Advancements in Enterprise Risk and Governance: Sponsored by Columbia University's School of Professional Studies

1. Introduction

Thank you for agreeing to participate in this important research!

The Columbia University School of Professional Studies’ Dean’s Grant is funding this research. The purpose of the survey is to learn the current state and future direction of advancements in risk practice focused on Enterprise Risk and Governance around the world.

Your feedback will advance research in risk management and inform instruction on leading ERM practice.

Respondents will receive a copy of the results by email.

Question Title

* 1. Business title

Other titles (please specify)

Question Title

* 2. Which risk framework(s) have you adopted? (Select all that apply)

COSO ERM - 2017

COSO ERM pre-2017

ISO 31000 - 2018

ISO 31000 pre-2018

Basel Capital Accord

Hybrid Risk Framework - Combination (COSO/ISO/other)

Proprietary Risk Framework - InHouse Design

NIST IT Security Risk Framework

No Formal Risk Framework - NA

IT Security Risk Framework - ISO, ISACA, CoBIT, Internal, Others (please explain below)

Customized proprietary framework

Other (please specify)

Question Title

* 3. Adoption rate of 2017 COSO ERM new guidance

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Short answers allowed (please specify)

Question Title

* 4. Adoption rate of 2018 ISO 31000 new guidance

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Short answers allowed (please specify)

Question Title

* 5. Adoption rate of 2018 NIST Cybersecurity framework

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Largely complete

Making great progress on adoption

Identified key areas for adoption and begun the process

Begun planning for adoption

Have not adopted new guidance

Don't know

N/A

Short answers allowed (please specify)

Question Title

* 6. How do you measure the performance of your risk program? (Select all that apply)

I don't have metrics of performance for a risk program

Key Risk Indicators/Key Performance Indicators - Dashboard

Risk Surveys

Risk Reduction Metrics - Quantitative

Risk Appetite Metrics

Benchmark measures of risk performance

Audit findings of significance

Cyber Risk Metrics

Annual change in risk profile

Automated risk metric reporting

Improved risk outcomes

Other (please specify)

Question Title

* 7. Tools used to facilitate the administration of risk management (Select all that apply)

GRC/IRM/RegTech/Audit Risk Platform(s)

Proprietary Risk Management Systems - InHouse (Quantitative/Qualitative)

Machine Learning - automated risk monitoring, assessment, &/or analysis (AI)

Third-Party Vendor Security Systems

Contractual Agreement Automation

Cloud-based Risk platform

InsureTech

InfoSec GRC Platform

Microsoft Office (Excel, etc)

Manual administration of risk program

Other (please specify)

Question Title

* 8. Risk governance profile (select all that apply)

Risk Oversight Committees

Senior Executive Risk Committees

CRO on Board or Audit Committee

Audit Executive on Audit Committee

SR. Risk/Compliance/Audit Oversight Committee

CFO/CCO drives Risk Governance

Board drives Risk Governance

Risk governance is informal

Other models of governance (please specify)

Question Title

* 9. Define how risk management is aligned with strategy (select all that apply)

Risk management reviews & approves strategy

Risk management is one of several reviewers

Risk management is optional, but key contributor

Risk management consults upfront

Risk management is a valued resource

Risk provides independent analysis & assessment (data & research)

Risk is not involved in strategic decision-making

Other strategic alignments with risk (please specify)

Question Title

* 10. Risk program contributions to corporate culture
(Select all that apply)

Decision-support tools

Risk & Cyber Awareness Programs

Risk Analytics & Reporting

Risk & Control Self-Assessments

Active Tone at the Top (Board/Sr. Executives)

Risk Appetite Statement

Risk Management Policy

Clear Three Lines of Defense (3LoD)

Risk Taxonomy/Communications

Well defined risk-taking process

Other (please specify)

Question Title

* 11. Enhancements in risk management program (check all that apply)

Automate risk data/monitoring

Stochastic Risk Database or Data Lake

Machine learning - Compliance, Risk, Audit

Decision-Support Platform(s)

Audit Analytics

Risk Data Analysts (SAS, Python, R)

Risk Modeling

Cyber Risk Analytics & Monitoring

Risk & Control Self-Assessments

Risk Surveys

Facilitated Risk Assessments

N/A

Other (please specify)

Question Title

* 12. Advancements in CyberSecurity Risk Management (planned or in-use) Check that apply

Automated Threat and Vulnerability Monitoring

Automate Incident Response - Human Error

Proprietary InfoSec Automation (Python, others)

Deception Automation - Honey Pots, etc.

Hardware Authentication

End-Point Analytics

User-behavior Analytics

Digital Access Management

Encryption and Tokenization software

Machine Learning - Threat Assessment

Mobile Device Behavioral Analytics

Cloud-analytics monitoring

Add Cyber Risk Analysts (Python, SAS, R)

Building Cyber Risk Data Models

IT Risk Inventory (qualitative)

Adoption of ERM approach to IT Security Risks

Cyber Risk Insurance

Captive Insurance - Cyber Risk

Other (please specify)

Question Title

* 13. Feedback - What other risk governance advancements apply?

Question Title

* 14. Enter your email if you would like to receive one free copy

Name

Email Address

Advancements in Enterprise Risk and Governance: Sponsored by Columbia University's School of Professional Studies

1. Introduction

Question Title

* 1. Business title

Question Title

* 2. Which risk framework(s) have you adopted? (Select all that apply)

Question Title

* 3. Adoption rate of 2017 COSO ERM new guidance

Question Title

* 4. Adoption rate of 2018 ISO 31000 new guidance

Question Title

* 5. Adoption rate of 2018 NIST Cybersecurity framework

Question Title

* 6. How do you measure the performance of your risk program? (Select all that apply)

Question Title

* 7. Tools used to facilitate the administration of risk management (Select all that apply)

Question Title

* 8. Risk governance profile (select all that apply)

Question Title

* 9. Define how risk management is aligned with strategy (select all that apply)

Question Title

* 10. Risk program contributions to corporate culture (Select all that apply)

Question Title

* 11. Enhancements in risk management program (check all that apply)

Question Title

* 12. Advancements in CyberSecurity Risk Management (planned or in-use) Check that apply

Question Title

* 13. Feedback - What other risk governance advancements apply?

Question Title

* 14. Enter your email if you would like to receive one free copy

* 10. Risk program contributions to corporate culture
(Select all that apply)