Marchetti Book Chapter 1: Overview of Enterprise Risk Management

This set of vocabulary flashcards covers the fundamental concepts, regulatory frameworks, and implementation strategies of Enterprise Risk Management as presented in Chapter 1 of the Marchetti text.

Enterprise Risk Management (ERM)

The methods and processes used by organizations to minimize surprises and seize opportunities related to the achievement of their objectives by aligning strategy, process, and knowledge.

Choice Management

A description of good risk management, characterized as a continuous work in progress where an entity identifies risks and determines how to address each one.

Holistic View of Risk

An approach to risk assessment that considers interdependencies and aggregate entity consequences rather than managing risks as independent components in a siloed process.

Risk Identification

A process designed to identify strategic objectives and goals first, followed by potential internal and external events that could adversely affect the enterprise's ability to achieve them.

Integrated Risk Organization

An entity structure consisting of centralized risk management reporting to the CEO and board, an integrated risk management strategy, and the integration of risk management into business processes.

COSO Internal Control – Integrated Framework (1992)

A conceptual framework issued to provide evaluation tools for control systems, defining internal control as a process providing reasonable assurance regarding operations, financial reporting, and compliance.

Sarbanes-Oxley Act (SOX)

A 2002 act that led the SEC to suggest the COSO framework for the design and analysis of internal control over financial reporting.

Public Company Accounting Oversight Board (PCAOB)

A private, nonprofit corporation established by SOX whose mission is to oversee the auditors of public companies.

AS No. 5

An auditing standard titled 'An Audit of Internal Control over Financial Reporting that Is Integrated with an Audit of Financial Statements' which directs auditors to adopt a top-down risk-based approach.

COSO ERM – Integrated Framework (2004)

A document issued to assist organizations in identifying, assessing, and managing risk effectively by establishing key risk management principles, concepts, and language.

Risk Assessment SASs (SAS 104 – 111)

Statements on Auditing Standards that outline auditor requirements, including documentation associated with risk assessment and understanding management's risk assessment process.

Internal Control

In the context of ERM, these are activities designed to mitigate risk; they apply to all organizations and exist in many forms throughout organizational processes.

SAS 115

An auditing standard requiring auditors to report identified significant deficiencies or material weaknesses in internal control over financial reporting in writing to management and governance.

Upside Risk

Future events that create uncertainty but present occasions for value enhancement and positive gains.

Downside Risk

Uncertainties that can lead to value erosion, which are managed defensively through policies, procedures, and systems to prevent negative performance impacts.

Tone-at-the-top

Executive and board-level sponsorship and testimony that establishes the appropriate internal environment fundamental for a solid ERM program foundation.

Risk Appetite

The level of risk an organization is willing to take related to both specific incidents and the entity as a whole, often evidenced in company policies regarding authority and approval limits.

Phased Approach

The implementation of an ERM program in stages to achieve short-term success, customize remaining phases, and avoid overwhelming the organization with a full-scale implementation.