ASTM E 3502:2025

1.1 This practice establishes a structured framework for identifying, assessing, treating, monitoring, and communicating risk across an organization. It provides a common language and approach to risk that supports the integration of enterprise risk management (ERM) into governance, strategic planning, decision-making, and operational processes. The goal is to enhance resilience, ensure compliance with legal and regulatory obligations, and promote organizational sustainability and continuity. 1.2 This practice applies to all levels of an organization, including governance, strategy, operations, and assurance functions. It is designed for use by organizations of all sizes and sectors, both public and private. The practices outlined herein are designed to support effective management of financial, operational, strategic, technological, legal, environmental, compliance, and reputational risks. 1.3 Managing risk across the enterprise is an iterative and systematic process that enables organizations to: 1.3.1 Set strategic direction and define risk appetite and risk tolerance; 1.3.2 Align risk management efforts across all components of the management system (MS); 1.3.3 Balance risk exposure with financial constraints while working toward strategic objectives; 1.3.4 Ensure compliance with applicable legal, regulatory, contractual, and policy-based obligations; 1.3.5 Make informed decisions at all organizational levels, including governance, strategy, tactical operations, and frontline activities. 1.4 The enterprise risk management (ERM) approach outlined in this practice is applicable to all types of risks, including those identified through a structured PESTLE (Political, Economic, Social, Technological, Legal, and Environmental) analysis. The use of the PESTLE framework helps organizations assess external and internal context and ensures comprehensive risk identification. Note 1: Annex A1 provides examples of PESTLE-based risk factors and their relevance to specific industries and organizational functions. 1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use. 1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

03.100.01