Digitizing Enterprise Risk Management through Configurable Workflow Architecture and Cloud Computing

Abstract

Enterprise risk management (ERM) asks organizations to identify, assess, respond to, monitor, and report risks consistently across the whole enterprise. In practice, many organizations still run ERM on spreadsheets, email, and periodic manual reporting, so risk information is fragmented, slow, and hard to audit. Building on prior work on configurable workflow architecture for digitizing risk management, this article examines how configurable workflows and cloud computing together can digitize ERM across an enterprise. It connects ERM frameworks and the three lines model of governance with configurable workflow design, business process management, cloud service models, and scalable service architecture. It also considers the controlled use of large language models (LLMs) to assist risk teams. The article proposes a cloud-based reference architecture in which risk processes are expressed as configurable workflows, run on scalable cloud services, and are connected to operational systems. It maps each stage of the ERM process to its manual limitations and digital capabilities, and sets out six reusable risk workflow patterns with their three-lines roles. It also discusses cloud deployment and resilience, including the risk of depending on cloud providers. Using a design-oriented approach grounded in eleven studies published between 2011 and 2024, the article maps the evidence base and illustrates the architecture with a healthcare services group. It argues that ERM becomes enterprise-wide in practice when risk processes are configurable, integrated, and delivered on resilient cloud infrastructure.