Risk curves in enterprise risk management: linking performance targets to risk responses

Abstract Enterprise risk management links performance commitments to decisions about resources and risk responses. This paper develops an exposure-based framework for selecting those decisions under a quantitative risk-appetite criterion. Coefficients remain fixed within each assessed regime. A general formulation separates a policy-specific risk profile from the least committed expenditure needed to meet the criterion. Analytical and hypothetical examples show when resource reallocation helps, how response costs change selection, and why local marginal costs cannot price every response switch. A multi-output activity model compares expenditure and expected-total-cost objectives, tests insurance pricing and programme effectiveness, and introduces binding resource constraints. Assessing a selected plan unchanged under alternative assumptions distinguishes its robustness from the options available after reassessment. A documented input procedure and lexicographic implementation make the calculations reproducible. The framework supports financial appraisal within ERM while retaining management responsibility for objectives, criteria and approval.