EDM03

EDM03: Ensured Risk Optimization

The Ensure Risk Optimisation process is concerned with ensuring the enterprise risk tolerances and risk appetite are defined and communicated and the impact to enterprise value from IT risks are managed, this is achieved through the following:

Evaluating IT risk management – continual examination and judgement of IT risk in relation to enterprise strategy (i.e. determine risk appetite, tolerances, alignment to enterprise risk strategy, evaluate risk factors, risk aware decision making and evaluation of risk management activities against tolerances).

Directing IT risk management – providing direction through the delivery of policies, measurement objectives and approved processes for measuring the management of IT risk to provide assurance that IT risk management practices are appropriate and aligned to enterprise risk appetite.

Monitoring IT risk management – Monitoring IT risk management processes and defining how deviations from the agreed targets will be managed (i.e. identified, documented, tracked, reported and resolved).