COSO Enterprise Risk Management

ROBERT R. MOELLER, CPA, CISA, CISSP, is an internal audit specialist and project manager with a strong understanding of business risk management, information systems, corporate governance, and security. He has over twenty-five years of experience in internal auditing, ranging from launching new internal audit functions in several companies to serving as audit director for a Fortune 50 corporation. Formerly national director of computer auditing at Grant Thornton and internal audit director at Sears Roebuck, he is the author of six books published by Wiley. He is the former president of the Institute of Internal Auditors' Chicago chapter and the former chair of the AICPA's Computer Audit Subcommittee.

• Preface xiChapter 1: Introduction: Enterprise Risk Management Today 1The COSO Internal Controls Framework: How Did We Get Here? 2The COSO Internal Controls Framework 3COSO Internal Controls: The Principal Recognized Internal Controls Standard 14An Introduction to COSO ERM 14Governance, Risk, and Compliance 15Global Computer Products: Our Example Company 16Chapter 2: Importance of Governance, Risk, and Compliance Principles 21Road to Effective GRC Principles 22Importance of GRC Governance 23Risk Management Component of GRC 25GRC and Enterprise Compliance 26Importance of Effective GRC Practices and Principles 28Chapter 3: Risk Management Fundamentals 31Fundamentals: Risk Management Phases 32Other Risk Assessment Techniques 45Chapter 4: COSO ERM Framework 51ERM Definitions and Objectives: A Portfolio View of Risk 51COSO ERM Framework Model 55Other Dimensions of the ERM Framework 86Chapter 5: Implementing ERM in the Enterprise 89Roles and Responsibilities of an Enterprise Risk Management Function 90Risk Management Policies, Standards, and Strategies 100Business, IT, and Risk Transfer Processes 105Risk Management Reviews and Corrective Action Practices 108ERM Communications Approaches 112CRO and an Effective Enterprise Risk Management Function 113Chapter 6: Importance of Strong Enterprise Governance Practices 115History and Background of Enterprise Governance: A U.S. Perspective 116Enterprise Integrity and Ethical Behavior 119Disclosure and Transparency 125Rights and Equitable Treatment of Shareholders and Key Stakeholders 126Governance Role and Responsibilities of the Board 128Governance as a Key Element of GRC 128Chapter 7: Enterprise Compliance Issues Today 131Compliance Issues Today 132Establish a Compliance Assessment Team 133Compliance Risk Assessments and Compliance Program Reviews 136Work Unit–Level Compliance Tracking and Review Processes 138Compliance-Related Procedures and Staff Education Programs 141Enterprise Hotline Compliance and Whistleblower Support 142Assessing the Overall Enterprise Compliance Program 144Chapter 8: Integrating ERM with COSO Internal Controls 147COSO Internal Controls Background and Earlier Legislation 147Efforts Leading to the Treadway Commission 151COSO Internal Controls Framework 156COSO Internal Controls and COSO ERM: Compared 174Chapter 9: Sarbanes-Oxley and Enterprise Risk Management Concerns 177Sarbanes-Oxley Act Background 177SOx Legislation Overview 179Enterprise Risk Management and SOx Section 404 Reviews 193Internal Controls Reporting and Materiality 198PCAOB Risk-Based Auditing Standards 199Sarbanes-Oxley: The Other Sections 200SOx and COSO ERM 201Chapter 10: Corporate Culture and Risk Portfolio Management 203Whistleblower and Hotline Functions 204Risk Portfolio Management 208Integrated Enterprise-Wide Risk Management 211Chapter 11: OCEG Capability Model GRC Standards 215GRC Capability Model “Red Book” 215Other OCEG Materials: The “Burgundy Book” 223Level and Scope of the OCEG Standards-Setting Authority 224Chapter 12: Importance of GRC Principles in the Board Room 225Board Decisions and Risk Management 226Board Organization and Governance Rules 230Corporate Charters and the Board Committee Structure 231Audit Committees and Managing Risks 235Establishing a Board-Level Risk Committee 238Audit and Risk Committee Coordination 244COSO ERM and Corporate Governance 245Chapter 13: Role of Internal Audit in Enterprise Risk Management 247Internal Audit Standards for Evaluating Risk 248COSO ERM for More Effective Internal Audit Planning 251Risk-Based Internal Audit Findings and Recommendations 264COSO ERM and Internal Audit 265Chapter 14: Understanding Project Management Risks 267Project Management Process 268PMBOK_ Guide: A Guide to the Project Management Book of Knowledge 269PMBOK_ Guide’s Project Manager Risk Management Approach 272Project-Related Risks: What Can Go Wrong 282Implementing ERM for Project Managers 285Chapter 15: Information Technology and Enterprise Risk Management 291IT and the COSO ERM Framework 292IT Application Systems Risks 294Effective IT Continuity Planning 302Worms, Viruses, and System Network Risks 307IT and Effective ERM Processes 309Chapter 16: Establishing an Effective GRC Culture throughout the Enterprise 311First Steps to Establishing a GRC Culture: An Example 312Promoting the Concept of Enterprise Risk 314Establishing of Enterprise-Wide Governance Awareness 319Enterprise Codes of Conduct 323Building a GRC Culture: Risk, Governance, and Compliance Education Programs 326Keeping the GRC Culture Current 327Chapter 17: ISO 31000 and 38500 Risk Management Worldwide Standards 331ISO Standards-Setting Process 332Understanding ISO 31000 334ISO 38500: The Corporate Governance of IT 337Implementing an ISO Standard 340Chapter 18: ERM and GRC Principles Going Forward 343ERM and GRC for the Internal Controls Professional 344COSO’s Ongoing Support Role 347COSO ERM and GRC Future Prospects 348About the Author 351Index 353