Enterprise Risk Management
What is Enterprise Risk Management?
A holistic approach to managing all types of organizational risk including strategic, operational, financial, and compliance risks in an integrated framework.
Terms that appear alongside enterprise risk management
Each of these is named in at least one of the same controls as enterprise risk management. The number is how many controls name both.
- governance 11 shared controls
- risk management framework 9 shared controls
- audit 6 shared controls
- cybersecurity 6 shared controls
- risk appetite 5 shared controls
- compliance 5 shared controls
- risk assessment 4 shared controls
- nist 4 shared controls
Frameworks that govern enterprise risk management
What the standards actually require on enterprise risk management
Requirements naming enterprise risk management across 6 standards, quoted from the control text.
Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-03 · Cybersecurity risk management activities and outcomes are included in enterprise risk management processes →Demonstrate integration of sustainability and climate risks into the entity's enterprise risk management framework, including consistent rating scales and escalation paths.
SASB-RM-02 · Integration of Sustainability Risks into Enterprise Risk Management →Insurers conduct an Own Risk and Solvency Assessment integrating risk management and capital adequacy.
ICP16 · Enterprise Risk Management and ORSA →Address enterprise risk management and governance within the program, covering assessment, mitigation and monitoring of security and technology risk, security and technology capital planning and investment, board and management oversight, technology audit and...
CFTC-SS-2 · Enterprise Risk Management and Governance Category →The IRM Risk Architecture + Strategy + Protocols (RASP) framework defines the governance + structural + behavioural enabling elements of effective enterprise risk management.
IRM-Architecture-Strategy-Protocols-Appetite-Culture-Board-Audit-Committee-CRO-Three-Lines · IRM RASP - Risk Architecture + Strategy + Protocols + Risk Appetite Statement + Risk Culture + Board + Audit Committee + Chief Risk Officer + Three Lines of Defence + Tone at the Top →The organization uses communication channels to support enterprise risk management.
INFO-19 · Communicates Risk Information →Questions people ask about enterprise risk management
What is Enterprise Risk Management?
Why is Enterprise Risk Management important for compliance?
Which compliance frameworks address Enterprise Risk Management?
Where can I learn more about Enterprise Risk Management?
See how Enterprise Risk Management applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.