Risk management and internal controls
Risk management is a continuous cycle: identify risks, assess them, decide what to do, and monitor them. All of it lives in a risk register.
Every risk has four possible responses:
| Avoid | Stop the activity that causes it, e.g. never store card data. |
| Mitigate | Add controls that reduce likelihood or impact: MFA, backups. |
| Transfer | Shift the financial impact: cyber insurance, or a contractually liable provider. |
| Accept | The risk is small or costlier to treat than to bear, so accept it with a documented decision. |
Internal controls protect against error and fraud. The most important is segregation of duties: the same person must not create a new vendor and approve its payment, or they could pay themselves. ERPs enforce this through roles.
Watch outThe IIA's three lines model: operational management owns risks, risk and compliance functions oversee and advise, and internal audit gives independent assurance to the board.