 is a framework enabling organizations to identify, assess, manage, and mitigate risks across all levels of the business. It strategically considers risks relevant to the organization, including — but not limited to — strategic, operational, financial, and compliance risks, all in support of achieving the organization’s values and objectives.

In-house lawyers often play a pivotal role in ERM by recognizing and evaluating risks, advising internal stakeholders, and assisting in managing or mitigating them as necessary. While legal training often emphasizes risk aversion, modern commercial realities demand a nuanced approach. Legal professionals need to embrace a risk continuum mindset, understanding the company’s business goals, strategy, and risk tolerance — its appetite for risk and the extent of acceptable consequences. This understanding provides the foundation for delivering accurate, tailored advice.

Legal teams contribute significantly to ERM by collaborating with Risk and Compliance functions, the Executive Leadership Team, and the Board. They help manage legal risks, ensure compliance with laws and regulations, and maintain oversight of the evolving legal landscape. Key areas of support include:

When risks are identified, in-house lawyers may be tasked with preparing reports or recommendations for senior decision-makers. To support ERM effectively, their advice must be strategic, considering both legal implications and commercial realities.

There is growing recognition of in-house legal teams as key strategic advisors. Effective ERM requires their integration into business decision-making, enabling them to mitigate legal risks associated with litigation, intellectual property, and reputational damage.

The “one-size-fits-all” approach to corporate risk assessment is no longer viable. This is particularly true in fast-evolving industries like technology, where in-house lawyers must navigate increased regulation and rapid innovation. Legal and commercial teams must collaborate closely, especially in global organizations with varied risk appetites across jurisdictions. Strong partnerships between internal counsel and business teams are essential, as siloed risk management is no longer feasible.

Technology plays an increasingly critical role in risk management, particularly in compliance and fraud prevention. In-house legal teams are leveraging data analytics and automation to enhance efficiency and accuracy in managing contracts, regulatory requirements, and other risk-related tasks. Harnessing technology helps legal teams adopt process innovations and tools to work more effectively and with greater insight.

Managing third-party relationships is a critical aspect of ERM. In-house counsel can implement processes to ensure vendors and partners comply with legal standards, mitigating risks such as fraud, regulatory breaches, and reputational harm.

Risk assessment and due diligence are essential when engaging with third parties. For example, in-house counsel must draft and enforce contractual clauses to safeguard the organization from breaches of laws like the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act. Sanctions screening, often handled by legal and compliance teams, identifies entities that organizations should avoid doing business with. Solutions like Diligent’s 

enhance this process, ensuring robust, comprehensive compliance across global operations.

The COVID-19 pandemic has intensified risk management complexities, increasing legal workloads amid budget constraints. Despite these challenges, in-house legal teams remain essential in protecting the company while driving efficiencies. Organizations are now moving beyond survival mode toward longer-term scenario planning, including 12-month and three-to-five-year strategies.

An effective in-house legal team brings more than just cost savings by reducing reliance on external counsel. When commercially focused and well-integrated, it offers a holistic, comprehensive perspective on ERM. This alignment ensures legal risk management supports the organization’s overarching objectives and values.

Download our checklist for risk leaders at all levels, and discover how to capture, contextualize, curate, and clarify data to keep your risk team and board informed and aligned.

Four C's of effective ERM reporting


Kathleen Dunphy serves as Legal Counsel at Diligent Board Services Australia Pty Ltd, where she focuses on enterprise risk management and legal compliance. With extensive experience in legal advisory and contract management, Kathleen provides strategic guidance to help the organization navigate complex legal and regulatory frameworks, playing a pivotal role in ensuring compliance and mitigating risks across the business. She holds a Bachelor of Laws from Western Sydney University and a Graduate Diploma of Legal Practice from The College of Law Australia.

The role of in-house legal in enterprise risk management

Cyber risk is no longer a back-office IT issue — it’s a boardroom priority and a business-critical challenge. As cyber threats escalate and regulations tighten, staying ahead demands more than vigilance; it requires strategic vision.

Whether safeguarding sensitive data, navigating new regulations, or aligning cyber strategies with business goals, the need for actionable insights has never been greater. That’s why the 

, is an unmissable opportunity for leaders in cybersecurity, governance, and risk management to redefine their approach to cyber resilience.

This free, global event — with specific sessions tailored to the 

 regions — delivers cutting-edge strategies, practical tools, and expert knowledge to empower professionals across industries.

Here are eight essential reasons you should mark your calendar and sign up for this pivotal gathering.

1. Learn from world-class cyber risk and governance leaders

The Cyber Risk Virtual Summit brings together some of the brightest minds in cybersecurity, governance, and risk management. This isn’t your average event: attendees will gain exceptional insights into the latest threats, trends, and best practices shaping the global cyber landscape, from tackling complex compliance matters, to fostering stronger board engagement on cyber issues. Each session is designed to equip you with the expertise to make informed decisions at the highest levels.

CISOs, board members, and other leaders need to translate complex cyber issues into actionable strategies. This summit offers insights into bridging the communication gap between technical teams and the board, ensuring cyber risk is not just understood but prioritized at the highest levels.

2. Access tailored sessions for different roles and regions

Cyber threats don’t occur in a vacuum — they’re shaped by global trends, regional regulatory pressures, and industry contexts. The summit addresses these nuances with content tailored to specific roles; from CISOs and IT risk leaders, to general counsels and board directors. Whether it’s emerging threats posed by AI, evolving regulations like NIS2, the EU AI Act, and the SEC’s disclosure mandates, or building cyber resilience in an era of geopolitical volatility, this event will equip you with the knowledge to stay ahead.

Whether you’re refining strategies for universal cyber threats or navigating region-specific compliance, this summit ensures every session delivers relevant insights.

3. Turn cyber risks into operational advantages

Cybersecurity isn’t just about defense; it’s a strategic enabler for innovation and business growth. At the summit, you’ll explore strategies to manage cyber risks proactively and align cybersecurity efforts with organizational goals. Sessions like 

“Mastering Cyber Risk & Board Reporting: From Threats to Strategic Advantage”

 provide tips on how to help you shift from a reactive stance to a proactive, strategic approach.

As cyber risks become increasingly complex, leaders must understand how to leverage cybersecurity as a competitive differentiator — not just a cost center.

4. Prepare your organization for future threats

The cyber landscape is evolving faster than ever, with AI-driven threats and privacy concerns at the forefront. Attendees will gain future-ready strategies to anticipate and mitigate emerging risks, from leveraging AI as a force multiplier for defenses to addressing cross-jurisdictional compliance challenges in a globalized business world.

Staying ahead of the curve is no longer optional. This summit equips you with the tools and frameworks to navigate rapid technological and regulatory shifts, ensuring your organization remains resilient.

5. Discover innovative tools and best practices

In addition to thought leadership, the Cyber Risk Virtual Summit showcases 

 and best practices to enhance your organization’s cybersecurity posture. From 

to actionable frameworks for streamlining threat detection and reporting, you’ll leave with tangible tools to implement immediately.

Modern cybersecurity challenges demand modern solutions. Learn how to integrate advanced tools into your risk management workflows for better visibility, faster responses, and more efficient operations.

6. Build a network of like-minded leaders

This summit isn’t just about learning — it’s also about connecting with peers and experts from around the globe. Whether you’re a CISO looking to share strategies with fellow security leaders, a board member seeking governance insights, or a risk manager navigating compliance challenges, the event provides unique opportunities for networking and collaboration.

In cybersecurity, collaboration is key. The relationships you build here can serve as a lasting resource for advice, innovation, and shared solutions.

7. Earn up to 4 CPE credits while gaining expertise

For professionals in information security, risk, or audit roles, continuing professional education (CPE) credits are essential. By attending the summit, you can earn up to 4 CPE hours while diving deep into content that directly enhances your day-to-day responsibilities.

You’re not just learning for the sake of it — you’re adding real value to your skillset while maintaining certifications that demonstrate your commitment to excellence.

8. And finally...It’s free and accessible from anywhere!

One of the most compelling reasons to attend is its accessibility. This no-cost, entirely virtual event eliminates barriers to participation, ensuring you can join from anywhere in the world.

You get world-class insights without the hassle of travel, making it easier than ever to prioritize your professional development.

The Cyber Risk Virtual Summit isn’t just another event — it’s a pivotal opportunity to shape the future of cybersecurity and governance in your organization. Whether you’re on the board, in the C-suite, managing risk, or driving IT security initiatives, this summit provides the insights, tools, and connections you need to succeed in an increasingly complex world.

Reserve your spot today and join us on February 5-6, 2025, for this transformative global gathering.

Diligent

Blog

The role of in-house legal in enterprise risk management

8 compelling reasons to attend the Cyber Risk Virtual Summit

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

The role of in-house legal in enterprise risk management

8 compelling reasons to attend the Cyber Risk Virtual Summit

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company