Viewing risks across the enterprise can help management and the board of directors not only articulate more clearly the “most likely” outcome of a strategy, change in process, or transaction but, more important, focus on a range of possible results to facilitate a discussion of risks and effectiveness of processes to lay off or mitigate those risks.
Internal controls are an integral part of enterprise-wide risk management. Under COSO’s Internal Control Framework, directors have responsibility for overseeing internal control processes so that they can reasonably expect that their directives will be followed. Directors should also keep up with innovations in corporate governance, and this is one key area in which the legal advisers of financial companies can assist their clients.