Skip to content
ComplianceOfficer
§ 01

ERM register

Enterprise risk management software, the ERM risk register, KRIs and risk appetite limits

Run the free scan

Work email and a 6 digit code. No card, nothing charged. Starter plan $149 a month when you want the daily watch.

Enterprise risk management software keeps one register for every risk that could stop you hitting your objectives, scores each one against a stated risk appetite, tracks key risk indicators, and rolls the whole thing up for the board. Most ERM platforms stop there, which is why the register goes stale between quarterly meetings. ComplianceOfficer is not an ERM platform: it has no risk scoring, appetite limits, KRIs or board reporting. It covers the moving part underneath your compliance and regulatory risk lines: a register of the obligations, checked against the sources once a day, with each new change emailed to you instead of waiting for someone to notice.

Build the obligation register under your risk lines

Pick your sector below. The scan returns the obligation register that sits under your compliance and regulatory risk lines, with the last 12 months of regulatory movement and sources linked. No signup, nothing stored.

§ Live · Compliance scan

One free run. Nothing you pick is stored.

Frameworks you answer to

Fintech, US · first rows of a real scan

  • § 01 Control environment and governance
  • § 02 Risk assessment and monitoring of controls
  • § 03 Logical access controls
  • § 04 System monitoring and incident response
§ 02 ERM versus point tools

What enterprise risk management software actually does

The word enterprise is doing real work in that phrase. A vendor risk platform tells you about suppliers. An IT risk tool tells you about systems. Neither can answer the question a board asks, which is what our ten biggest risks are and whether any of them is getting worse. ERM software exists to answer that one question, and it does it with four moving parts.

First, one register, so a risk recorded by the treasury team and the same risk recorded by operations do not live in separate spreadsheets under different names. Second, a scoring method applied consistently, usually likelihood against impact (the job of dedicated compliance risk assessment software), so a $2m operational risk and a $2m credit risk sort next to each other rather than being argued about. Third, a risk appetite statement with real limits, because a register with no appetite behind it produces a list nobody can act on. Fourth, indicators with thresholds, so movement is detected between assessments rather than at them.

The failure mode is almost always the fourth part. Registers get built properly, then age. A risk logged in February as low likelihood because a rule was only proposed becomes a very different risk once that rule is final, and nothing in a conventional ERM tool knows the difference.

Category What it covers Who owns it Its blind spot
ERM software Every risk category in one register, appetite, KRIs, board reporting Chief risk officer, risk committee Depends on humans to refresh it; usually blind to rule changes
GRC suite Controls, policies, evidence, audits, with a risk module attached Compliance and internal audit Risk often reduced to a control-failure log, not enterprise risk
Vendor risk tool Third-party questionnaires, tiering, contract and SLA risk Procurement, security One risk domain; cannot aggregate to an enterprise view
IT and cyber risk tool Asset inventory, vulnerabilities, control maturity scoring Security team Speaks a technical language a risk committee cannot use
Spreadsheet register Whatever the last person to touch it decided Nobody, in practice No version history, no thresholds, no alerting, no audit trail

Plenty of teams need more than one of these. The point of the table is that only the first row produces an enterprise view, and the row that most often gets bought instead is the second. If controls and evidence are your live problem rather than risk aggregation, start with GRC software and add the register later. If third parties are the exposure, our vendor risk management software page covers that domain on its own terms.

The register, across the five enterprise risk categories

A workable enterprise register is not a hundred lines. It is a small number of named risks per category, each with an owner, a score, a treatment and an indicator. Below is that shape. An ERM platform holds it; the scan only builds the obligation register that sits under the regulatory and compliance lines.

  • § 01 Strategic: market shift, failed initiative, concentration STR
  • § 02 Operational: process failure, key person, outage OPS
  • § 03 Financial: liquidity, credit, receivables, FX FIN
  • § 04 Regulatory: a rule changes and an obligation moves REG
  • § 05 Compliance: a control stops meeting the rule CMP
  • § 06 Third party: supplier failure, subprocessor breach TPR
  • § 07 Technology and cyber: intrusion, data loss, availability CYB
  • § 08 People and conduct: misconduct, culture, capacity PEO
  • § 09 Reputational: customer trust, media, regulator posture REP
  • § 10 Indicators breaching threshold, escalated automatically KRI

The two seal-red lines are the ones software can keep current without being asked. Regulatory risk moves when a regulator moves, and that is observable. Indicator breaches are arithmetic. Everything else still needs a human to reassess. ComplianceOfficer only helps with the first of the two: it checks the sources behind your obligations every day and tells you what moved, and you reassess the risk line. The mechanism is described on how it works.

§ 03 Framework

COSO ERM or ISO 31000, and what the software has to support

Two frameworks dominate US practice, and a buyer usually has to state which one the program follows before an ERM tool is configured. COSO's 2017 framework organizes 20 principles into five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting. It leans into board oversight and ties risk to strategy, which is why US public companies cite it most often. ISO 31000:2018 is lighter: eight principles, a framework for embedding risk management in governance, and a process for identifying, analyzing, evaluating and treating risk. ISO explicitly publishes it as guidance, so there is no ISO 31000 certification for an organization to hold.

Neither framework tells you to buy anything. What they do is set the fields your register has to carry: an appetite statement, tolerances, defined ownership, a treatment decision, and a review cadence with evidence that the review happened. If a tool cannot represent all of those, it will not survive an internal audit of the ERM program itself. We wrote the full side-by-side in COSO ERM vs ISO 31000, including the case for running both.

COSO has also kept publishing, most recently From Guidance to Action: Exploring Practical ERM in 2026, which is worth reading if your program is technically compliant with the framework and still not informing any decisions.

Enterprise risk management software for banks and financial institutions

Banking is where ERM stops being a governance nicety and becomes a supervisory expectation with a written standard behind it. The clearest example is the OCC Guidelines Establishing Heightened Standards, appendix D to 12 CFR part 30, and it is also a live example of why a register needs to track the rule and not just the risk.

Appendix D requires a covered bank to establish a risk governance framework with three defined roles: front line units, independent risk management, and internal audit. On top of that it requires a strategic plan, a risk appetite statement, concentration and front line unit risk limits, processes for reviewing and communicating appetite, defined handling of limit breaches, risk data aggregation and reporting, and talent and compensation programs aligned to the framework. The board carries its own standards, including active oversight, independent directors, ongoing director training and periodic self-assessments. That list is a specification for an ERM system, written by a regulator.

Verified August 2026

The threshold is still $50 billion, not $700 billion

Appendix D currently applies to any covered bank with average total consolidated assets of $50 billion or more, plus any smaller bank whose parent company controls at least one covered bank. On 30 December 2025 the OCC published a proposed rule that would raise that trigger to $700 billion, adding a prong for banks the OCC judges highly complex or otherwise higher risk. Comments closed on 2 March 2026. As of 1 August 2026 no final rule has been published, so the $50 billion threshold and the full framework requirement remain in force. A bank between $50bn and $700bn that has already started standing down its heightened standards program is acting on a proposal, not a rule.

Sources: 12 CFR part 30 appendix D (eCFR, current text); OCC Bulletin 2025-51; Federal Register proposed rule 2025-23986, published 30 December 2025, comments closed 2 March 2026.

That is the exact category of change this product exists to catch, and it cuts both ways: a proposal misread as final is as expensive as a final rule missed. Banks and credit unions running an ERM program alongside BSA obligations usually pair this with AML transaction monitoring, and the same watch loop drives our regulatory change management page.

§ 04 Choosing

How we compare, honestly

The established ERM market is enterprise software: Riskonnect, MetricStream, LogicGate, Diligent, Workiva and Ncontracts all sell mature, configurable platforms, generally through a sales process with custom quoting rather than published prices (for banks weighing the last one, see Ncontracts competitors and pricing). If you are a $40bn bank with a twelve-person risk function, a dedicated risk committee and integration requirements across a dozen systems, one of those is very likely the right answer, and we will say so.

We are built for the team below that line: a compliance or risk lead, maybe two, at a regulated company that needs a defensible obligation register and cannot absorb a six-figure platform plus a year of configuration. What we do is the regulatory watch. In every incumbent platform, the regulatory and compliance risk lines are updated when a human notices a rule changed. With us, the daily check finds the change and emails it to you with the source; updating the risk line is still your call. What we do not have is an ERM platform at all: no risk scoring, appetite limits, KRIs or board reporting, no insurable risk and claims module, no actuarial modelling. Our published tiers are on the pricing page, and the wider field is compared in best compliance software.

Enterprise risk management software questions, answered

What is enterprise risk management software?

Enterprise risk management software is a single system holding an organization's whole risk picture: one register covering strategic, operational, financial, compliance and reputational risk, scored assessments against a stated appetite, key risk indicators with thresholds, treatments with owners and dates, and board reporting. It differs from point tools such as vendor risk or IT risk platforms, which each cover one domain, because its job is aggregation into a view a risk committee can act on.

Is ERM software the same as GRC software?

No, though they overlap heavily. GRC is the broader category covering governance, risk and compliance, and most GRC suites bolt on a risk module. ERM software is the risk half done properly: one register, appetite and tolerance, indicators, aggregation to the board. Ask which side is failing today. If controls and evidence are the pain, buy GRC first. If nobody in the building can name the top ten risks, buy ERM first.

What are the five components of the COSO ERM framework?

The 2017 COSO ERM framework organizes 20 principles into five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting. US public companies cite it most often because it ties risk to strategy and board oversight rather than treating risk as a separate exercise. ISO 31000:2018 covers similar ground with eight principles and a lighter process model.

What is a key risk indicator?

A key risk indicator, or KRI, is a measurable signal that a risk is moving before it becomes a loss. A KPI measures performance already delivered; a KRI looks forward. Turnover in a control function, failed access reviews per quarter, days past due in the receivables book, unresolved audit findings. Each carries a threshold tied to the appetite statement, so crossing it triggers escalation instead of a conversation at the next quarterly meeting.

How much does enterprise risk management software cost?

Most established ERM vendors do not publish prices and quote per module, per user and per entity, so a mid-market program commonly lands in the tens of thousands per year before implementation, and large enterprise deployments considerably higher. Treat any single figure you see quoted for these platforms with suspicion unless it names its source. Our own pricing is published: $149 a month or $894 a year.

Do the OCC heightened standards still apply at $50 billion in assets?

Yes. As of July 2026 appendix D to 12 CFR part 30 still applies to covered banks with average total consolidated assets of $50 billion or more. The OCC proposed raising the threshold to $700 billion in a proposed rule published 30 December 2025, with comments closing 2 March 2026, but no final rule has been published. Until one is, the $50 billion trigger and the risk governance framework requirement stand.

Who is responsible for enterprise risk management?

Accountability sits with the board, which is why COSO and the OCC guidelines both write board standards separately. Day to day, a chief risk officer or equivalent owns the framework and the register, risk owners in the business own individual risks and their treatments, and internal audit independently tests whether any of it works. Software does not change who is accountable. It changes how much of their week goes on collection rather than judgment.

General regulatory information, not legal advice.

Run the compliance scan
§ 90

Related registers

§ 99 · Final entry

Create your account

Leave your work email, confirm the 6-digit code, and your account is ready. Nothing is charged to create it.

Buy the plan