01
ERM framework & maturity review
Assess existing risk practices and develop an ERM policy, governance structure, methodology and implementation plan. Connect the framework to strategic objectives and the organisation’s decision-making routines.
UAE advisory / Risk
Enterprise Risk Management Consulting in the UAE
COSO ERM and ISO 31000-led advisory that connects strategy, risk appetite, controls and board reporting for UAE businesses.
Discuss your risk prioritiesThe business case
Make uncertainty part of better decision-making
Enterprise risk management is more than a risk register. It is a structured way to understand uncertainty, evaluate choices and protect the objectives that matter most. An effective approach considers both threats and opportunities across strategy, operations, finance, compliance, technology and reputation.
We help UAE organisations build or strengthen ERM using COSO ERM 2017 and ISO 31000:2018 as reference frameworks. The work connects risk ownership, appetite, assessment, control effectiveness and reporting so that risk information supports management decisions and board oversight.
Our approach is practical and proportionate. We work with the people who know the business, test assumptions and translate assessment results into actions with accountable owners. The goal is not to eliminate all risk, but to make informed choices and manage exposure within agreed boundaries.
Scope of advisory
Our risk services
02
Risk appetite & tolerance
Facilitate discussions on the risks the business is willing to take and the limits it should observe. Develop qualitative statements, measurable thresholds and escalation triggers aligned with strategy and capacity.
03
Risk identification & assessment
Run structured workshops and interviews to identify strategic, operational, financial, regulatory and emerging risks. Define consistent likelihood and impact criteria and distinguish inherent exposure from residual risk.
04
Risk registers, KRIs & reporting
Create registers with causes, consequences, owners, controls and treatment plans. Develop key risk indicators, heat maps and reporting templates that highlight trends, breached limits and decisions requiring attention.
05
Internal controls & assurance alignment
Map key processes, risks and controls using COSO Internal Control principles where appropriate. Assess control design, clarify ownership and align monitoring with compliance and internal audit without blurring assurance independence.
06
Resilience & business continuity
Identify critical activities, dependencies and disruption scenarios. Support business impact analysis, continuity arrangements and exercises, connecting resilience plans to the enterprise risk register and management priorities.
Framework into practice
From objectives to monitoring: a complete risk cycle
ISO 31000 supports integrated, structured and inclusive risk management with communication and consultation throughout the process. COSO ERM 2017 complements this by connecting governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.
01
Context & criteria
Define objectives, stakeholders, scope and the scales against which risks will be assessed.
02
Identify & analyse
Understand risk sources, causes and consequences; assess exposure and existing controls.
03
Evaluate & treat
Compare exposure with appetite, prioritise responses and assign action owners and deadlines.
04
Monitor & review
Track indicators and actions, report changes and refresh assessments as the business evolves.
Local context
Adapted to UAE entities
A UAE risk assessment should reflect the entity’s actual jurisdiction and activities. Depending on the business, relevant exposures may include licensing obligations, Corporate Tax and VAT, beneficial ownership, AML/CFT, data protection, employment, outsourcing and cross-border contracts.
We consider sector-specific regulation, free zone requirements and group structures rather than treating all UAE entities alike. Commercial factors such as customer concentration, supply-chain dependency, liquidity, cyber disruption and succession can be as important as formal compliance risks.
COSO and ISO 31000 are reference frameworks, not substitutes for applicable law. ISO 31000 provides guidelines and is not a certifiable management-system standard; our advisory does not promise ISO 31000 certification or the elimination of risk.
Tangible outputs
What an engagement can deliver
- ERM policy, methodology and governance roles
- Risk appetite and tolerance statements
- Risk assessment criteria and enterprise register
- Risk-control mapping and treatment action plan
- KRI dashboard and board risk-reporting pack
- Risk-owner workshops and monitoring calendar
Final deliverables are agreed for your entity’s needs and engagement scope.
From enquiry to execution
A structured, collaborative engagement
- 1
Discover
Understand your entity, objectives, concerns and existing documentation.
- 2
Assess
Review the current position and agree priorities, scope and deliverables.
- 3
Design
Develop tailored frameworks and practical tools with your team.
- 4
Implement
Support adoption, assign responsibilities and build internal capability.
- 5
Review
Evaluate progress and refine the approach as needs evolve.
Common questions
Risk advisory, clarified
Should we use COSO ERM or ISO 31000?
The frameworks can complement each other. COSO ERM is particularly useful for linking risk with strategy and performance; ISO 31000 provides principles, a framework and a risk-management process. We select an approach that fits the organisation rather than duplicate systems.
What is the difference between inherent and residual risk?
Inherent risk describes exposure before considering controls under the agreed methodology. Residual risk is the exposure remaining after the effect of controls. Comparing them helps management assess whether controls and further treatment are sufficient.
Is a heat map enough for board reporting?
No. A heat map is a summary. A useful board pack also explains material exposures, trends, appetite breaches, control weaknesses, actions and decisions needed. Scoring should use agreed criteria and be supported by evidence.
Can you work with an existing risk register?
Yes. We can review its completeness, scoring criteria, ownership and connection to objectives. We then improve reporting and action tracking so the register becomes part of an active management process.
Principal-led, framework-driven advice
Led by CS Bilu Balakrishnan, Founder & Principal Consultant, with over 20 years of governance, risk and ESG experience. Professional credentials include FCS, Registered Independent Director (IICA), Certified CSR Professional (ICSI) and the COSO ERM Certificate of Applied Competence.
Discuss your risk priorities
Start with a confidential discussion about your entity, current challenges and the outcomes you want to achieve.
Request a consultation