Duty of Care

Chapter 4Enterprise Risk Management (ERM)

The case of Volkswagen, discussed in Figure 4.1, demonstrates the importance of understanding the risk implications of technology decisions. Enterprise risk management (ERM) provides a foundation for examining an organization's full portfolio of risks. As a result of the stringent regulations that align with ERM as a practice, there are many tools and professional services to help directors meet their obligations.

Figure 4.1 The Case of Volkswagen

At a high level, ERM methods are used to understand individual risks that are faced by the business. They consider how risks interrelate and support validation of appropriate mitigations. For ERM to be effective as part of an overall governance program, a board must have overt conversations about their risk-tolerance level. Every incremental level of risk prevention comes at a cost, and not every preventive measure is necessary or even prudent. Risk and security professionals often tend toward an absolute, so it is critical that the board balance the threat against both the probability of an incident and their tolerance of the event. Mitigations, including insurance, may be an effective alternative to investing in costly prevention measures – this chapter will help you make those trade-off decisions.

Risk is not an absolute thing, but a derived value, considering:

• Threat – potential events ...