An enterprise approach to risk management is required under the venerable OMB circular A-123. That's helped push ERM down into agency practices.
