End-to-End ERM Framework for US Pension Fiduciaries: Investment, Liability, Operational, and ERISA Compliance Risk

Why Risk Management for Pension Funds Demands a New Playbook

If you serve as a fiduciary for a US pension fund, whether corporate defined benefit, public retirement system, or multiemployer plan, you already know the stakes.

 As of 2025, the Milliman 100 Pension Funding Index shows the largest corporate DB plans have crossed into surplus territory with a funded ratio above 106%, while state and local plans carry an aggregate $1.27 trillion in unfunded liabilities at a national average funded ratio of roughly 82.5%. These are not abstract numbers.

They represent promises made to millions of workers, and your fiduciary duty under ERISA or state trust law is to ensure those promises are kept.

The challenge is that the risk landscape for pension funds has fundamentally shifted. Public pension asset allocations have migrated steadily toward alternatives, now comprising nearly 32% of total assets, up from single digits two decades ago.

The share of pension fund assets priced based on valuations rather than market prices has almost tripled since the Global Financial Crisis, introducing what researchers call “valuation risk” that traditional risk frameworks were not designed to capture.

At the same time, longevity improvements, interest rate volatility, cybersecurity threats, and evolving regulatory expectations around ESG and fiduciary conduct demand a comprehensive, enterprise-wide approach to risk management for pension funds.

This guide provides an end-to-end ERM framework for US pension fiduciaries. It covers investment risk, liability risk, operational risk, and ERISA compliance risk in an integrated structure anchored to ISO 31000:2018 and COSO ERM.

Along the way, I will give you practical tools: risk registers, KRI dashboards, scenario models, and a 90-day implementation roadmap. For a foundational overview of enterprise risk management, see our step-by-step guide to risk assessment.

Building the ERM Architecture for a Pension Fund

Enterprise risk management for a pension fund is not just an investment exercise. According to NCPERS’ 2024 study, only 24% of public retirement systems have implemented a formal ERM framework.

That means three-quarters of public pension funds are managing risk in silos, with investment risk handled by one team, operational risk by another, and compliance risk by a third, with no integrated view presented to the board.

An effective pension fund ERM architecture has four pillars, drawn from the OECD’s framework for pension fund risk management: management oversight and culture, strategy and risk assessment, control systems, and information and reporting.

These map cleanly onto the ISO 31000 process of establishing context, identifying risks, analyzing and evaluating risks, treating risks, and monitoring and reviewing. Our risk management lifecycle guide walks through each of these stages in detail.

The Three Lines model provides the governance structure. The first line (investment staff, operations teams, plan administrators) owns the risks.

The second line (CRO, risk committee, compliance function) sets policy, defines risk appetite, and monitors adherence. The third line (internal audit, external auditors) provides independent assurance.

For a pension fund, the board of trustees sits above all three lines, setting risk appetite and holding management accountable.

If you are designing governance structures for the first time, our risk management policy guide lays out the key components.

The Pension Fund Risk Taxonomy: What You Need to Track

A pension fund risk assessment must cover four interconnected risk domains. The table below maps each domain to its sub-categories, the ERISA or regulatory anchor, and the KRIs fiduciaries should be monitoring. For an introduction to building KRI frameworks across industries, see our KRI examples guide.

For fiduciaries managing financial sector risk indicators more broadly, our financial KRI guide provides deeper coverage of credit, market, and operational risk metrics.

Investment Risk: Beyond the Policy Benchmark

Investment risk is the most visible risk domain for pension fiduciaries, and the one most likely to generate headlines.

Public pension fund returns swung from a historic high of 27% in 2021 to negative 4.8% in 2022, a 30-plus-percentage-point swing in a single year.

This volatility underscores why managing investment risk requires more than setting a strategic asset allocation and reviewing quarterly performance reports.

Asset-liability management (ALM) is the foundation. The purpose of a pension fund’s investment portfolio is not to maximize returns in isolation.

It is to generate sufficient returns to pay promised benefits as they come due, within the fund’s risk tolerance.

ALM modeling projects benefit payments over the next 30 to 50 years, overlays asset return scenarios, and identifies the probability of underfunding under different market regimes.

Monte Carlo simulation with 10,000 iterations across correlated asset classes is the standard quantitative tool. Our scenario-based risk assessment guide covers the mechanics of building scenario models.

Valuation risk in alternatives deserves special attention. The share of pension fund assets priced based on valuations rather than market prices has grown to over 25%. Private equity, real estate, infrastructure, and hedge fund valuations are reported with a lag and rely on manager estimates.

This creates a smoothing effect that understates volatility and overstates risk-adjusted returns. Fiduciaries should require independent valuations, track valuation adjustments as a KRI, and stress-test the portfolio assuming mark-to-market adjustments of 15–25% on illiquid assets.

Liquidity risk is the constraint most pension boards underestimate. A pension fund has non-discretionary cash outflows every month: benefit payments, administrative expenses, capital calls from private fund managers.

If liquid assets are insufficient to meet these calls during a market downturn, the fund may be forced to sell assets at distressed prices or draw on credit facilities. Build a cash-flow ladder that projects monthly outflows against available liquid assets under base, stress, and severe stress scenarios.

Track the liquidity coverage ratio (liquid assets divided by next 12 months of net outflows) as a primary KRI.

For fiduciaries evaluating infrastructure allocations specifically, our infrastructure investment risk assessment guide provides a detailed methodology for PPP and project finance due diligence.

Liability Risk: The Other Side of the Balance Sheet

Investment returns get the attention, but liability risk often determines whether a pension fund is sustainable. Liability risk arises from the uncertainty in the present value of future benefit payments.

Discount rate sensitivity is the single largest driver of pension liability volatility for corporate DB plans measured under ERISA and ASC 715. A 50-basis-point decline in the discount rate can increase liabilities by 8–12% for a plan with 15-year average duration.

For public plans measured under GASB 67/68 using expected return assumptions, the sensitivity is embedded in the assumed rate of return. Track the duration gap between assets and liabilities, and model the funded ratio impact of 50bps, 100bps, and 200bps rate moves in both directions.

Longevity risk is a slow-moving but material exposure. The Society of Actuaries’ Retirement Plans Experience Committee releases annual mortality improvement updates, most recently the 2025 update covering trends through June 2025.

Each additional year of life expectancy at age 65 increases pension liabilities by approximately 3–4% for a typical plan.

Fiduciaries should review their plan’s mortality assumptions against the latest SOA tables and consider longevity risk transfer options, including pension risk transfer (buy-outs and buy-ins) and longevity swaps.

Contribution volatility is the risk that investment shortfalls or actuarial assumption changes trigger sudden increases in employer contributions, creating budget stress.

For public plans, Equable Institute’s 2025 State of Pensions report found that employer contributions have grown from 9.4% of payroll in 2001 to 31.7% in 2025, driven almost entirely by increased unfunded liability amortization payments.

Fiduciaries should model contribution trajectories under multiple return scenarios and communicate the range of outcomes to plan sponsors proactively.

For organizations building broader resilience against financial shocks, our business continuity risk assessment framework provides useful parallels.

Operational Risk: The Risks You Cannot Afford to Ignore

Operational risk in a pension fund covers everything from benefit payment accuracy to cybersecurity to third-party vendor management.

These risks rarely make investment committee agendas, but they can generate fiduciary liability, reputational damage, and direct financial losses.

Cybersecurity is the operational risk that has moved fastest up the priority list. The Department of Labor issued cybersecurity best practices guidance in 2021, signaling that cyber risk management is now a fiduciary obligation.

Fiduciaries should ensure their recordkeeper, custodian, and other service providers maintain SOC 2 Type II compliance, conduct annual penetration testing, and carry cyber insurance.

Track cyber KRIs including mean time to detect (MTTD), mean time to respond (MTTR), and unpatched critical vulnerability count. Our NIST cybersecurity KRI framework provides 40+ indicators mapped to CSF 2.0 functions.

Benefit payment errors represent both an operational risk and a compliance risk. Overpayments create fiduciary exposure and participant hardship if recouped; underpayments breach the fund’s obligations. Track the error rate per 10,000 transactions, root-cause analysis of errors, and time to resolution.

Third-party vendor risk is amplified by the pension industry’s reliance on outsourced recordkeeping, custodial services, actuarial consulting, and investment management.

Under ERISA, the plan sponsor retains fiduciary responsibility for vendor selection and monitoring even when functions are delegated.

Implement a vendor risk assessment framework that evaluates financial stability, information security posture, service-level compliance, and business continuity capabilities.

Our business continuity and incident management guide covers the organizational resilience angle.

ERISA Compliance Risk: The Fiduciary Minefield

ERISA’s fiduciary standards are often called the highest standard of care in the financial world.

The four core duties, loyalty, prudence, diversification, and following plan documents, seem straightforward in principle but create complex compliance obligations in practice.

Duty of prudence requires fiduciaries to act with the care, skill, and diligence that a prudent person familiar with such matters would use.

In the investment context, this means documenting the process used to select, monitor, and replace investment options. Courts evaluate the process, not the outcome.

A documented investment policy statement (IPS), regular investment reviews with written minutes, and fee benchmarking studies create the evidentiary record that demonstrates prudence.

Prohibited transactions under ERISA Sections 406–408 are a strict-liability regime. Even well-intentioned transactions between the plan and a party in interest can trigger excise taxes and fiduciary liability.

The August 2025 Executive Order on alternative assets in retirement plans has opened the door wider for private equity and other alternatives in DC plans, but fiduciaries must still navigate the QPAM exemption, the 25% plan asset rule, and the requirement that all investments meet the same prudence standard.

For fiduciaries expanding into alternatives, the compliance infrastructure must keep pace with the investment strategy.

Fee reasonableness has been the most active area of ERISA litigation over the past decade. Fiduciaries must demonstrate that fees paid are reasonable relative to the services provided.

This requires regular benchmarking of investment management fees, recordkeeping fees, and other service provider costs against peer plans of similar size.

Track fee benchmarking percentile and document the rationale for any fees above the median. Our how to conduct a risk assessment guide covers the governance process for documentation.

SECURE 2.0 Act compliance introduces new requirements that fiduciaries must integrate into their operational and compliance frameworks, including mandatory auto-enrollment for new plans, expanded catch-up contributions with Roth requirements, and student loan matching.

Each of these provisions creates implementation risk that should be captured in the operational risk register.

Quantitative Risk Tools for Pension Fiduciaries

Pension fund risk management demands a quantitative toolkit that goes beyond basic performance reporting. Here are the essential tools every fiduciary should have access to.

Asset-liability modeling (ALM) with stochastic simulation. Project benefit payments, contributions, and investment returns over the plan’s full liability horizon using Monte Carlo simulation.

Generate probability distributions of funded ratio, contribution rates, and benefit security levels at 5, 10, 20, and 30-year horizons. Present results as percentile tables: P10 (severe stress), P25 (adverse), P50 (expected), P75 (favorable), P90 (optimistic).

Value-at-Risk (VaR) and Conditional VaR (CVaR). Calculate the maximum expected loss on the investment portfolio at the 95% and 99% confidence levels over one-month and one-year horizons. CVaR (expected shortfall) provides the average loss in the tail beyond VaR, capturing the severity of extreme outcomes. Present VaR and CVaR in dollar terms alongside funded ratio impact.

Stress testing and scenario analysis. Define deterministic scenarios anchored to historical events (2008 GFC, 2020 COVID crash, 2022 rate spike) and hypothetical scenarios (simultaneous equity crash + rate decline, stagflation, pandemic recurrence).

For each scenario, show the impact on funded ratio, contribution requirements, and liquidity position. Our scenario-based risk assessment guide provides templates for structuring these exercises.

Sensitivity analysis (tornado charts). Identify the three to five assumptions that drive the most variance in funded status: discount rate, equity returns, mortality improvement rate, inflation, and contribution levels. Display the results as a tornado chart showing the funded ratio range for each variable. This gives the board a clear picture of where to focus risk mitigation efforts.

For deeper coverage of risk quantification tools including Monte Carlo and FAIR model applications, see our risk quantification for boards article.

Building the Pension Fund Risk Register

The risk register is the central artifact of any pension fund ERM program. It translates the risk taxonomy into a living document that drives governance decisions. Our risk register guide details the key components, but here is how to apply them specifically to a pension fund context.

For guidance on conducting a comprehensive project-level risk assessment, see our project risk assessment guide.

90-Day Implementation Roadmap for Pension Fund ERM

Our seven-step risk monitoring guide provides the operational framework for sustaining these processes beyond the initial 90 days.

Seven Pitfalls That Undermine Pension Fund Risk Management

1. Managing investment risk without integrating liability risk. A pension fund that reports strong investment returns while its funded ratio deteriorates has failed at the most basic level. Always measure investment performance relative to liability growth, not just market benchmarks.

2. Ignoring valuation risk in alternatives. Smoothed returns from private equity and real estate overstate Sharpe ratios and understate correlation with public markets. Fiduciaries who rely on reported volatility without adjusting for stale pricing are making decisions on distorted data.

3. Treating cybersecurity as an IT problem, not a fiduciary obligation. The DOL’s 2021 guidance made clear that pension cyber risk is a fiduciary matter. Fiduciaries who delegate cybersecurity entirely to vendors without oversight are exposed to breach-of-duty claims.

4. Failing to document the decision process. ERISA litigation is process-focused. Courts do not require perfect outcomes, but they require evidence of a prudent process. Every investment decision, vendor selection, and fee negotiation should have contemporaneous documentation.

5. Setting risk appetite once and never revisiting. Risk appetite should be reviewed annually and recalibrated when material changes occur: benefit formula changes, actuarial assumption updates, significant market moves, or changes in plan demographics.

6. Overloading the board with data, not decisions. A 50-page risk report that buries the key messages in technical appendices is worse than useless. Structure every board risk report around three questions: What is the risk? So what is the financial impact? Now what decisions do we need from the board?

7. Assuming full funding equals no risk. Corporate plans near 100% funded face a different risk profile, not a lower one. They face de-risking execution risk, asset-liability rebalancing risk, and pension risk transfer pricing risk. Risk management does not stop when you cross the 100% line. For broader guidance on risk communication, our risk assessment methodology guide covers the governance dimension.

Looking Ahead: Pension Risk Trends for 2026 and Beyond

Alternative asset transparency. As alternatives reach one-third of public pension portfolios, pressure for mark-to-market reporting, fee disclosure, and performance attribution will intensify. Fiduciaries should prepare for enhanced reporting requirements and build valuation governance frameworks now.

Pension risk transfer acceleration. Corporate DB plans at or above full funding are accelerating annuity buy-outs and buy-ins.

The Milliman 100 PFI tracks these transactions as a leading indicator of the de-risking trend. Fiduciaries managing the glide path to termination need a risk framework that addresses execution timing, insurer credit risk, and participant communication.

Climate risk integration. The 2022 DOL rule on ESG factors in ERISA fiduciary decision-making confirmed that climate risk can be a risk-return factor when supported by analysis.

Fiduciaries should assess climate risk exposure in their portfolios using TCFD-aligned metrics and scenario analysis. Our risk mitigation in project management guide covers parallel risk treatment concepts.

AI and model risk. The Society of Actuaries’ December 2025 report on model risk management for pension fund investment practitioners highlights the impact of ESG model selection and parameter uncertainty on pension outcomes.

As AI tools enter portfolio construction and actuarial projections, model risk governance becomes a fiduciary obligation.

SECURE 2.0 implementation risks. The ongoing phased implementation of SECURE 2.0 provisions creates compliance risk for DC plan fiduciaries through 2026 and beyond. Mandatory auto-enrollment, Roth catch-up contributions, and emergency savings provisions each require system changes, participant communications, and process documentation.

Bringing It All Together

Risk management for pension funds is not a separate activity from managing the fund itself. It is how you manage the fund. The ERM framework outlined in this guide, spanning investment, liability, operational, and compliance risk domains, gives fiduciaries a structured, standards-anchored approach to protecting the retirement security of plan participants while demonstrating the prudent process that ERISA demands.

The fiduciaries who will navigate the next decade successfully are the ones who integrate risk management into every decision: asset allocation, vendor selection, benefit design, cybersecurity, and board reporting. They will use quantitative tools to challenge assumptions, qualitative judgment to capture emerging risks, and a governance framework that ensures accountability at every level.

Start with the 90-day roadmap. Build the risk register. Commission the ALM study. Stand up the KRI dashboard. Present the first integrated ERM report to your board. That is how you move from managing a pension fund to governing one.

Found this guide useful? Share it with your board, investment committee, or pension risk management team. For more practitioner content on enterprise risk management, business continuity, and fiduciary governance, explore riskpublishing.com.

References

1. ISO 31000:2018, Risk Management Guidelines. iso.org

2. COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017). coso.org

3. OECD, Pension Funds’ Risk-Management Framework (2010). oecd.org

4. NCPERS, Best Governance Practices for Public Retirement Systems (2024). ncpers.org

5. Equable Institute, State of Pensions 2025 (July 2025). equable.org

6. Milliman, Pension Funding Index September 2025. milliman.com

7. The Pew Charitable Trusts, Increased Risk, Complex Investment Landscape (April 2025). pew.org

8. The Pew Charitable Trusts, State Pension Funding Levels (October 2025). pew.org

9. IRS, Retirement Plan Fiduciary Responsibilities. irs.gov

10. 29 CFR Part 2550, Rules and Regulations for Fiduciary Responsibility. ecfr.gov

11. Society of Actuaries, Model Risk Management for Pension Funds (December 2025). soa.org

12. Lin et al., “Pension Risk Management in the Enterprise Risk Management Framework,” Journal of Risk and Insurance (2017). Wiley Online

13. Morrison Foerster, Executive Order Targets Access to Alternative Assets in Retirement Plans (August 2025). mofo.com

Related Reading on riskpublishing.com

A Step-by-Step Guide to Risk Assessment | Eight Steps for Project Risk Assessment | Scenario-Based Risk Assessment | Key Risk Indicators Examples | Deciphering Financial KRIs | Key Elements of a Risk Register | Risk Management Lifecycle | Risk Management Policy Components | Business Continuity Risk Assessment | Business Continuity & Incident Management | Risk Mitigation in Project Management | How to Monitor Risk in 7 Steps | How to Conduct a Risk Assessment | NIST Cybersecurity Framework KRIs | Transportation Risk Assessment

Chris Ekai

Chris Ekai is a Risk Management expert with over 10 years of experience in the field. He has a Master’s(MSc) degree in Risk Management from University of Portsmouth and is a CPA and Finance professional. He currently works as a Content Manager at Risk Publishing, writing about Enterprise Risk Management, Business Continuity Management and Project Management.