Enterprise Risk Management
Featured Case Studies
FFIEV Based IT Control Framework
After initial analysis and consultation with the client, CapTech re-wrote the institutions control framework to not only reflect the regulatory changes instituted by FFIEC but also to create a sustainable control referencing system and document reference repository for the institution to use in future compliance efforts...
Sarbanes-Oxley Compliance
Performing user surveys, data analysis and using open design principles, CapTech developed a comprehensive solution that met the requirements for SARBOX and resolved internal audit findings...
CapTech’s Enterprise Risk Management (ERM) service offering helps clients develop an integrated, consistent method for the management of risk. Depending on organization size, culture, and risk appetite or tolerance, we work with clients to establish and tailor a risk management program appropriate for their situation. Our ERM offering includes four major services that can be leveraged independently or collectively to address, mitigate, and manage risk:
Risk Assessment
Focus on identification, evaluation, and prioritization of enterprise risk based on extensive experience working with the most accepted frameworks such as COSO, CobiT, ITIL, ISO17799, and FFIEC. We help clients document process level controls, identify the key controls over these processes and perform risk analysis.
Risk Response
Focus on the identification and implementation of mechanisms to address business risk by improving controls and/or upgrading information systems.
Communication and Reporting
Focus on the distribution or risk and risk response information throughout an organization. We help clients establish a common language for stakeholders to use in order to make informed decisions about risk exposure.
Risk Monitoring
Focus on helping clients identify and implement processes that methodically track risk management activities as well as identify new risks as they arise. We help clients determine which critical risks should be monitored and how monitoring and reporting activities can be optimally managed.