Enterprise Risk Management and Lines of Defense

What it is

Enterprise risk management (ERM) manages all of an organization's risks together: strategic, financial, operational, compliance and technology. IT risk is one category inside ERM, not a separate silo, so it must be expressed in the same language and fed into the same profile.

The lines of defense model, now framed by the IIA as the Three Lines Model (2020), describes who manages risk, who oversees it and who gives independent assurance.

How it works

Why integrate IT risk into ERM

When IT risk is managed separately, leaders cannot compare it with other risks or see how a technology failure drives financial, legal and reputational loss. Integration means using the enterprise risk taxonomy, the same rating scales and the same appetite, and rolling IT risks into the enterprise risk profile. The job practice asks the practitioner to maintain the IT risk register and incorporate it into this enterprise-wide view.

ERM frameworks

COSO ERM stresses that risk should inform strategy setting, not just operations. ISO 31000 stresses that risk management is part of all activities and must be tailored to the organization.

The ERM cycle

A typical ERM cycle sets context and appetite, identifies and assesses risks, chooses responses, monitors and reports, then reviews and improves. The cycle repeats, because the business and threats keep changing.

The Three Lines Model

The IIA's 2020 update replaced the older "three lines of defense" wording with a principles-based model of roles. The governing body is accountable to stakeholders; management takes first and second line roles; internal audit takes the third line role; and external assurance providers add further assurance.

The risk practitioner usually works in the second line: setting methods, facilitating assessments, challenging ratings and reporting. The practitioner supports the first line but does not take over its ownership of risk.

Independence

The third line must stay independent. If internal audit designs controls or manages risk, it cannot then give objective assurance over them. The second line also needs enough independence from the first line to challenge it credibly.

A worked example

A manufacturer keeps its IT risk register in a separate tool with a five-point scale, while ERM uses a four-point scale and different impact categories. The board sees a top ten enterprise risk list with no technology risks, even though a plant control system outage would stop production.

The practitioner maps IT risk impacts to the enterprise categories, aligns the scales and submits the plant system risk through the ERM process. It enters the enterprise profile as an operational risk with a technology cause, so the board can compare it with other risks.

How the exam asks about this

• "What is the MOST important benefit of integrating IT risk into ERM?" Senior management can compare IT risk with other enterprise risks and prioritize consistently.
• "Which function provides independent assurance over the risk management program?" Internal audit, the third line.
• "Who is PRIMARILY responsible for managing risk in day to day operations?" First line management, the business and IT operations that own the activities.