Enterprise Risk Management, or ERM, has evolved considerably since the 1970s. From simply 'buying' insurance, it has grown in importance to become a prime function in many organizations as part of a more extensive system known as Governance, Risk, and Compliance (GRC), which starts with corporate governance and ends with compliance. ERM is the function of studying the risks that may hinder a corporation's ability to achieve its goals and then deciding how to overcome them. Various organizations, including ISO, which released ISO 31000 on risk management, conducted studies on risk management. However, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) created the ERM system that is most widely used. This system, covered in this course, teaches the steps to controlling risk. It starts with evaluating the internal environment and setting objectives, mainly due to the tone at the top of the organization, the directives from corporate governance, and the vision, mission, and corporate strategies. Then, the course goes through the steps management needs to consider to identify and assess risk and decide on proper risk responses and controls. The course ends with how to monitor, communicate, and report risk. In addition, the course looks at risk in different organizational areas such as strategy, reporting, compliance, operations, financial and physical risk, and risk in different industries.
