State the characteristics of good ERM system

This is a question of Schweser concept checker. Curriculum has a similar list, but as the steps of an effective ERM system. I’m confused by them…Here is the list from CFAI:

Identify risk factor; quantify the exposure’s size; risk estimation calculation(VAR); identify the overall risk exposure; report to senior management; monitor compliance.