Thanks to Sarbanes-Oxley's new Auditing Standard 5 (AS5), which fosters a top-down, risk-based approach to compliance, enterprise risk management (ERM) solutions are likely to see a surge in interest in coming months. By providing insights into the multiple risks a company faces, ERM technology enables top management to dig through the morass of organizational layers to gain a holistic view of risk. The technology is all about "gaining more of an enterprise perspective on risk versus a siloed approach," says Lee Dittmar, a principal at Deloitte Consulting. As a result, "By saying that top down is better than bottom up, AS5 has provided a shot in the arm for ERM," says Steve Minsky, CEO at LogicManager, a provider of ERM software.

While ERM implementations vary widely across companies and industries, there's consensus that an ERM system must incorporate real-time visibility and analytics about all categories of risk, enabling the management of operational and compliance risks and controls across lines of business, legal entities and processes. It should follow a COSO-based ERM framework that supports Sarbanes-Oxley and other compliance initiatives. It should also provide a means for tracking losses, plus automated alerts that notify management when risks exceed company-specific thresholds. The latest versions offer personalized dashboards with drill-down capabilities.

ERM systems are distinguished by the sophistication of their risk assessment, loss management and risk modeling. "Some have simple graphs doing heat maps in a simplistic way. Some do more qualitative modeling. At the extreme end, [solutions offer] quantitative modeling, such as Monte Carlo simulations," says Michael Rasmussen, president of Corporate Integrity, a newly created governance, risk and compliance (GRC) consulting firm. Loss management, he adds, is especially important. "A significant piece of any ERM is not only predicting the future, but where you've been in the past."