thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Enterprise Risk Management (ERM)

Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.

Definition

ERM integrates strategic, financial, operational, compliance, and technology risks into a common framework and appetite. COSO ERM (2017, Integrating with Strategy and Performance) and ISO 31000 are the leading ERM frameworks. IT and cyber risk should feed into ERM rather than being managed in isolation.

Example

Cyber risks are reported in the same enterprise risk register as credit and supply chain risks.

Exam tip

Information risk management should be integrated with ERM, a recurring CRISC and CISM theme.

Related terms