ERM in my company: how does it work?