COSO Enterprise Risk Management: Understanding the New Integrated ERM Framework

Chapter 11. Information Technology and ERM

Because of the complexity in building and maintaining information technology (IT) systems, their network interconnections, and all types of applications, risk management has been very important to IT processes. As discussed in Chapter 10 on project management risks, one does not have to have been a participant or observer of IT hardware and software projects for many years to have observed many IT projects that were launched with high expectations but subsequently failed for any of a variety of reasons. Just as people involved in marketing often have overly high expectations that some new initiative will succeed, IT processes often face similar risks.

IT-related issues and concerns are somewhat covered in the Committee of Sponsoring Organizations’ enterprise risk management (COSO ERM) framework through that model’s control activities and information and communications layers. The word somewhat is used because IT is so pervasive in business and operations processes that the high-level descriptions of risks in COSO ERM may seem to miss or ignore some of the many and evolving specific IT risks and concerns here. This is also a challenging area for understanding risks and developing appropriate risk responses. As has been the pattern, no matter how strong the designed and implemented controls—particularly those that are software based—someone will find a way to violate and get around them.

While the range of IT risks is vast and extensive, this ...