ERM in a CPA Practice

Denise Diaz-Garrastacho, CPA, and Denise Dickins, PhD, CPA, CIA

Enterprise risk management (ERM) describes an entity's process for assessing, controlling, and monitoring risk across lines of businesses and functions. It is viewed as critical to an entity's success, so much so that publicly traded companies are now required by SEC rules to specifically disclose the role of the board of directors in risk oversight (SEC Release 33-9089, adopted December 2009). Specific disclosures include describing the board's role in monitoring the company's risk identification, risk tolerance, and risk management processes. Further, the New York Stock Exchange (NYSE) explicitly requires its listed companies' audit committees to discuss guidelines and policies that govern the way risk is handled, including major financial risk exposures and the steps management takes to monitor and control risk. Beyond compliance, the independent rating agency Standard & Poor's assesses companies' ERM as part of its rating process, and the International Organization for Standardization has issued standards for assessing risk (ISO 31000 and 31010, both issued in 2009).