Enterprise Risk Management

Assessment Brief

Assignment title: 7022- Developing risk management strategies

Johnson & Johnson case study exercise

Evaluation of a risk management model

Johnson & Johnson use the Enterprise Risk Management framework (ERM) – you will find more detail about this and other models in the CMI Pathways workbook for Unit 7022.

Evaluation questions:

1. Does this ERM approach look suitable for all sizes of organisations?
2. This is only a summary document, but would you say this looks like a complex or simple process? (It might be helpful to think in terms of expertise needed, costs, time needed)
3. Would this framework be useful in your organisation?
4. Which types of risk would you include for your business in the accountability table on page 9?
5. What would be the easiest component of ERM to implement in your organisation? Why?
6. What would be the most difficult component of ERM to implement in your organisation? Why?

Sample Answer

Evaluation of Johnson & Johnson’s ERM Framework

Suitability of ERM for all organisations

The Enterprise Risk Management (ERM) framework adopted by Johnson & Johnson demonstrates a comprehensive and integrated approach to identifying, assessing, and mitigating risks. While the model is robust, its suitability depends largely on the size and maturity of an organisation. For large multinational corporations such as Johnson & Johnson, the framework is highly appropriate because of the complex global operations, regulatory requirements, and diverse risk exposures they face. However, for small to medium-sized enterprises (SMEs), full adoption may be challenging due to resource constraints, limited expertise, and the costs associated with implementing and maintaining such a framework. SMEs may benefit from adapting a simplified version of ERM rather than adopting it wholesale.

Complexity of the process

Although presented as a summary, the ERM process clearly reflects a degree of sophistication. The framework requires detailed risk identification, accountability structures, reporting mechanisms, and integration into corporate strategy. This points to a relatively complex process that demands specialist knowledge, cross-functional engagement, and significant investment of time and resources. For large firms with risk management teams, this level of complexity is manageable. For smaller organisations, however, the time and expertise needed may be perceived as a barrier.

Usefulness within my organisation

In my organisation, adopting an ERM framework would be beneficial for improving risk awareness and embedding proactive management practices into strategic decision-making. It would ensure risks are not only considered at the operational level but also aligned with corporate goals. That said, the framework would need to be tailored to suit organisational size and resources, perhaps by streamlining reporting processes and focusing on the most material risks rather than applying every component in full detail.

Continued...