Technology to facilitate and execute enterprise risk management initiatives is widely available, but the specific tools to accomplish ERM can vary by industry and even the particular risk manager involved.

One inherent problem is that defining the elements that constitute an ERM program varies greatly.

There are a host of tools for ERM programs that capture data on operational, credit and market risk, along with capital modeling suites, management reporting information and monitoring metrics from various systems to provide a robust understanding of the data.

“Technology has its place in ERM” and is “not an allocation process where you can set it up in advance and it just runs and clients get what they need time and time again,” said Tom Wimberly, Atlanta-based vp of Aon eSolutions, a unit of Aon Corp. “This has a great deal more to do with being able to guide ERM at every stage and control it.”

Aon eSolutions' Risk Register is its primary ERM product, which feeds and interrelates with data stored in an existing risk management information system and “elevates an organization's view of risk” with heat maps, surveys and risk assessments through a series of tools, he said.

As ERM's core tenets encompass a business' potential risks and rewards across the entire organization, ERM technology must be configured to a specific organization's needs, observers say.

“There are no ERM tools that uniformly apply to every firm,” said Enrique Mejorada, vp of risk management and chief risk officer of Public Service Enterprise Group Inc. in Newark, N.J.

“There is going to have be an 'e' put in front of the word RMIS,” said David Duden, national risk management information systems practice leader at Deloitte & Touche L.L.P. in Hartford, Conn. “We are going to have to look at ERM information systems and today there are very few of those that actually exist in my opinion.”

While traditional RMIS do a good job tracking risks such as claims for property, workers compensation, general liability and auto liability, they fall short in making all the ERM connections, Mr. Duden said.

“They don't necessarily track what the impact or likelihood of different types of risk events might be for the organization,” Mr. Duden said.

“That's the problem with some of the standardized software packages. They may be very good, but if they don't match the processes—and we don't want to change the processes—then we can't use the systems,” said Hans Læssøe, senior director of strategic risk management for toy manufacturer LEGO Group in Billund, Denmark.

After surveying several systems for his ERM program, Mr. Læssøe decided to continue using an Excel spreadsheet he built that includes identifying various risks with columns for assessment, probabilities and likelihoods, some of which cannot be entirely quantified.

Mr. Læssøe's ideal approach would be to take his existing spreadsheet and build a database that multiple users can access with easy-to-use reporting tools.

“Simplicity is paramount and this is why I have found that a spreadsheet is good. Everybody accepts what a spreadsheet is,” Mr. Læssøe said.

Joe C. Underwood, principal at Albert Risk Management Consultants Inc. in Needham, Mass., said understanding what needs to be gauged and how technology can facilitate company processes is essential to achieve a program that genuinely constitutes ERM.

“The scope of an ERM system has a lot more to do with identifying controls and identifying areas of vulnerability and making sure there are appropriate controls to address those vulnerabilities,” Mr. Underwood said. “It requires that you understand what the risk manager's definition of ERM is before you go to suggest particular systems for them.”

The goal of an ERM application is to organize data and show it graphically so it can be digested easily and used to identify and mitigate risks, Mr. Underwood said.

“It is important for risk managers to try to match the technology to their level of sophistication. You want the emphasis to be on risk, not on the systems,” he said.

Bob Morrell, president and CEO of Riskonnect Inc. in Marietta, Ga., said ERM systems need to move beyond data collection to strategic risk management that is assisted by visualization tools.

Riskonnect's ERM platform uses key risk indicators to drive risk assessment through visual dashboards, internal risk surveys and collaboration technology, among others.

“We have clients that quantify nothing. There are no dollar amounts or even rankings associated with any of their risks,” Mr. Morrell said.

“They literally move risk bubbles around visually on a screen and really all that matters is the relative placement of risks, relative to one another, so they can prioritize risks and then track the mitigations around it and prioritize those,” he said.

“The reality is, trying to force dollar amounts or force strict rankings or units of measurement on risks can destroy a process just by itself,” he said.

Features of software most important to an ERM leader are “specific to the "risk factor' and impact analysis sought,” PSEG's Mr. Mejorada said. Such features include “analytical flexibility” in graphics “and the ability to process, in some instances, large amounts of data to produce actionable metrics on a timely basis,” which he said “are very important features of any ERM process.”

Despite any reticence from ERM leaders, the technology must be customizable at a level that is comfortable for the organization, said Tom Hettinger, North American property/casualty, ERM and capital modeling leader for Towers Watson & Co. in Chicago.

All ERM programs, and the technology supporting them, need to evolve, he said.

“This is a journey. You will continue to make changes to it,” Mr. Hettinger said.