Enterprise risk management (ERM) is a holistic, top-down approach that assesses how risks affect an organization and devises plans on how to approach different risks.