Responding to Change and Strategic Risk
5 minutes
5 Questions
In the Certification in Risk Management Assurance (CRMA) body of knowledge, 'Responding to Change and Strategic Risk' addresses how an organization's governance structures anticipate, assess, and adapt to shifts that could affect its ability to achieve strategic objectives. Strategic risk refers to uncertainties tied to the fundamental direction of the enterprise—market disruption, technological change, regulatory shifts, competitive moves, reputational events, or flawed strategy execution. Unlike operational or compliance risks, strategic risks often arise from external forces and from the assumptions embedded in strategic plans themselves. From a governance perspective, the board and senior management are responsible for setting risk appetite, aligning strategy with that appetite, and ensuring that risk management is integrated into strategic planning rather than treated as a separate function. Frameworks such as COSO ERM 2017 emphasize this integration, framing risk as inseparable from strategy-setting and performance. Responding to change requires organizations to establish mechanisms for horizon scanning, scenario analysis, stress testing, and key risk indicators that signal emerging threats or opportunities. Governance should support agility: clear escalation paths, defined decision rights, and periodic reassessment of strategic assumptions. Management must also recognize that change itself—mergers, new systems, restructuring, or expansion—introduces transitional risks that need deliberate oversight. For internal audit and the CRMA practitioner, the role is to provide independent assurance that these processes exist and function effectively. This includes evaluating whether the organization identifies strategic risks comprehensively, whether risk responses (accept, avoid, reduce, share) are appropriate and executed, and whether the board receives timely, relevant information to govern strategic risk. Auditors should assess the culture surrounding change: whether dissenting views are welcomed, whether early warning signals are acted upon, and whether lessons from past changes inform future responses. Ultimately, effective governance of strategic risk links resilience and value creation, enabling the organization to pursue opportunities while remaining within its risk appetite.
Responding to Change and Strategic Risk: A Complete CRMA Study Guide (Risk Management Governance)
Why This Topic Matters
Within the IIA Certification in Risk Management Assurance (CRMA) syllabus, the Risk Management Governance domain tests whether you understand how an organization's governing body and senior management direct, oversee, and adapt risk management. 'Responding to Change and Strategic Risk' sits at the heart of this domain because risk management is not a one-time exercise. Organizations operate in environments that shift constantly: new competitors, regulation, technology disruption, economic shocks, geopolitical events, changes in leadership, mergers, and shifts in stakeholder expectations. A risk framework that was fit for purpose last year can be dangerously outdated today.
The CRMA examiner expects you to know three interlocking things: (1) what strategic risk is and how it differs from operational, compliance, and financial risk; (2) how mature governance structures detect and respond to internal and external change; and (3) what internal audit's role is in providing assurance (and sometimes advice) on the organization's ability to adapt, without crossing into management's responsibilities. Candidates who treat risk management as a static register-building exercise tend to score poorly here. Those who think of it as a dynamic, iterative, strategy-linked process score well.
What Is Strategic Risk?
Strategic risk is the risk that affects, or is created by, the organization's business strategy and strategic objectives. The COSO ERM 2017 framework, Enterprise Risk Management: Integrating with Strategy and Performance, is the most important reference for this topic. It describes three dimensions of strategy-related risk that you must be able to distinguish:
1. The possibility that strategy does not align with mission, vision, and core values. A well-executed strategy that takes the organization somewhere its stakeholders never intended is itself a risk.
2. The implications of the strategy chosen. Every strategic choice carries its own risk profile. Choosing aggressive international expansion, for example, imports currency, political, and supply-chain exposures that a domestic strategy would not.
3. Risk to executing the strategy. This is the dimension most people think of first: the risk that the organization fails to deliver the plan because of operational, financial, compliance, or external events.
Strategic risk is typically high impact, long horizon, and difficult to quantify. It is owned at the board and executive level, not delegated to a single department. ISO 31000 reinforces this by making 'Integrated' and 'Dynamic' two of its core principles: risk management should be part of all organizational activities, and it should anticipate, detect, acknowledge, and respond to change in a timely way.
What Does 'Responding to Change' Mean in a Governance Context?
Responding to change refers to the governance mechanisms that ensure risk identification, assessment, appetite, and response remain relevant when the internal or external context shifts. COSO ERM 2017 addresses this explicitly through its Review and Revision component, which contains three principles:
- Principle 15: Assesses Substantial Change. The organization identifies and assesses changes that may substantially affect strategy and business objectives. Examples include a new regulatory regime, a change in the business model, a major acquisition, leadership turnover, rapid growth, or new technology.
- Principle 16: Reviews Risk and Performance. The organization reviews entity performance results and considers risk. Variances between expected and actual performance often signal that the risk profile has changed.
- Principle 17: Pursues Improvement in Enterprise Risk Management. The organization continually improves ERM practices based on lessons learned and changing conditions.
In addition, the Strategy and Objective-Setting component requires the organization to analyze the business context (internal and external), define risk appetite, evaluate alternative strategies, and formulate business objectives. When the context changes, each of these should be revisited.
How It Works: The Mechanics of Adaptive Risk Governance
1. Monitoring the business context. Mature organizations scan their environment continuously using tools such as PESTLE analysis (political, economic, social, technological, legal, environmental), SWOT analysis, competitor intelligence, and stakeholder engagement. The board should receive regular reporting on external trends, not just internal metrics.
2. Horizon scanning and emerging risk identification. Emerging risks are new, evolving, or poorly understood risks whose impact and likelihood are uncertain. Governance structures should assign responsibility for identifying them, often to a risk committee or chief risk officer, and should use techniques such as scenario analysis, stress testing, war-gaming, and expert workshops. Risk velocity (how quickly a risk materializes) and risk persistence (how long its effects last) become especially important when assessing emerging risks.
3. Key risk indicators (KRIs) and triggers. KRIs are forward-looking metrics that signal a change in risk exposure before a loss occurs. Governance should define thresholds that trigger escalation and reassessment. For example, a sustained rise in customer churn or a sudden drop in supplier on-time delivery may be a leading indicator that a strategic assumption is failing.
4. Re-evaluating risk appetite and tolerance. Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of value. It is set by the board and must be revisited when strategy changes, when the organization's capacity to bear risk changes (for example, after losses or capital raising), or when stakeholder expectations shift. Tolerances, which are the acceptable ranges of variation around specific objectives, should be recalibrated at the same time.
5. Event-driven reassessment. Besides periodic cycles (usually annual), good governance mandates reassessment when substantial change occurs: a merger or acquisition, a new line of business, entry into a new jurisdiction, major system implementation, significant leadership change, a crisis, or a material regulatory development. Waiting for the next scheduled cycle is a common governance weakness that exam questions probe.
6. Clear roles under the Three Lines Model. Management (first line) owns risks and the responses to change. Risk, compliance, and similar functions (second line) provide expertise, frameworks, monitoring, and challenge. Internal audit (third line) provides independent assurance. The governing body sets direction and oversight. In a change scenario, the board should expect management to update the risk profile and strategic plan, second-line functions to update frameworks and monitoring, and internal audit to assess whether all of this was done effectively.
7. Communication and reporting. COSO's Information, Communication, and Reporting component requires that changes in risk be communicated across the organization and upward to the board in a timely fashion. Reporting should show how the risk profile has changed, why, and what actions are planned, linked to strategy and performance.
Internal Audit's Role in Responding to Change and Strategic Risk
The CRMA exam views this topic through the lens of risk management assurance, so you must be clear about what internal audit does and does not do.
What internal audit should do:
- Maintain a risk-based audit plan that is reviewed and adjusted as the organization's risk profile changes, not just annually. The IIA Standards require the chief audit executive to establish a risk-based plan, review it at least annually, and adjust it in response to changes in the organization's business, risks, operations, programs, systems, and controls.
- Evaluate whether the organization's governance processes effectively identify and respond to substantial change (an assurance engagement over the Review and Revision component, in COSO terms).
- Assess risk exposures relating to the achievement of the organization's strategic objectives, as well as operational, reporting, and compliance objectives.
- Provide insight to the board and audit committee on emerging risks observed across engagements, trends, and root causes.
- Offer consulting support, such as facilitating risk workshops or advising on framework design, provided independence is safeguarded and management retains decision-making responsibility.
- Consider the organization's strategy and strategic risks when developing the internal audit strategy and plan, and build agility into the plan (for example, reserving unallocated hours for emerging issues).
What internal audit should NOT do:
- Set risk appetite, decide risk responses, or own the strategic risk register.
- Implement risk management processes on management's behalf.
- Provide assurance over risk management activities that internal audit itself designed or operated without appropriate safeguards and disclosure.
- Treat the audit plan as fixed once approved; failing to adjust the plan after a major change is a frequently tested weakness.
Common Governance Failures Tested on the Exam
- Risk assessments performed only annually with no trigger for interim reassessment.
- Strategic risks absent from the risk register because the register focuses on operational and compliance risks only.
- Risk appetite statements that are never revisited after strategy changes.
- Boards that receive backward-looking performance data but no forward-looking risk information.
- Emerging risks identified by staff but with no escalation path to decision-makers.
- Change initiatives (system implementations, acquisitions) launched without a risk assessment or without updating the control environment.
- Internal audit plans that ignore the organization's strategic objectives or are not updated after major events.
Exam Tips: Answering Questions on Responding to Change and Strategic Risk
Tip 1: Think 'dynamic, not static.' Whenever an answer choice suggests that a risk assessment, audit plan, or risk appetite statement is reviewed only at a fixed interval regardless of events, treat it with suspicion. The best answer almost always involves ongoing monitoring and event-driven reassessment.
Tip 2: Link everything to strategy. The CRMA emphasizes COSO ERM 2017's integration of risk with strategy and performance. If a question asks what should happen first after a strategic change, look for the option that revisits business context, risk appetite, and objectives before jumping to control testing.
Tip 3: Know the three dimensions of strategic risk. Questions may describe a scenario and ask which type of strategy-related risk it represents. Misalignment with mission equals dimension one; consequences of the chosen strategy equals dimension two; failure to execute equals dimension three.
Tip 4: Respect the Three Lines. If an option has internal audit deciding risk responses, setting appetite, or owning the risk register, it is wrong. The correct answer will have internal audit assessing, evaluating, reporting, or advising, with management deciding and owning.
Tip 5: Watch for 'substantial change' triggers. Mergers, new regulations, new products, geographic expansion, leadership changes, and major IT projects are classic triggers. The best response usually involves reassessing the risk profile and updating the audit plan promptly, not waiting for the next annual cycle.
Tip 6: Prefer forward-looking tools. When asked how to identify emerging or strategic risks, favor scenario analysis, horizon scanning, KRIs, and stress testing over historical loss data alone. Historical data is useful but insufficient for change-driven risk.
Tip 7: Identify the governing body's role correctly. The board approves strategy and risk appetite, oversees management's response to change, and receives reporting. It does not perform day-to-day risk management. Options that have the board executing operational risk tasks are distractors.
Tip 8: Read for the 'best' answer, not a 'correct' one. Many CRMA items present several plausible actions. Rank them: the best answer is typically the one that is most independent (for internal audit), most proactive and timely (for governance), and most clearly connected to strategic objectives and risk appetite.
Tip 9: Use framework vocabulary. Recognize terms such as 'assesses substantial change,' 'reviews risk and performance,' 'pursues improvement,' 'business context,' 'risk appetite,' 'risk capacity,' 'tolerance,' 'emerging risk,' 'risk velocity,' and 'dynamic.' Answer choices that use framework language precisely are often the intended correct option.
Tip 10: In scenario questions about the audit plan, choose agility. If a question describes a major event mid-year, the chief audit executive should reassess risks, revise the plan, and communicate the changes to senior management and the board. Simply noting the change for next year's plan is rarely correct.
Quick Review Summary
- Strategic risk has three dimensions: misalignment with mission and values, implications of the chosen strategy, and risk to execution.
- COSO ERM 2017's Review and Revision component (Principles 15 to 17) is the anchor for responding to change.
- ISO 31000 requires risk management to be integrated and dynamic.
- Governance tools include business context analysis, horizon scanning, scenario analysis, KRIs, appetite recalibration, and event-driven reassessment.
- Management owns risk and responses; the board oversees and sets appetite; second-line functions support and monitor; internal audit provides independent assurance and insight.
- Internal audit must keep its risk-based plan current, assess strategic risk exposures, and avoid assuming management responsibilities.
Master these ideas, practice applying them to scenario-based questions, and you will be well prepared for the Responding to Change and Strategic Risk content within the CRMA Risk Management Governance domain.
Within the IIA Certification in Risk Management Assurance (CRMA) syllabus, the Risk Management Governance domain tests whether you understand how an organization's governing body and senior management direct, oversee, and adapt risk management. 'Responding to Change and Strategic Risk' sits at the heart of this domain because risk management is not a one-time exercise. Organizations operate in environments that shift constantly: new competitors, regulation, technology disruption, economic shocks, geopolitical events, changes in leadership, mergers, and shifts in stakeholder expectations. A risk framework that was fit for purpose last year can be dangerously outdated today.
The CRMA examiner expects you to know three interlocking things: (1) what strategic risk is and how it differs from operational, compliance, and financial risk; (2) how mature governance structures detect and respond to internal and external change; and (3) what internal audit's role is in providing assurance (and sometimes advice) on the organization's ability to adapt, without crossing into management's responsibilities. Candidates who treat risk management as a static register-building exercise tend to score poorly here. Those who think of it as a dynamic, iterative, strategy-linked process score well.
What Is Strategic Risk?
Strategic risk is the risk that affects, or is created by, the organization's business strategy and strategic objectives. The COSO ERM 2017 framework, Enterprise Risk Management: Integrating with Strategy and Performance, is the most important reference for this topic. It describes three dimensions of strategy-related risk that you must be able to distinguish:
1. The possibility that strategy does not align with mission, vision, and core values. A well-executed strategy that takes the organization somewhere its stakeholders never intended is itself a risk.
2. The implications of the strategy chosen. Every strategic choice carries its own risk profile. Choosing aggressive international expansion, for example, imports currency, political, and supply-chain exposures that a domestic strategy would not.
3. Risk to executing the strategy. This is the dimension most people think of first: the risk that the organization fails to deliver the plan because of operational, financial, compliance, or external events.
Strategic risk is typically high impact, long horizon, and difficult to quantify. It is owned at the board and executive level, not delegated to a single department. ISO 31000 reinforces this by making 'Integrated' and 'Dynamic' two of its core principles: risk management should be part of all organizational activities, and it should anticipate, detect, acknowledge, and respond to change in a timely way.
What Does 'Responding to Change' Mean in a Governance Context?
Responding to change refers to the governance mechanisms that ensure risk identification, assessment, appetite, and response remain relevant when the internal or external context shifts. COSO ERM 2017 addresses this explicitly through its Review and Revision component, which contains three principles:
- Principle 15: Assesses Substantial Change. The organization identifies and assesses changes that may substantially affect strategy and business objectives. Examples include a new regulatory regime, a change in the business model, a major acquisition, leadership turnover, rapid growth, or new technology.
- Principle 16: Reviews Risk and Performance. The organization reviews entity performance results and considers risk. Variances between expected and actual performance often signal that the risk profile has changed.
- Principle 17: Pursues Improvement in Enterprise Risk Management. The organization continually improves ERM practices based on lessons learned and changing conditions.
In addition, the Strategy and Objective-Setting component requires the organization to analyze the business context (internal and external), define risk appetite, evaluate alternative strategies, and formulate business objectives. When the context changes, each of these should be revisited.
How It Works: The Mechanics of Adaptive Risk Governance
1. Monitoring the business context. Mature organizations scan their environment continuously using tools such as PESTLE analysis (political, economic, social, technological, legal, environmental), SWOT analysis, competitor intelligence, and stakeholder engagement. The board should receive regular reporting on external trends, not just internal metrics.
2. Horizon scanning and emerging risk identification. Emerging risks are new, evolving, or poorly understood risks whose impact and likelihood are uncertain. Governance structures should assign responsibility for identifying them, often to a risk committee or chief risk officer, and should use techniques such as scenario analysis, stress testing, war-gaming, and expert workshops. Risk velocity (how quickly a risk materializes) and risk persistence (how long its effects last) become especially important when assessing emerging risks.
3. Key risk indicators (KRIs) and triggers. KRIs are forward-looking metrics that signal a change in risk exposure before a loss occurs. Governance should define thresholds that trigger escalation and reassessment. For example, a sustained rise in customer churn or a sudden drop in supplier on-time delivery may be a leading indicator that a strategic assumption is failing.
4. Re-evaluating risk appetite and tolerance. Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of value. It is set by the board and must be revisited when strategy changes, when the organization's capacity to bear risk changes (for example, after losses or capital raising), or when stakeholder expectations shift. Tolerances, which are the acceptable ranges of variation around specific objectives, should be recalibrated at the same time.
5. Event-driven reassessment. Besides periodic cycles (usually annual), good governance mandates reassessment when substantial change occurs: a merger or acquisition, a new line of business, entry into a new jurisdiction, major system implementation, significant leadership change, a crisis, or a material regulatory development. Waiting for the next scheduled cycle is a common governance weakness that exam questions probe.
6. Clear roles under the Three Lines Model. Management (first line) owns risks and the responses to change. Risk, compliance, and similar functions (second line) provide expertise, frameworks, monitoring, and challenge. Internal audit (third line) provides independent assurance. The governing body sets direction and oversight. In a change scenario, the board should expect management to update the risk profile and strategic plan, second-line functions to update frameworks and monitoring, and internal audit to assess whether all of this was done effectively.
7. Communication and reporting. COSO's Information, Communication, and Reporting component requires that changes in risk be communicated across the organization and upward to the board in a timely fashion. Reporting should show how the risk profile has changed, why, and what actions are planned, linked to strategy and performance.
Internal Audit's Role in Responding to Change and Strategic Risk
The CRMA exam views this topic through the lens of risk management assurance, so you must be clear about what internal audit does and does not do.
What internal audit should do:
- Maintain a risk-based audit plan that is reviewed and adjusted as the organization's risk profile changes, not just annually. The IIA Standards require the chief audit executive to establish a risk-based plan, review it at least annually, and adjust it in response to changes in the organization's business, risks, operations, programs, systems, and controls.
- Evaluate whether the organization's governance processes effectively identify and respond to substantial change (an assurance engagement over the Review and Revision component, in COSO terms).
- Assess risk exposures relating to the achievement of the organization's strategic objectives, as well as operational, reporting, and compliance objectives.
- Provide insight to the board and audit committee on emerging risks observed across engagements, trends, and root causes.
- Offer consulting support, such as facilitating risk workshops or advising on framework design, provided independence is safeguarded and management retains decision-making responsibility.
- Consider the organization's strategy and strategic risks when developing the internal audit strategy and plan, and build agility into the plan (for example, reserving unallocated hours for emerging issues).
What internal audit should NOT do:
- Set risk appetite, decide risk responses, or own the strategic risk register.
- Implement risk management processes on management's behalf.
- Provide assurance over risk management activities that internal audit itself designed or operated without appropriate safeguards and disclosure.
- Treat the audit plan as fixed once approved; failing to adjust the plan after a major change is a frequently tested weakness.
Common Governance Failures Tested on the Exam
- Risk assessments performed only annually with no trigger for interim reassessment.
- Strategic risks absent from the risk register because the register focuses on operational and compliance risks only.
- Risk appetite statements that are never revisited after strategy changes.
- Boards that receive backward-looking performance data but no forward-looking risk information.
- Emerging risks identified by staff but with no escalation path to decision-makers.
- Change initiatives (system implementations, acquisitions) launched without a risk assessment or without updating the control environment.
- Internal audit plans that ignore the organization's strategic objectives or are not updated after major events.
Exam Tips: Answering Questions on Responding to Change and Strategic Risk
Tip 1: Think 'dynamic, not static.' Whenever an answer choice suggests that a risk assessment, audit plan, or risk appetite statement is reviewed only at a fixed interval regardless of events, treat it with suspicion. The best answer almost always involves ongoing monitoring and event-driven reassessment.
Tip 2: Link everything to strategy. The CRMA emphasizes COSO ERM 2017's integration of risk with strategy and performance. If a question asks what should happen first after a strategic change, look for the option that revisits business context, risk appetite, and objectives before jumping to control testing.
Tip 3: Know the three dimensions of strategic risk. Questions may describe a scenario and ask which type of strategy-related risk it represents. Misalignment with mission equals dimension one; consequences of the chosen strategy equals dimension two; failure to execute equals dimension three.
Tip 4: Respect the Three Lines. If an option has internal audit deciding risk responses, setting appetite, or owning the risk register, it is wrong. The correct answer will have internal audit assessing, evaluating, reporting, or advising, with management deciding and owning.
Tip 5: Watch for 'substantial change' triggers. Mergers, new regulations, new products, geographic expansion, leadership changes, and major IT projects are classic triggers. The best response usually involves reassessing the risk profile and updating the audit plan promptly, not waiting for the next annual cycle.
Tip 6: Prefer forward-looking tools. When asked how to identify emerging or strategic risks, favor scenario analysis, horizon scanning, KRIs, and stress testing over historical loss data alone. Historical data is useful but insufficient for change-driven risk.
Tip 7: Identify the governing body's role correctly. The board approves strategy and risk appetite, oversees management's response to change, and receives reporting. It does not perform day-to-day risk management. Options that have the board executing operational risk tasks are distractors.
Tip 8: Read for the 'best' answer, not a 'correct' one. Many CRMA items present several plausible actions. Rank them: the best answer is typically the one that is most independent (for internal audit), most proactive and timely (for governance), and most clearly connected to strategic objectives and risk appetite.
Tip 9: Use framework vocabulary. Recognize terms such as 'assesses substantial change,' 'reviews risk and performance,' 'pursues improvement,' 'business context,' 'risk appetite,' 'risk capacity,' 'tolerance,' 'emerging risk,' 'risk velocity,' and 'dynamic.' Answer choices that use framework language precisely are often the intended correct option.
Tip 10: In scenario questions about the audit plan, choose agility. If a question describes a major event mid-year, the chief audit executive should reassess risks, revise the plan, and communicate the changes to senior management and the board. Simply noting the change for next year's plan is rarely correct.
Quick Review Summary
- Strategic risk has three dimensions: misalignment with mission and values, implications of the chosen strategy, and risk to execution.
- COSO ERM 2017's Review and Revision component (Principles 15 to 17) is the anchor for responding to change.
- ISO 31000 requires risk management to be integrated and dynamic.
- Governance tools include business context analysis, horizon scanning, scenario analysis, KRIs, appetite recalibration, and event-driven reassessment.
- Management owns risk and responses; the board oversees and sets appetite; second-line functions support and monitor; internal audit provides independent assurance and insight.
- Internal audit must keep its risk-based plan current, assess strategic risk exposures, and avoid assuming management responsibilities.
Master these ideas, practice applying them to scenario-based questions, and you will be well prepared for the Responding to Change and Strategic Risk content within the CRMA Risk Management Governance domain.
Test mode:
CRMA - Responding to Change and Strategic Risk Example Questions
Test your knowledge of Responding to Change and Strategic Risk
Question 1
When evaluating an organization's ability to respond to substantial change and emerging risks, which of the following BEST indicates that this capability is operating effectively?
Question 2
Midway through the year, senior management shifts the organization's strategy from wholesale distribution toward online direct-to-consumer sales. The current risk-based internal audit plan was built on the prior strategy, and the board has asked the chief audit executive for assurance that the organization is responding appropriately to this change. Which action should the chief audit executive take FIRST?
Question 3
During an advisory review, the chief audit executive learns that the annual risk assessment flagged a proposed regulation that could make the organization's core product line unprofitable. The item was logged in the risk register, scored as high on the heat map, and assigned to the compliance function. However, the strategic plan and its underlying assumptions are unchanged, and the board has not discussed the proposal. Which recommendation is MOST appropriate?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Responding to Change and Strategic Risk questions
20 questions (total)
Other Risk Management Governance concepts
Assessing Risk CultureBoard Risk Oversight and CommitteesChief Risk Officer and Risk Function RolesComparing COSO ERM and ISO 31000Corporate Governance Structures and RolesCOSO ERM Components and PrinciplesCOSO Internal Control FrameworkElements of Risk GovernanceEmbedding Risk Management in OperationsEvaluating Governance Structure EffectivenessEvaluating the Quality of Risk ReportsGovernance Frameworks and PrinciplesHorizon Scanning and Scenario AnalysisIdentifying Emerging RisksImpact of Culture on the Control EnvironmentIncentives and Risk-Taking BehaviorIntegrated Risk Reporting to StakeholdersIntegrating Risk into Strategy SettingISO 31000 Principles, Framework, and ProcessIT Governance and Control FrameworksKey Risk Indicators and Performance IndicatorsLinking Risk to Objectives and PerformanceManagement Commitment to Risk ManagementPortfolio View of RiskResilience and Business ContinuityRisk Appetite StatementsRisk Capacity, Appetite, and ToleranceRisk Culture and Its IndicatorsRisk Reporting to the BoardSelecting a Framework That Fits the OrganizationSoft Controls and Ethical ClimateTone at the Top