1. IRS Enterprise Risk Management (ERM)
September 2015

2. ERM
The IRS’s approach to ERM is based on the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management – Integrated Framework.
The COSO ERM Framework consists of eight interrelated components. These are derived from the way management runs its organization and are integrated with the management process. These components include:
Internal Environment
Objective Setting
Event Identification
Risk Assessment
Risk Response
Control Activities
Information and Communication
Monitoring
Objectives
Components
Levels
Source: COSO. Enterprise Risk Management – Integrated Framework – Executive Summary Framework. September 2004.

3. Overview of ERM at the IRS
IRS Risk Management Standards
A set of standards is being followed in implementing risk management within each of the IRS’s business units. Risk Management is the responsibility of all employees at all levels of the organization and this concept is being considered in the design and implementation of processes and mechanisms for the identification, discussion and decision, and documentation of risks.
Category Standards
Processes to support the identification of risks and to participate in enterprise-wide risk assessments
Mechanism to assign ownership for risks identified
Risk Identification
Mechanisms to assess risks in a timely manner once identified, including, at a minimum, assessment of likelihood and impact, on both an inherent and residual basis
Processes to obtain coverage of risk information in both the short term and long term for significant business processes
Risk Assessment
Mechanism to consider and select appropriate risk responses, including avoiding, accepting, mitigating, and transferring risk in accordance with the established risk appetite
Mechanism in place to consider and respond to risks, including consideration of interdependencies on other units
Identification of risk owner to ensure accountability and responsibility for risk response
Risk Response
Process to compile and report through chain of command risks that are identified as having a potential unit-wide impact
Process to compile and report to the CRO risks that are identified as having a potential enterprise-wide impact
Defined reporting lines for risk information
Risk Reporting
Processes to monitor risks, which may include leveraging Key Risk Indicators (KRIs)
Mechanism to monitor risk responses/mitigations and effectiveness of responses/mitigations
Mechanism to escalate risks
Monitoring and Escalation
Processes to discuss risk information as part of management or governance meetings and decision making
Processes to facilitate cross-functional / divisional discussion with stakeholders where applicable
Mechanism to communicate expectations of management to follow-up on risks and identify risks across units
Method to document risk information, either in unit or process level risk registers or other documents
Information and Communication