COSO’s Enterprise Risk Management (ERM) framework is principles based and emphas

Question

COSO’s Enterprise Risk Management (ERM) framework is principles based and emphasises strategic plans to support the mission and vision of the organisation must be supported with governance elements, performance measure and internal controls. Explain how information and communication technology plays a role in the ERM components.COSO’s Enterprise Risk Management (ERM) framework is principles based and emphasises strategic plans to support the mission and vision of the organisation must be supported with governance elements, performance measure and internal controls. Explain how information and communication technology plays a role in the ERM components.

Explanation / Answer

ERM is defined as the practices, culture and capabilities integrated with performance and strategy relying on risk management to create and realize value. ERM creates value for the organization by balancing risks. The COSO ERM framework is based on 20 principles with eight key components. The main focus of the COSO framework is to integrate the core processes with the ERM or integrating performance and strategy in common terms.
The key components of ERM framework include the internal environment. ICT plays a critical role in the internal environment component of COSO by building a reliable internal communication system to communicate the top management views of ERM to all levels of employees in the organization. The importance of risk management and the risk management criteria are conveyed to the employees of the organization through ICT.
Objective setting is the second component that identifies potential events aligning with the mission of the organization. ICT plays a critical role in aligning the potential events and mission with the risk criteria of the organization.
Event identification is the third component of COSO that identifies the impact of the potential events or risks. The sources of the events are categorized as internal and external. These events impact the organization’s objectives providing opportunities and at the same time have risks associated with them. ICT helps in identifying the sources of the events.
Risk assessment is the fourth COSO component that analyzes the identified risks to determine the way of managing them. Risks are associated with objectives and they need to be assessed on a continuous basis. ICT helps the manager to choose effective methods to manage risks associated with the objectives and assess them continuously.
Risk response COSO component is concerned with evaluating the possible responses to risks by accepting, avoiding, sharing and reducing risk. ICT helps the manager to take action on risks based on their level of risk tolerance.
Control activities COSO component deals with the procedures and policies established to ensure the risk response is carried out effectively in a successful manner. ICT helps in developing the procedures and policies based on the risks identified and responses taken against them. These response procedures are stored in digital databases or cloud by ICT for future reference.
Information and communication COSO component deals with the identified information and communicated in a timeframe form enabling people to execute their responsibilities. The information gathered at all levels from identification to responding to risk is effectively communicated through ICT.
The final monitoring COSO component monitors the entire ERM and necessary modifications are done in a dynamic manner using the ICT. Information and Communication Technology improves the quality of ERM service, enhances efficiency in operations, enhances systems of risk mitigation, improves asset value, organize IT activities to manage risks, improves resource efficiency, improves financial performance and overall performance of the organization. Overall, ICT plays a critical role and is an integral part of the ERM.

Related Questions

Navigate

• Browse (All)
• Browse C
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.