at least annually, an opinion on the adequacy of risk management processes; and at national banks above $50 billion the OCC’s guidelines call for an independent assessment of the risk governance framework at least annually, by internal audit, an external party or both. The table maps the book to the work. The ERM audit guide, the guide to internal audit in banking and the regulators’ expectations guide carry the surrounding procedures.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Auditing the ERM framework | Seven components, each testable, in a chain from the board to stakeholders | Structure the audit by component and report a weakness anywhere in the chain as a weakness in ERM |
| Risk appetite and limits | Limits that bind; tolerances agreed between the board and management | Test the cascade from the appetite statement to desk limits; analyse breaches and how each was resolved, as SR 13-1 expects internal audit to evaluate the reasonableness of limits and test adherence |
| Incentive compensation | Pay for the performance you want | Test whether bonus pools are risk-adjusted and whether the chief risk officer has an input; Regulation YY requires the framework to integrate risk management and its controls with management goals and compensation |
| The chief risk officer and the risk committee | Independence and standing | Test reporting lines, access and the committee’s challenge against the charter and the rules; the governance audit guide gives the method |
| Board risk reporting | Dashboards built for decisions | Assess whether the board pack shows the risk profile against appetite and trends; the board risk reporting guide describes a good pack |
| Risk analytics and models | Models that are validated and used | Test model validation and whether outputs drive limits, pricing and capital; see the model risk audit guide and the value at risk guide |
| Cash and liquidity | Keep your eye on the cash | Reconcile profit to cash by business line; test liquidity stress assumptions against actual collateral and funding needs; see the liquidity risk guide |
| Risk culture | Balance the yin and the yang | Include culture, escalation and the treatment of people who raise concerns in the scope of the ERM audit; see the culture audit guide |
One caution matters more than the rest. The book is written from the chair of the chief risk officer, and an auditor who adopts its framework wholesale risks auditing ERM as the risk function would design it rather than testing whether it works. The independent question is the one Lam himself put in 2010 when he argued for feedback loops: has the framework improved outcomes, for example by reducing unexpected volatility in earnings, and would the organisation know if it had not? A framework that conforms to every component and cannot answer that question has not been shown to work. The site’s summary of The Failure of Risk Management makes the sharper version of the same challenge.
The criticisms, and what the book leaves out
We found no substantial published review of the second edition, so the points below are our reading, checked against the contents and against what has happened since. A 2025 review of Lam’s follow-up book, by the Mutual Fund Directors Forum, found it engaging but textbook-like and sometimes technical, and readers of this book should expect the same register. The most important limitation is date. The second edition was published before COSO’s 2017 framework, ISO 31000:2018, the Three Lines Model and the Global Internal Audit Standards, so its framework predates COSO’s integration of risk with strategy and the IIA’s restatement of the lines, and its regulatory discussion predates the supervisory changes of 2025 and 2026. An auditor needs to translate its framework into the current standards, and the table in the previous section is one way to do it.
Three further limits follow from the book’s origins. Its centre of gravity is financial services: three chapters on the main financial risk types, a chapter on financial institutions, and six of the eleven named case studies are of banks and other financial institutions, so that a reader in manufacturing, healthcare or the public sector must do more of the translation. Its analytics, economic capital and risk-adjusted return above all, depend on models whose weaknesses Lam himself acknowledged in 2010, when he argued that value at risk and economic capital capture only risks within set probability levels and must be supplemented by stress tests and scenarios. And as a book by a practitioner and consultant, it is written to make the case for ERM; an auditor should hold it, and any programme built on it, to Lam’s own call for feedback loops, evidence that the framework has improved outcomes. For the economics of bank capital that the book takes for granted, the Bankers’ New Clothes summary is the counterweight, and the Too Big to Fail summary covers the crisis that tested the first edition’s predictions.
Editions, companions and how to read it
| What | Details | Best for |
|---|---|---|
| First edition | Wiley Finance, 2003; four sections, twenty chapters | Historical interest; the original predictions |
| Second edition | Wiley Finance, 2014 (ebook January, hardback March in Wiley’s listing); five sections, twenty-five chapters; hardback ISBN 9781118413616 | The edition to read |
| Companion | Implementing Enterprise Risk Management: From Methods to Applications, Wiley, March 2017; twenty chapters in seven parts, including chapters on the three lines of defence, the risk appetite statement, risk and control self-assessment and ERM dashboards | Putting the framework into practice |
| Current frameworks to read alongside | COSO’s 2017 ERM framework and ISO 31000:2018 | Translating the book into current language |
| Reading plan | Chapters 2 and 4 for the lessons and the definition; Section Two for the framework; chapters 21, 22 and 25 for implementation, the board and dashboards; the risk-type chapters as the audit plan requires | An auditor preparing an ERM audit |
Read it with the organisation’s risk appetite statement and last board risk pack open. The first test of the book’s value is whether, after the chapter on lessons learned, the reader can say which of the seven the organisation would fail; the second is whether the board pack would show it.
A one-hour discussion guide for an audit team
- Ten minutes: the seven lessons. Each person scores the organisation against the seven lessons on a three-point scale, independently. Compare the scores and discuss the lesson with the widest spread.
- Fifteen minutes: the limits. Take the last twelve months of limit breaches in the riskiest business. How many were resolved by reducing the position, and how many by raising the limit? Decide whether the answer is a finding.
- Ten minutes: the pay. Read the bonus plan for the riskiest business line. Identify one behaviour it rewards that the risk framework is meant to prevent.
- Fifteen minutes: the chain. Trace one risk from the board’s appetite statement to a desk limit, a model, a report and a disclosure. Mark where the chain breaks or goes unevidenced.
- Ten minutes: the opinion. Draft the two sentences of the annual opinion on risk management that the evidence would support today, and list what the function would need to know to strengthen it.
Worked example: Thornwick Bank audits its ERM framework
Thornwick Bank is a fictional US bank. Its holding company has $62 billion of consolidated assets and owns a national bank and a broker-dealer, and its capital markets business serves corporate clients in fixed income, foreign exchange and interest rate derivatives. The internal audit function has 24 people. At its size the holding company must keep a board risk committee and a chief risk officer under Regulation YY; the national bank, with average assets above $50 billion, is subject to the OCC’s heightened standards, although the OCC’s December 2025 proposal to raise the threshold to $700 billion would remove it from their scope if finalised; and, following SR 13-1, the chief audit executive gives the audit committee an annual opinion on the adequacy of risk management processes. For the 2027 plan the chief audit executive scheduled an audit of the ERM framework that would serve both purposes, the annual opinion and the independent assessment of the risk governance framework, and asked the team to structure it on the book’s seven components and test it against the seven lessons. An audit director and five auditors ran the engagement over ten weeks, with model specialists from the function’s co-source provider.
| Component or lesson | What the function tested | What it found | Result |
|---|---|---|---|
| Corporate governance | Risk committee composition, charter and minutes against Regulation YY; the risk appetite statement and its cascade | The committee met the composition and meeting requirements. The appetite statement had 22 metrics, of which nine were quantitative, and none covered counterparty concentration in derivatives, the capital markets business’s largest single exposure | Finding: a quantitative concentration limit added to the appetite statement and cascaded to the desks |
| Set limits and boundaries | Twelve months of market risk limit breaches on the rates desks | Of 31 breaches, 19 were resolved by temporary limit increases approved by the head of capital markets rather than by independent risk management, and six of those increases became permanent without the risk committee being told | Finding: increases above a threshold to need chief risk officer approval and be reported to the committee |
| Pay for the performance you want | The capital markets bonus pool and the chief risk officer’s role in it | The pool was set as a share of revenue; risk input was limited to a conduct gate that could remove individuals but not resize the pool | Finding: pool sizing to use a risk-adjusted measure, with a documented chief risk officer assessment, consistent with Regulation YY’s requirement to integrate risk management and its controls with compensation |
| Use the right yardstick | Use of the economic capital model in pricing and relationship reviews | Risk-adjusted returns were calculated for corporate relationships but used in neither pricing approvals nor annual reviews | Observation: risk-adjusted return to be shown in credit approval papers above a threshold |
| Data and technology | Aggregation of exposure to the ten largest derivatives counterparties | Exposures were held in three systems and combined in a spreadsheet two days after month-end; one counterparty’s exposure had been understated for three months by a mapping error | Finding: automated daily aggregation, with the spreadsheet’s mapping logic tested in the interim |
| Stakeholder management and reporting | The board risk pack against the appetite statement | The quarterly pack ran to 140 pages; the comparison of risk profile with appetite was on page 87, and the pack showed no trends | Observation: a one-page dashboard of the risk profile against appetite, with trends, at the front of the pack |
| Balance the yin and the yang | Culture survey results and interviews in capital markets | 38 percent of capital markets staff disagreed that raising a concern about a limit would be welcomed, against 14 percent in the rest of the bank | Observation: reported to the risk committee with the breach analysis, as two views of the same problem |
The audit produced four findings and three observations, and its overall conclusion was more useful than any single finding. The framework existed and conformed: there was a risk committee that met its requirements, an appetite statement, limits, models and a chief risk officer with the right reporting lines. What the audit showed was that in capital markets the hard side was routinely bent to fit the soft side: limits raised to fit positions, pay sized on revenue and concerns not raised, which is the pattern of the subtitle and of the failures read against it earlier in this guide. The chief audit executive’s annual opinion described risk management processes as adequate for the bank as a whole and as requiring improvement in capital markets, and set out the evidence in the terms of the seven lessons, which the committee found easier to follow than a list of control deficiencies.
The chief risk officer accepted all four findings and asked for the limit-increase rule to take effect before the next quarter’s trading plan. The head of capital markets disputed the pay finding on the grounds that revenue was the measure competitors used; the report recorded the disagreement and the committee referred the pool design to the compensation committee, whose decision it was. The function recorded one change to its own practice: the annual risk management opinion would in future be built on the seven components, so that a weakness in one link of the chain could be seen in the context of the whole. The bank audit universe example shows where an engagement like this sits in a bank’s plan, and the audit committee effectiveness guide covers how the committee itself should weigh such an opinion.
Frequently asked questions
Is the 2014 edition still worth reading after COSO 2017 and ISO 31000:2018?
Yes, for its lessons and its component-by-component framework, which in our view are more specific about where ERM fails than the newer frameworks. Read it alongside them and translate its vocabulary into theirs.
How do Lam’s seven components relate to COSO’s five?
They are built differently. Lam’s follow the organisation, from the board through the business lines and the analytics to stakeholders; COSO’s 2017 components follow a cycle from governance and culture through strategy, performance and review to information and reporting. Our mapping puts governance with governance and culture, most of the operational components with performance, and data and stakeholders with information, communication and reporting.
Was James Lam the first chief risk officer?
By his own account he proposed the title for himself at GE Capital in 1993, modelling it on the chief information officer, and his publisher describes him as widely regarded as the first. He later held the title at Fidelity Investments.
Should I read this book or Implementing Enterprise Risk Management?
This one for the framework and the lessons; the 2017 book for implementation, with chapters on the three lines of defence, risk appetite statements, risk and control self-assessment, dashboards and feedback loops. An auditor planning an ERM audit will get more from this book first.
Does a $62 billion bank need a chief risk officer and a risk committee?
If it is a bank holding company with $50 billion or more of assets, yes: Regulation YY requires both, with the chief risk officer reporting to the risk committee and the chief executive. A national bank of that size is also subject to the OCC’s heightened standards, unless the OCC finalises its proposal to raise the threshold to $700 billion. The bank thresholds guide sets out the ladder.
Where does the book sit in an auditor’s reading?
With the books on risk management and banking; the internal audit reading list organises the site’s recommendations by theme and career stage.
Related guides
- How Internal Audit Should Audit the ERM Program Itself — the audit programme for the framework
- Internal Audit’s Role in ERM: Assurance, Advice, and Limits — where assurance ends and ownership begins
- Risk Appetite Statements That Actually Guide Decisions: Eight Examples and the Cascade — the statement the limits should cascade from
- Board Risk Reporting: The Quarterly Risk Pack That Directors Actually Read — dashboards built for decisions
- Risk Management Frameworks Compared: COSO, ISO 31000, NIST — the current frameworks beside the book
- Bank Regulatory Thresholds in 2026: The US Ladder, Tailoring Categories, EU, UK and Japan — which rules apply at which size
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply