By Larry Lake, Protiviti Managing Director
The attached presentation was given at the annual conference of the Association of Healthcare Internal Auditors in 2005. These presentation addresses three primary topics:
- What are Risk Management Frameworks and Why have them?
- What is a Risk Control Matrix, COSO, COBIT, Risk Universe, Key Controls, Critical Controls?
- Using them in SOA and ERM
The presentation illustrates a risk framework and risk control matrix, and defines Entity-level Controls, Process-Level Controls, and General IT and Application Controls.
It also defines and discusses control types:
- Manual vs. System-based controls
- Preventive vs. Detective controls
- Key controls vs. Critical controls
- Primary vs. secondary controls
- Controls over routine processes vs. controls over non-routine processes
Descriptions and details are provided for the COSO framework, the COSO ERM framework and the COBIT framework. The presentation concludes by discussing the elements and implementation of an Enterprise Risk Management solution.
View the full presentation:
(51 pages, 6.6 MB)