Damon Boswell and Ashley Boswell explain why treating risk as a control checklist leaves mid-market companies exposed — and the ERM framework that turns risk into a growth advantage.
Most mid-market companies treat risk management the way they treat insurance — a compliance obligation to be checked off, renewed annually, and forgotten between renewals. Ashley Boswell has reviewed the risk practices of enough growing businesses to know that this framing is not just incomplete; it is dangerous. A business that manages risk only as a control checklist is managing the risks it can document while remaining blind to the risks that actually threaten its strategy. Enterprise risk management, done correctly, is not a compliance function. It is a strategic discipline that protects growth and, increasingly, creates it.
The distinction matters because the risk landscape has changed. Damon Boswell points to the four risk areas that now demand leadership attention at every growing company: cybersecurity, artificial intelligence exposure, enterprise technology dependency, and operational risk. A decade ago, these were IT concerns delegated to a vendor. Today, a single cybersecurity incident can halt operations, destroy customer trust, and trigger regulatory consequences that outlast the breach itself. The mid-market companies that survive the next decade will be the ones whose leadership teams treat risk as a board-level strategic conversation, not a quarterly compliance review.
Enterprise risk management, as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), is 'the culture, capabilities, and practices, integrated with strategy-setting and its performance, that organizations rely on to manage risk in creating, preserving, and realizing value.' Ashley Boswell emphasizes the last clause. ERM is not about avoiding risk — it is about deciding which risks to take in pursuit of value and which to avoid, mitigate, or transfer. A business that tries to eliminate all risk eliminates all growth. The discipline is in choosing, deliberately, which risks are worth the potential reward.
Damon Boswell structures an ERM engagement around the COSO framework's core components, adapted for the scale of a mid-market business. The first is governance and culture — establishing the tone at the top that makes risk a leadership conversation rather than a delegated task. The second is strategy and objective-setting — ensuring that risk appetite is defined alongside growth targets, so the business knows how much risk it is willing to accept in pursuit of each goal. The third is the risk management cycle itself: identification, assessment, response, and monitoring. The fourth is review and revision — the cadence that keeps the risk register alive rather than archived.
The risk register is where Ashley Boswell sees most companies fail the discipline. A risk register that is built once, filed in a binder, and never updated is a document, not a system. A living risk register is reviewed quarterly, scored on both likelihood and impact, and assigned a clear owner who is accountable for the mitigation plan. The scoring matters because it forces prioritization. A risk that is high-likelihood and high-impact demands immediate attention. A risk that is low-likelihood but catastrophic demands a contingency plan. A risk that is high-likelihood but low-impact demands a process fix. Without scoring, every risk feels equally urgent, and nothing gets managed well.
Risk response is the decision that separates strategic ERM from compliance theater. Damon Boswell walks leadership teams through four response options for every identified risk: avoid the risk entirely by exiting the activity, accept the risk consciously because the reward justifies it, reduce the risk through controls and mitigation, or transfer the risk through insurance and contracts. The key word is consciously. Most businesses accept risks every day without knowing they have done so, because no one has named the risk or decided that the reward is worth it. ERM makes those decisions explicit, documented, and owned.
The operational risk dimension is where Ashley Boswell sees mid-market companies most exposed. A growing business accumulates operational risk not from recklessness but from speed — new systems, new vendors, new geographies, and new processes that were never designed for the scale at which they are now operating. The single point of failure that was tolerable at $2 million in revenue becomes existential at $20 million. A proper ERM engagement maps those dependencies before they break, because the cost of mapping them is a fraction of the cost of discovering them during a crisis.
Enterprise risk management is not a luxury reserved for regulated industries or public companies. It is the decision-grade discipline that lets a growing business pursue ambitious goals without flying blind to the exposures those goals create. Damon Boswell and Ashley Boswell help leadership teams install that discipline — governance, strategy integration, a living risk register, and a response framework — so risk becomes a strategic input rather than a reactive scramble. That is the work, and it is the work Blueprint Business Advisors was built to do.
