Standard
Enterprise Risk Management Standard
This standard defines the enterprise-wide risk management framework, taxonomy, and scoring methodology that guide the identification, evaluation, treatment, and monitoring of risks across all business units and functions. It ensures that risk management practices are consistent, measurable, and traceable, aligned with ISO 31000:2018, COBIT 2019 APO12, and CSA CCM v4.1 GRC-02.
- Type
- Standard
- Version
- 1.8.19
- Date
- 2026-10-27
- Owner
- Chief Risk Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Risk Management
- Review frequency
- Annual or as required by regulatory or framework changes
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance
- 4. Risk taxonomy
- 5. Risk assessment and scoring
- 6. Risk treatment
- 7. Risk register entry fields
- 8. Risk monitoring and reporting
- 9. Evidence requirements
- 10. Framework alignment
- 11. Licence
Frameworks it maps to
- ISO 31000:2018
- ISO/IEC 23894:2023
- ISO/IEC 42001:2023
- COBIT 2019
- CSA CCM v4.1
- CSA AICM v1.1
- NIST SP 800-39
- NIST IR 8286 (Rev. 1; and 8286A/B/C/D)
- NIST SP 800-221 / 800-221A
- NIST AI RMF 1.0
- OECD AI Principles
- GDPR
- PIPEDA (Canada Personal Information Protection and Electronic Documents Act)
- PIPL
- LGPD
- APEC CBPR
Related documents
- Enterprise Governance and Risk Management Policyrisk
- Risk Register Procedurerisk
- Risk Assessment Methodology Procedurerisk
- Risk Acceptance Procedurerisk
- Exception and Risk Acceptance Management Policygovernance
Next
All Documents