Which of the following must be established to manage I&T-related risk across the enterprise?
An enterprise risk universe provides the complete population of risks that could affect the organization at every level. It establishes the enterprise-wide scope needed to identify and manage I&T-related risk comprehensively; a committee or use of industry practices alone does not establish that scope.
Community Discussion