What is an enterprise risk management (ERM) framework and how does it relate to IT risk?

• A. ERM is a department handling IT only
• B. ERM eliminates all IT risk
• C. ERM is only about compliance
• D. ERM is an organization-wide approach to identifying, assessing, and mitigating risks; IT risk is a component aligned with business risk appetite within ERM

Answer: (D)

Enterprise risk management is an organization-wide approach to identifying, assessing, and mitigating risks in a way that ties to the organization’s objectives and risk appetite. It isn’t limited to a single department or focused only on IT; it spans all areas of the business. It doesn’t promise to eliminate all risk—risks can be reduced and controlled, but not wholly removed. And it isn’t just about compliance; while compliance matters, ERM integrates strategic, operational, financial, and IT risks to support informed decision-making. IT risk is one part of the overall risk landscape and is managed within ERM, aligned with the business’s risk appetite to ensure technology-related risks are addressed in the context of broader goals and constraints.