not take) Identifying and describing the risks in a "risk inventory". Implementing a risk-ranking methodology to prioritize risks within and across functions. Establishing a risk committee and or Chief Risk Officer (CRO) to coordinate certain activities of the risk functions. Establishing ownership for particular risks and responses. Demonstrating the cost-benefit of the risk management effort. Developing action plans to ensure the risks are appropriately managed. Developing consolidated reporting for various stakeholders. Monitoring the results of actions taken to mitigate risk. Ensuring efficient risk coverage by internal auditors, consulting teams, and other evaluating entities. Developing a technical ERM framework that enables secure participation by 3rd parties and remote employees. Internal audit role In addition to information technology audit, internal auditors play an important role in evaluating the risk-management processes of an organization and advocating their continued improvement. However, to preserve its organizational independence and objective judgment, Internal Audit professional standards indicate the function should not take any direct responsibility for making risk management decisions for the enterprise or managing the risk-management function. Internal auditors typically perform an annual risk assessment of the enterprise, to develop a plan of audit engagements for the upcoming year. This plan is updated at various frequencies in practice. This typically involves review of the various risk assessments performed by the enterprise (e.g., strategic plans, competitive benchmarking, and SOX 404 top-down risk assessment), consideration of prior audits, and interviews with a variety of senior management. It is designed for identifying audit projects, not to identify, prioritize, and manage risks directly for the enterprise. Current issues in ERM The risk management processes of corporations worldwide are under increasing regulatory and private scrutiny. Risk is an essential part of any business. Properly managed, it drives growth and opportunity. Executives struggle with business pressures that may be partly or completely beyond their immediate control, such as distressed financial markets; mergers, acquisitions and restructurings; disruptive technology change; geopolitical instabilities; and the rising price of energy. Sarbanes–Oxley Act requirements Section 404 of the Sarbanes–Oxley Act of 2002 required U.S. publicly traded corporations to utilize a control framework in their internal control assessments. Many opted for the COSO Internal Control Framework, which includes a risk assessment element. In addition, new guidance issued by the Securities and Exchange Commission (SEC) and PCAOB in 2007 placed increasing scrutiny on top-down risk assessment and included a specific requirement to perform a fraud risk assessment. Fraud risk