In an ERM framework, risks are assessed based on their likelihood and potential impact on the organization. The goal is not only to minimize the negative effects of risks but also to leverage opportunities for growth and improvement. ERM often includes risk identification, risk analysis, risk response, and continuous monitoring of risk factors.