Compliance and controls focus on specific rules or processes. ERM looks across the enterprise to understand how risks interact, impact objectives, and affect long-term performance.