Enterprise Risk Management (ERM) will be a business requirement for family-owned businesses, private companies, and nonprofits. This represents a strategy shift for such organizations, which up until now thought Sarbox and other ERM issues applied only to public companies. ERM is defined as the methods and processes used by organizations to manage risks (or seize opportunities) related to the achievement of their objectives.

Standard & Poor published a report (May 2008) on its approach to ERM analysis and how it plans to factor it into its corporate ratings. Their article How Corporate Governance Can Bolster or Hinder Enterprise Risk Management summarizes their position: "Given the current market environment and the new, ever-increasing and changing risks companies are facing, the roles and responsibilities of boards and senior management in overseeing and managing those risks likely will continue to increase in terms of quantity and complexity. Therefore, one of the biggest challenges for companies now is adopting the 'right' risk governance model to support its underlying ERM practices. There is increasing pressure around the world for companies to create governance structures that support strong ERM policies and procedures."

When private and nonprofit organizations will implement ERM strategies remains a tougher question. Understandably, they have a range of reasons - some legitimate; others questionable - on why they prefer delaying the time when ERM factors will be applied to them. However, the question is mainly when, not if, some form of ERM requirements will be applied to their enterprises.

When the economic climate changes as dramatically and as frequently as it does nowadays, contingency planning and risk management should be on every executive dashboard regardless of the size of your organization. Face your risks squarely and come up with an adaptable ERM plan. Don't wait until you're forced to make a Mayday call to a world that is embroiled in its own crisis.