Officer and the BoardGRC Law & Consulting

Enterprise Risk & Strategy

Connect enterprise risk
to business decisions.

Use financial, operational, and external data to evaluate strategic choices, understand uncertainty, and decide where to commit resources.

How we can help

Assessments and risk registers

Combine leadership perspectives with operational and financial evidence. Examine gaps in the information and whether people feel able to report concerns candidly.

  • Leadership interviews and risk surveys
  • Analysis of operational, financial, and external risk information
  • Registers, priorities, and accountable owners
  • Connections to strategic and operational objectives

Risk appetite and decisions

Help leadership articulate the uncertainty it is willing and able to accept.

  • Risk appetite and tolerance
  • Materiality and escalation criteria
  • Scenario and opportunity analysis
  • Decision frameworks for strategic initiatives

ERM program development

Build a program around the organization’s objectives, structure, and culture, with clear authority and a way to address risks that cross departmental boundaries.

  • Program design and governance
  • Decision authority, reporting relationships, and shared responsibilities
  • Integration with planning and resource decisions
  • Assessment and improvement of existing programs

Monitoring and follow-through

Select measures that show whether a strategy is working, exposure is changing, or a decision needs to be revisited.

  • Leadership and board reporting
  • Mitigation plans and action tracking
  • Performance and risk indicators, review cycles, and triggers for action
  • Facilitated discussions and program support

Corporate insurance and risk transfer

Connect insurance decisions to the exposures the business has chosen to retain or transfer.

  • Review of corporate insurance arrangements, including D&O
  • Renewal planning and coordination with brokers and insurers
  • Review of limits, exclusions, and contractual insurance requirements
  • Leadership and board advice on gaps and retained exposure

Internal controls and audit coordination

Identify who owns each control, how it is checked, and what happens when it falls short.

  • Control inventories and accountable owners
  • Risk-based internal audit planning and process development
  • Coordination of external financial audits
  • Review of findings, management responses, and corrective action

Venture and opportunity analysis

Test the assumptions behind a new business, investment, or service against available evidence, including what is missing and what could change the decision.

  • Business models, pricing, and financial scenarios
  • Market, competitive, and regulatory developments
  • Risk analysis for investments, partnerships, and expansion
  • Decision criteria and reporting for boards and investors

Technology and organizational change

Bring operational experience to decisions that cross legal, technical, and business teams.

  • Governance for technology and AI initiatives
  • Privacy, security, and operational dependencies
  • Project risk and transition planning
  • Responsibilities, escalation, and implementation oversight

Illustrative engagement · Hypothetical

“As we expand our use of AI, how do we establish the right policies and governance?”

Inventory current and proposed AI uses, assess their purpose and potential consequences, and establish a review process proportionate to the risk. Address data use, privacy, vendor terms, validation, human oversight, and responsibility for monitoring performance and responding to concerns.

The work could produce: An AI use inventory, policies and approval criteria, assigned oversight responsibilities, and a monitoring process that identifies when to reassess, restrict, or stop a use.

Illustrative engagement · Hypothetical

“Our risk assessment produces a long list, but it does not affect what we do.”

Compare reported risks with operational and financial data, examine differences in what departments disclose, and connect priorities to business objectives, accountable owners, and resource decisions.

The work could produce: A prioritized register, action plans, and reporting measures tied to decisions and triggers for reassessment.

Illustrative engagement · Hypothetical

“Our insurance renewal is coming up. Does our coverage still fit the business?”

A new service, acquisition, or change in ownership can alter the company’s exposure. Review the insurance portfolio alongside those changes, the company’s contracts, and its risk appetite; then work with its broker to address the questions that need answers.

The work could produce: An exposure and coverage review, questions for the broker, and a renewal recommendation that explains the risk the business would retain.

Writing and references

Enterprise risk in practice

Robert B. Stratton · HCCA Compliance Institute · 2026

Healthcare enterprise risk management

Presentation materials on building an ERM program and connecting enterprise risk to leadership and board decisions.

Read the slides ↗
Robert B. Stratton · With Amy Stratton · 2026

The Board Will See You Now: When Research Risk Goes Enterprise

Research funding, infrastructure costs, financial sustainability, and communicating institutional decisions to executives and boards. Read the presentation overview ↗

Read the slides ↗
Robert B. Stratton · Writing

Risk, opportunity, and informed decisions

Examples exploring risk appetite, game theory, transparency, and how organizations interpret information.

Read the examples ↗

Start a conversation

OATB is coming soon.

This site previews planned legal and consulting services. Visit RobertBStratton.com for Robert’s professional background, writing, and speaking.

Contact Robert ↗