Which of the following is a component of an effective ERM framework?

• A. Governance (tone at top, policies)
• B. Budgeting procedures
• C. Inventory management
• D. Physical security controls

Answer: (A)

An effective ERM framework starts with governance—the way leadership sets the tone, establishes policies, and assigns accountability for risk. This foundation shapes how the organization identifies and manages risk across all areas, ensures risk management aligns with strategy, and promotes consistent, responsible decision-making. When top leaders demonstrate commitment and formalize risk policies, risk awareness becomes embedded in everyday operations and resources are directed to monitoring and mitigating risks.

Budgeting procedures, inventory management, and physical security controls are important parts of running an organization, but they are not the overarching framework that organizes risk management itself. Budgeting allocates financial resources, inventory management focuses on stock control, and physical security controls are specific risk mitigations. They support risk management, but without governance establishing authority, ownership, and policy, the ERM program lacks coherence and accountability.

So, governance—the tone at the top and the policies that define risk roles and responsibilities—forms the backbone of an effective ERM framework.