In order to achieve end-state enterprise risk management, organizations must define practices and language to consistently identify, manage and aggregate risks; build from existing practices and inject risk management into critical management practices; link risk management with opportunity pursuit/ROI; and drive awareness of top risks through the organization via communication, training, linking to compensation and involving an informed board, with management and directors focused on similar issues, while being objective and transparent.

In this tool, we’ve compiled a guide that can be used by auditors to understand and improve an organization’s risk management process.