ERM under construction

Internal Auditor, April, 2006

tHE ANTICIPATED ENTERPRISE RISK MANAGEMENT (ERM) BUILDING BOOM IS OFF TO A SLOW START, despite the adoption of risk-based auditing by organizations worldwide. Only 6 percent of organizations responding to a recent IIA Research Foundation survey have fully implemented ERM. Others are just starting the process: drawing up blueprints, gaining executive approvals and financing, pouring the foundation, and erecting the ERM infrastructure.

Organizations in the throes of ERM projects face an array of challenges. Some may be looking for ways to use their Sarbanes-Oxley compliance structure to accelerate ERM implementation. Others are examining the relationship between ERM and the information technology that cements their operations. And throughout the construction process, organizations must decide who should be the foreman for ERM-related activities--internal auditors or management.

The Committee of Sponsoring Organizations of the Treadway Commission's Enterprise Risk Management--Integrated Framework has given management and auditors an architectural model for looking at risks from an organizationwide perspective. Building blocks and best practices have been put in place. Now it's up to organizations to break ground on construction.