Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Enterprise Risk Management: Purpose and Principles
What ERM is
Enterprise risk management looks at all the organisation’s risks together (strategic, financial, operational, compliance and technology) and manages them in line with strategy and the board’s appetite. Its aim is to help the organisation achieve its objectives, not just avoid losses.
Principles that make it work
Where IT risk fits
IT risk is a category of business risk. It rolls up from risk data and the register into the IT risk profile, then into the enterprise profile the board sees.
Why integration matters
- One risk language and common scales.
- IT risks compete fairly for attention and funding.
- Concentrations across categories become visible.
- Decisions weigh technology risk alongside other risks.
Example. A manufacturer’s IT team rated ransomware “critical” on its own scale, but the board’s ERM report showed only financial risks. After IT risk joined the ERM process, ransomware ranked third enterprise-wide and received funding.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST way to manage IT risk at enterprise level | Integrate it into ERM with common scales |
| PRIMARY purpose of ERM | Help achieve objectives within appetite |
| Benefit of a portfolio view | Compare and prioritise all risks together |
| IT risk is… | A category of business risk |
In short
- ERM manages all of an organisation's risks together, linked to strategy and objectives.
- IT risk is a category of business risk and should be managed within ERM, not separately.
- A portfolio view on common scales lets the board compare and prioritise risks of all kinds.
- ERM works when it's integrated into planning and decisions, with clear appetite and named owners.
- Risk management aims to support value creation, not just avoid losses.
Exam traps
- Running IT risk in a silo with its own scales and register.
- Treating ERM as a compliance exercise disconnected from decisions.
- Assuming ERM's goal is to minimise all risk.
- Reporting IT risk to the board in technical terms that can't be compared with other risks.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Principles that make it work
Where IT risk fits
1 / 8