Continuous Risk Management, Part 2: Internal Controls, Risk Mitigations, and Mission-Advancing Opportunities
摘要
The chapter continues on from Chap. 8 by providing definition and guidance relevant to the tracking and control steps of CRM. It discusses the nature and purpose of hierarchical internal controls with respect to risk management, and elaborates upon the use of risk drivers to inform the identification of internal controls and risk mitigations. It then identifies information that should be provided to decision makers in order to facilitate their deliberations on whether to select or reject candidate risk mitigation options. It continues by highlighting the difference between tactical opportunities and strategic opportunities with respect to advancing the organization’s mission, and provides a demonstration pertinent to the evaluation of strategic opportunities through the lens of risk drivers and the balancing of aggregate risks.