Everyone in an entity has some responsibility for enterprise risk management. The chief
executive officer is ultimately responsible and should assume ownership.
Other managers support the entity’s risk management philosophy, promote compliance with its risk appetite,
and manage risks within their spheres of responsibility consistent with risk tolerances.
A risk officer, financial officer, internal auditor, and others usually have key support responsibilities.
Other entity personnel are responsible for executing enterprise risk management in
accordance with established directives and protocols.
The board of directors provides important oversight to enterprise risk management, and is aware of and concurs with the entity’s risk appetite. A number of external parties, such as customers, vendors, business
partners, external auditors, regulators, and financial analysts often provide information useful
in effecting enterprise risk management, but they are not responsible for the effectiveness of,
nor are they a part of, the entity’s enterprise risk management.