The Best Risk Management and ERM Books: A Practitioner's Reading List
Maxim Atanassov •
If you read one book on enterprise risk management, read James Lam's Enterprise Risk Management: From Incentives to Controls. If you read two, add Douglas Hubbard's The Failure of Risk Management. Lam shows how to build an ERM program; Hubbard shows why most programs measure risk badly and how to fix them. The rest of this list is sorted by what you need next.
The list at a glance
| Book | Author | Best for |
|---|---|---|
| Enterprise Risk Management: From Incentives to Controls | James Lam | Building an ERM program |
| The Failure of Risk Management | Douglas W. Hubbard | Measuring risk properly |
| Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives | John Fraser, Rob Quail and Betty Simkins | Research and case studies |
| Fundamentals of Enterprise Risk Management | John J. Hampton | A practical first book |
| Enhanced Enterprise Risk Management | John Sidwell and Peter Hlavnicka | Implementation tools |
| Enterprise Risk Management: Modern Approaches to Balancing Risk and Reward | Stefan Hunziker | Risk in strategy and decisions |
| How to be a Chief Risk Officer | Jennifer Geary | The CRO's job |
| A Short Guide to Risk Appetite | David Hillson and Ruth Murray-Webster | Setting risk appetite |
| Making Risk Management Work | Anthony Wilson | Risk culture and ownership |
| Cybersecurity and Third-Party Risk | Gregory C. Rasner | Third-party cyber risk |
| Global Risk Agility and Decision Making | Daniel Wagner and Dante Disparte | Resilience and global risk |
| The Moorad Choudhry Anthology | Moorad Choudhry | Risk in banking |
| Against the Gods | Peter L. Bernstein | The history of risk |
| The Black Swan | Nassim Nicholas Taleb | Rare, high-impact events |
| Fundamentals of Risk Management | Paul Hopkin | Learning ISO 31000 |
Start here: the foundations
1. Enterprise Risk Management: From Incentives to Controls by James Lam
Lam, one of the first chief risk officers, argues that risk management works only when incentives and controls point the same way. He covers the full program: governance, risk appetite, measurement, reporting and the CRO's role. It is the closest the field has to a standard text.
2. The Failure of Risk Management: Why It's Broken and How to Fix It by Douglas W. Hubbard
Hubbard takes apart the risk matrix and the colour-coded heat map, and shows why scoring risks from 1 to 5 can mislead a board. He replaces them with quantitative methods any analyst can learn. Read it before you design your next risk assessment.
3. Fundamentals of Enterprise Risk Management by John J. Hampton
Hampton writes for the manager who has just been handed ERM. He explains how to assess risk, manage exposure and treat risk as a source of opportunity, with a strong section on risk-aware culture. The best first book for a non-specialist.
For building and running an ERM program
4. Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives by John Fraser, Rob Quail and Betty Simkins
An edited collection from academics and practitioners. Its chapters on implementation, tools and teaching ERM make it the reference to keep on the shelf rather than read cover to cover.
5. Enhanced Enterprise Risk Management by John Sidwell and Peter Hlavnicka
Sidwell and Hlavnicka add tools from strategy and operations to a standard ERM program: PESTEL analysis, Porter's five forces, treatment plans, scorecards, the three lines model, and process improvement methods such as Six Sigma and 8D. Useful when your program exists and needs to deliver more.
6. Enterprise Risk Management: Modern Approaches to Balancing Risk and Reward by Stefan Hunziker
Hunziker shows how risk management adds value to strategy and decisions, with case studies from medium-sized and large companies. Written for university courses as well as practitioners.
For specific roles and topics
7. How to be a Chief Risk Officer: A Handbook for the Modern CRO by Jennifer Geary
A practical handbook for current and aspiring CROs: leadership, communication, stakeholder management and influence on decisions. The book to give a newly appointed CRO.
8. A Short Guide to Risk Appetite by David Hillson and Ruth Murray-Webster
A short book on one hard question: how much risk should the organization take? The authors separate risk appetite from risk attitude and give tools to set and communicate both. Pair it with our guide to risk appetite.
9. Making Risk Management Work: Engaging People to Identify, Own and Manage Risk by Anthony Wilson
Wilson focuses on people: how to get employees to report, own and manage risk. Read it if your risk register is complete and nobody uses it. See also building a resilient risk culture.
10. Cybersecurity and Third-Party Risk: Third Party Threat Hunting by Gregory C. Rasner
Most breaches now come through a supplier. Rasner explains how to assess, monitor and contract for third-party cyber risk.
11. Global Risk Agility and Decision Making: Organizational Resilience in the Era of Man-Made Risk by Daniel Wagner and Dante Disparte
Wagner and Disparte look at risks no single company controls: geopolitics, climate, pandemics and technology. Their answer is agility: organizations that sense and adapt faster than the risks move.
12. The Moorad Choudhry Anthology: Past, Present and Future Principles of Banking and Finance by Moorad Choudhry
Not a risk management book in the narrow sense. It is a broad work on banking, with deep coverage of liquidity, capital and balance-sheet risk. Read it if you manage risk in a bank or a lender.
Also worth reading: the classics
Against the Gods: The Remarkable Story of Risk by Peter L. Bernstein
The history of how people learned to measure risk, from probability theory to modern finance. The best book on why risk management exists.
The Black Swan by Nassim Nicholas Taleb
Why rare, high-impact events dominate outcomes, and why models built on the past miss them.
Fundamentals of Risk Management by Paul Hopkin
A textbook aligned to ISO 31000, written while Hopkin was technical director of the Institute of Risk Management. The clearest route through the international standard.
How to choose
- New to ERM: Hampton, then Lam.
- Building or rebuilding a program: Lam, then Sidwell and Hlavnicka.
- Your risk assessments rely on a heat map: Hubbard, then our article on why your current risk assessment process sucks.
- Newly appointed CRO: Geary, then Hillson and Murray-Webster.
- Board director: Lam's chapters on governance, then Hillson and Murray-Webster.
- Working to ISO 31000: Hopkin.
- Want the big picture: Bernstein, then Taleb.
Frequently asked questions
What is the best book on risk management?
For enterprise risk management, James Lam's Enterprise Risk Management: From Incentives to Controls. For risk measurement, Douglas Hubbard's The Failure of Risk Management.
What should I read first if I am new to risk management?
John Hampton's Fundamentals of Enterprise Risk Management. It assumes no background and covers the full cycle.
Are there free risk management resources?
Yes. The COSO Enterprise Risk Management: Integrating with Strategy and Performance executive summary and the ISO 31000 overview are free to read, and our risk management dictionary defines the terms these books use. See also our guide to the COSO ERM framework.
Links marked "Buy on Amazon" are affiliate links. A purchase supports this site at no cost to you.
