Auditing the Enterprise Risk Management Process

Auditing the Enterprise Risk Management Process

This course will start with an overview of the Enterprise Risk Management process and all the underlying elements of an Enterprise Risk Management, including a discussion on risk appetite, governance, and roles & responsibilities. Once the Enterprise Risk Management fundamentals has been established, the course will provide more details into the attributes that make an Enterprise Risk Management process effective such as addressing black swans, using risk driven metrics as well as linking Enterprise Risk Management with the organization’s strategy. There will also be a discussion of Internal Audit’s role in the Enterprise Risk Management initiative. The majority of the course will involve methods for auditing the Enterprise Risk Management process by assessing the Enterprise Risk Management process according to the COSO framework which is comprised of 5 components and 20 principles. The 5 components include: 1) Governance & Culture 2) Strategy & Objective Setting 3) Performance 4) Review & Revision. The objective of the assessment procedures is to determine if the organization’s ERM process exhibits these 20 principles. There will also be a discussion to address another risk management framework, ISO 31000. A summary of key highlights of ISO 31000 will be covered as well as comparing the commonalities and differences between the ISO risk management framework and the COSO risk management framework.