Every chief compliance or chief risk officer knows how a company gets started on risk management. First, senior executives and the board dodge the question. Then some risk they didn’t foresee suddenly goes sour. Then they panic and decide that enterprise risk management is the company’s salvation.

Then they go out and get themselves a framework.

When it comes to picking a model for implementing ERM, experts say there’s no one way to do it. As Todd Tueller, a partner and Risk Transformation Leader with Ernst & Young’s Advisory Services practice, notes, “There are a lot of good models, but at ...