RISK MANAGEMENT (prelims)

CONTROL

it is defined as the IT management policies, procedures, practices, and structures, which provide an acceptable assurance level that business goals will be met

CONTROL OBJECTIVES FOR INFORMATION AND RELATED TECHNOLOGY (COBIT)

it is a framework for the management and governance of enterprise IT. It was developed by the Information Systems Audit and Control Association (ISACA) to set reliable auditing standards as computes networks became more important in financial systems.

EVALUATION

it assesses the design to determine what is working and what might need to be redefined

EVENT IDENTIFICATION

the organization must identify internal and external events that affect the achievement of its objectives

EXTERNAL RISKS

these exposures that result form environmental conditions that the firm commonly cannot influence, such as the regulatory environment and market conditions

GOALS CASCADE

it shows how stakeholder drivers create stakeholder needs and those need define the enterprise’s goals

IMPROVEMENT

organizations should continuously look for ways to improve their ISO 31000 implementation

INCLUSIVE

for efforts to be successful, key stakeholders must be involved and their knowledge and view considered

INTEGRATED

the concepts of risk mitigation and identification should be integrated into all business processes

INTERNAL ENVIRONMENT

it establishes the tone of the organization, influencing risk appetite, attitudes towards risk management and ethical values

ISO 31000

it provides a set of principles and guidelines for the design and implementation of a risk management framework

MONITORING AND REVIEW

this step should take place during all stages of the implementation process. The goal is to assess the effectiveness of the process implementation and find any room for improvement.

RISK DRIVERS

are the fundamental, global, and domestic macroeconomic and industry factors that create risk

RISK GOVERNANCE

it is the process that ensures all company employees perform their duties in accordance with the risk management framework

RISK MANAGEMENT FRAMEWORK

it provides a process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle

RISK TREATMENT

the purpose of this step is to choose and apply risk management options

MISMANAGED BUSINESS TRANSITIONS

change and the failure to manage it well is one of the major risks a company faces

INTERNAL FRAUD

employee theft, intentional misreporting of positions, and insider trading on an employee's own account

EXTERNAL FRAUD

robbery, forgery, and check kiting

CLIENTS, PRODUCTS, AND BUSINESS PRACTICES

fiduciary breaches, misuse of confidential customer information, money laundering, and sale of unauthorized products