What You Will Learn
1. Defining the Key Components of ERM
- identifying risk events
- assessing risk, probability, and impact
- risk responses
- monitoring the ERM process on an ongoing basis

2. A Top-Down Risk-Based Approach to Establishing an ERM Process
- mapping the organization to determine the natural risk assessment structure
- the risk organizational structure
-- makeup
-- reporting structure
-- process design
-- operating format
- methods of developing risk inventories to be used as the baseline for ERM
- searching for commonalities
- evaluating alternative ERM structures: subjective vs. objective
-- system-centric
-- data-centric
- determining the data/information inventory that will be the primary indicators of risk in each part of the organization
- establishing the logical data pathway of the risk data indicators that drive to the root cause of organizational failures
- designing the responsibility spectrum for risk

3. Integrating Business Risk and Internal Control
- the concept of business risk
- determining the relationship of key business risks and internal controls
- focusing the strategy on fundamental business process
- understanding the key attributes of outcome and output and its impact on governance
- using KPIs as the baseline for process-based oversight

4. Developing an ERM Audit Process
- gaining an understanding of the ERM environment
- risk assessing the ERM environment
- focusing the audit and establishing the audit scope
- determining the audit approach/tools/techniques/strategy
- defining an effective report format to bring about change

5. Auditing the ERM Process
- auditing the risk organizational structure: who, what, where, how and why
- auditing the risk infrastructure for completeness and coverage
- auditing the information flow of the ERM environment
-- timeliness
-- accuracy
-- usefulness

6. Auditing the Effectiveness of ERM in the Organization
- auditing the evaluation criteria of success for the ERM
- evaluating the real-world organizational impact of the ERM process in precluding or minimizing risks
- auditing areas of special concern in ERM, including outsourcing
- auditing the maintenance and future strategic initiatives within ERM to keep it current and cutting-edge

7. Case Study