One of the challenges many companies in the financial sector face when focusing on enterprise risk management is to what level they need to be focusing on the various potential threats they face.

It was noted by Jeff Gerrish, chairman of the board of Gerrish McCreary Smith Consultants, in a piece for the ABA Banking Journal, that one thing that businesses frequently overlook is the principle of "appropriate for the size and complexity of the institution". In other words, they either do too much risk management, or too little.

This is why firms must ensure their policies and procedures are tailored to the exact needs of their firm. Mr Gerrish noted that no-one - including regulators - expects a small community bank to have the same measures as a company dealing in the billions of dollars. But hitting the right level is often easier said than done.

Mr Gerrish said: "One of the reasons many community banks are easily intimidated by enterprise risk management [is] they view it as simply identifying every minute risk that could possibly impact the organisation."

Therefore, he added all institutions - big or small - need to understand not only what risks are in the market, but which will be the most relevant to their operations. Some potential issues - while quantifiable - will have relatively little impact on the organisation's activities as a whole.

"You should still implement processes that help identify those risks, but the institution's resources should be targeted primarily at risks that could have a significant impact," Mr Gerrish continued.

To determine what risks need the highest priority, effective reporting and analysis of both internal and external information is essential. The writer noted that firms need to incorporate tables, graphs and summaries into these activities. It is also vital to understand what this raw data means in real terms, as without context, the data is not likely to offer the insights that businesses need to cirrectly assess key areas of risk.