Standard
Active
Last Updated: Oct 20, 2025
Track Document
ASTM E3502-25
Standard Practice for Enterprise Risk Management (ERM)
Standard Practice for Enterprise Risk Management (ERM)
E3502-25
ASTM|E3502-25|en-US
Standard Practice for Enterprise Risk Management (ERM)
Standard
E3502 Standard Practice for Enterprise Risk Management (ERM)>
new
BOS Vol. 15.08 Committee E54
$
72.00
In stock
ASTM International
Significance and Use
4.1 This practice provides organizations with a structured, systematic, and integrated approach to identifying, assessing, mitigating, monitoring, and reporting risks across all organizational functions. This practice is essential for ensuring that risk management contributes meaningfully to value creation and protection, strategic alignment, and enhanced operational resilience.
4.2 Organizations face an increasing complexity of risks—including regulatory compliance, financial volatility, cybersecurity threats, supply chain disruptions, and environmental challenges. To effectively navigate these dynamic conditions, it is essential to establish an ERM framework aligned with governance structures, regulatory requirements, and industry best practices. Implementing standardized ERM practices enhances decision-making, supports regulatory compliance, fosters a risk-aware culture, and ensures business continuity across evolving risk landscapes.
4.3 In this practice, organizations are provided with a baseline framework to implement effective ERM practices. It is recommended that:
4.3.1 Top management and oversight bodies shall integrate risk management across all activities, allocate resources, assign responsibilities, and align it with strategy and culture. They shall establish effective frameworks, communicate risk criteria effectively, monitor risks closely, promote accountability for decisions made within an organizational context, satisfy obligations that must be fulfilled, and ensure relevancy for their purposes.
4.3.2 Organizations shall incorporate an ERM framework into their management system (MS), with clear accountability at every level. Risk owners shall be assigned to oversee risks within their respective areas under the ERM framework, ensuring alignment with the organization's strategic objectives and risk appetite.
4.3.3 Organizations shall utilize systematic approaches to identify risks, hazards, threats, and sources across PESTLE domains—internal as well as external factors should be taken into consideration during this process of identification—with particular attention paid to vulnerabilities or uncertainties that might hinder attainment of objectives.
4.3.4 Risk assessments shall combine qualitative and quantitative techniques in order to analyze likelihood, probability, and possible repercussions associated with an event. Upon applying existing risk controls, this evaluation process shall identify any remaining risk and facilitate prioritization and decision-making processes.
4.3.5 Organizations shall implement risk treatment strategies such as avoidance, reduction, transference, and acceptance to meet applicable regulatory and compliance frameworks. When selecting risk controls, the selection should reflect an organization's risk appetite tolerance as well as alignment with security risk policies and overall organizational objectives.
4.3.6 Organizations shall establish key risk indicators (KRIs), reporting mechanisms, and escalation procedures to monitor the effectiveness of controls and detect new threats. Continuous monitoring, periodic audits, and structured reviews contribute to creating a dynamic risk profile while building resilience through adaptation to change and enhancement of risk-related processes.
4.3.7 ERM shall be integrated across strategic planning, financial management, cybersecurity, supply chain operations, and compliance processes as part of core processes to ensure enterprise-wide risk resilience, alignment between practices and objectives, and unified management of security risks, vulnerabilities, and emerging threats.
4.3.8 Organizations shall foster a risk-aware culture by encouraging transparency, training, and active engagement from all stakeholders. Empowering employees with knowledge to identify uncertainty, threats, and hazards creates an ideal setting for risk identification, analysis, and response.
4.3.9 Organizations must commit to continuous enhancement of their ERM frameworks. Regular assessment against industry best practices, benchmarks, and maturity models shall serve to increase understanding of risk, optimize residual risk levels, and strengthen resilience against future events.
Scope
1.1 This practice establishes a structured framework for identifying, assessing, treating, monitoring, and communicating risk across an organization. It provides a common language and approach to risk that supports the integration of enterprise risk management (ERM) into governance, strategic planning, decision-making, and operational processes. The goal is to enhance resilience, ensure compliance with legal and regulatory obligations, and promote organizational sustainability and continuity.
1.2 This practice applies to all levels of an organization, including governance, strategy, operations, and assurance functions. It is designed for use by organizations of all sizes and sectors, both public and private. The practices outlined herein are designed to support effective management of financial, operational, strategic, technological, legal, environmental, compliance, and reputational risks.
1.3 Managing risk across the enterprise is an iterative and systematic process that enables organizations to:
1.3.1 Set strategic direction and define risk appetite and risk tolerance;
1.3.2 Align risk management efforts across all components of the management system (MS);
1.3.3 Balance risk exposure with financial constraints while working toward strategic objectives;
1.3.4 Ensure compliance with applicable legal, regulatory, contractual, and policy-based obligations;
1.3.5 Make informed decisions at all organizational levels, including governance, strategy, tactical operations, and frontline activities.
1.4 The enterprise risk management (ERM) approach outlined in this practice is applicable to all types of risks, including those identified through a structured PESTLE (Political, Economic, Social, Technological, Legal, and Environmental) analysis. The use of the PESTLE framework helps organizations assess external and internal context and ensures comprehensive risk identification.
Note 1: Annex A1 provides examples of PESTLE-based risk factors and their relevance to specific industries and organizational functions.
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.