Skip to main content

11.0 - Manage Enterprise Risk, Compliance, Remediation, and Resiliency

PCF Category: 11.0
Total Elements: 56
Hierarchy Depth: Up to 3 levels

Overview​

This category encompasses all processes related to manage enterprise risk, compliance, remediation, and resiliency within an enterprise.

Process Groups (Level 1)​

Hierarchy IDProcess GroupSub-Elements
11.0Manage Enterprise Risk, Compliance, Remediation, and Resiliency0
11.1Manage enterprise risk25
11.2Manage compliance15
11.3Manage remediation efforts6
11.4Manage business resiliency5

Detailed Process Hierarchy​

11.0 - Manage Enterprise Risk, Compliance, Remediation, and Resiliency​

PCF ID: 16437

11.1 - Manage enterprise risk​

PCF ID: 17060

IDProcessPCF IDMetrics
11.1.1Establish the enterprise risk framework and policies16439N
11.1.2Oversee and coordinate enterprise risk management activities16445N
11.1.3Manage business unit and function risk17462N
11.1.1 - Establish the enterprise risk framework and policies (5 elements)
IDProcessPCF ID
11.1.1.1Determine risk tolerance for organization16440
11.1.1.2Develop and maintain enterprise risk policies and procedures16441
11.1.1.3Identify and implement enterprise risk management tools16442
11.1.1.4Coordinate the sharing of risk knowledge across the organization16443
11.1.1.5Prepare and report enterprise risk to executive management and board16444
11.1.2 - Oversee and coordinate enterprise risk management activities (9 elements)
IDProcessPCF ID
11.1.2.1Identify enterprise level risks16446
11.1.2.2Assess risks to determine which to mitigate16447
11.1.2.3Develop risk mitigation and management strategy and integrate with existing performance management processes16448
11.1.2.4Verify business unit and functional risk mitigation plans are implemented16449
11.1.2.5Ensure risks and risk mitigation actions are monitored16450
11.1.2.6Report on enterprise risk activities16451
11.1.2.7Coordinate business unit and functional risk management activities16452
11.1.2.8Ensure that each business unit/function follows the enterprise risk management process16453
11.1.2.9Ensure that each business unit/function follows the enterprise risk reporting process16454
11.1.3 - Manage business unit and function risk (8 elements)
IDProcessPCF ID
11.1.3.1Identify risks16456
11.1.3.2Assess risks using enterprise risk framework policies and procedures16457
11.1.3.3Develop mitigation plans for risks16458
11.1.3.3.1Assess adequacy of insurance coverage18129
11.1.3.4Implement mitigation plans for risks16459
11.1.3.5Monitor risks16460
11.1.3.6Analyze risk activities and update plans16461
11.1.3.7Report on risk activities16462

11.2 - Manage compliance​

PCF ID: 17467

IDProcessPCF IDMetrics
11.2.1Establish compliance framework and policies17468N
11.2.2Manage regulatory compliance16463N
11.2.1 - Establish compliance framework and policies (4 elements)
IDProcessPCF ID
11.2.1.1Develop enterprise compliance policies and procedures17469
11.2.1.2Implement enterprise compliance activities17470
11.2.1.3Manage internal audits14133
11.2.1.4Maintain controls-related technologies and tools14137
11.2.2 - Manage regulatory compliance (9 elements)
IDProcessPCF ID
11.2.2.1Develop regulatory compliance procedures16464
11.2.2.2Identify applicable regulatory requirements16465
11.2.2.3Monitor the regulatory environment for changing or emerging regulations16466
11.2.2.4Assess current compliance position and identify weaknesses or shortfalls therein16467
11.2.2.5Implement missing or stronger regulatory compliance controls and policies16468
11.2.2.6Monitor and test regulatory compliance position and existing controls16469
11.2.2.7Compile and communicate compliance scorecard(s)19595
11.2.2.8Compile and communicate internal and regulatory compliance reports19596
11.2.2.9Maintain relationships with regulators as appropriate16470

11.3 - Manage remediation efforts​

PCF ID: 11185

IDProcessPCF IDMetrics
11.3.1Create remediation plans11201N
11.3.2Contact and confer with experts11202N
11.3.3Identify/dedicate resources11203N
11.3.4Investigate legal aspects11204N
11.3.5Investigate damage cause11205N
11.3.6Amend or create policy11206N

11.4 - Manage business resiliency​

PCF ID: 11216

IDProcessPCF IDMetrics
11.4.1Develop the business resilience strategy11221N
11.4.2Perform continuous business operations planning11222N
11.4.3Test continuous business operations11223N
11.4.4Maintain continuous business operations11224N
11.4.5Share knowledge of specific risks across other parts of the organization16471N

Change Summary (v7.2.1 vs v6.1.1)​

Changes are indicated by:

  • +XXXXX - New element added (PCF ID)
  • -XXXXX - Element removed
  • cXXXXX - Element changed
  • NEW - Newly introduced in v7.2.1

Full Process List​

Complete 56 elements
Hierarchy IDNamePCF IDChange
11.0Manage Enterprise Risk, Compliance, Remediation, and Resilie...16437RENAME, WAS:Manage Enterprise Risk, Compliance, Remediation and Resiliency
11.1Manage enterprise risk17060-
11.1.1Establish the enterprise risk framework and policies16439-
11.1.1.1Determine risk tolerance for organization16440-
11.1.1.2Develop and maintain enterprise risk policies and procedures16441-
11.1.1.3Identify and implement enterprise risk management tools16442-
11.1.1.4Coordinate the sharing of risk knowledge across the organiza...16443-
11.1.1.5Prepare and report enterprise risk to executive management a...16444-
11.1.2Oversee and coordinate enterprise risk management activities16445c16448, c16451
11.1.2.1Identify enterprise level risks16446-
11.1.2.2Assess risks to determine which to mitigate16447-
11.1.2.3Develop risk mitigation and management strategy and integrat...16448RENAME, WAS:Develop risk mitigation and management strategy, and integrate with existing performance management processes
11.1.2.4Verify business unit and functional risk mitigation plans ar...16449-
11.1.2.5Ensure risks and risk mitigation actions are monitored16450-
11.1.2.6Report on enterprise risk activities16451RENAME, WAS:Report on risk activities
11.1.2.7Coordinate business unit and functional risk management acti...16452-
11.1.2.8Ensure that each business unit/function follows the enterpri...16453-
11.1.2.9Ensure that each business unit/function follows the enterpri...16454-
11.1.3Manage business unit and function risk17462-
11.1.3.1Identify risks16456-
11.1.3.2Assess risks using enterprise risk framework policies and pr...16457-
11.1.3.3Develop mitigation plans for risks16458+18129
11.1.3.3.1Assess adequacy of insurance coverage18129NEW
11.1.3.4Implement mitigation plans for risks16459-
11.1.3.5Monitor risks16460-
11.1.3.6Analyze risk activities and update plans16461-
11.1.3.7Report on risk activities16462-
11.2Manage compliance17467-
11.2.1Establish compliance framework and policies17468-
11.2.1.1Develop enterprise compliance policies and procedures17469-
11.2.1.2Implement enterprise compliance activities17470-
11.2.1.3Manage internal audits14133-
11.2.1.4Maintain controls-related technologies and tools14137-
11.2.2Manage regulatory compliance16463+19595, +19596, c16467, c16469
11.2.2.1Develop regulatory compliance procedures16464-
11.2.2.2Identify applicable regulatory requirements16465-
11.2.2.3Monitor the regulatory environment for changing or emerging ...16466-
11.2.2.4Assess current compliance position and identify weaknesses o...16467RENAME, WAS:Assess current compliance position, and identify weaknesses or shortfalls therein
11.2.2.5Implement missing or stronger regulatory compliance controls...16468-
11.2.2.6Monitor and test regulatory compliance position and existing...16469RENAME, WAS:Monitor and test, on an ongoing and scheduled basis, regulatory compliance position and existing controls, defining controls that should be added, removed, or modified as required
11.2.2.7Compile and communicate compliance scorecard(s)19595NEW
11.2.2.8Compile and communicate internal and regulatory compliance r...19596NEW
11.2.2.9Maintain relationships with regulators as appropriate16470-
11.3Manage remediation efforts11185-
11.3.1Create remediation plans11201-
11.3.2Contact and confer with experts11202-
11.3.3Identify/dedicate resources11203-
11.3.4Investigate legal aspects11204-
11.3.5Investigate damage cause11205-
11.3.6Amend or create policy11206-
11.4Manage business resiliency11216-
11.4.1Develop the business resilience strategy11221-
11.4.2Perform continuous business operations planning11222-
11.4.3Test continuous business operations11223-
11.4.4Maintain continuous business operations11224-
11.4.5Share knowledge of specific risks across other parts of the ...16471-

Back to: APQC PCF Overview