GB921R Enterprise Risk Management R16.5.1

This publication focuses on the further development of the first version of GB921R published in 2015 to elaborate on the topic of Enterprise Risk Management (ERM). Enterprise Risk Management provides some of the key support functions for any telco operator. It spans across topics of security management, audit (compliance) management and ITIL service delivery processes. The range of these topics concern most, if not all, core operational processes of an organization.

The aim of this document is to use the eTOM framework for Enterprise Risk Management and create standardized process flows for Enterprise Risk Management. The current level of expansion available within eTOM is Level 2 breakdown. The following sections will elaborate on the effort to decompose the level 2 framework into the level 3 view of Enterprise Risk Management, detailed descriptions and generic process workflows.

The first release of this document included only the process Enterprise Risk Management process overviews and decompositions without any workflows. The workflows were reviewed, revised and included as a part of this release of Enterprise Risk Management appendix to eTOM; in order to introduce a standard for developing ERM business processes. The workflows are intentionally designed to avoid providing any technical and operational details which ensures maximum re-usability. They should, however, deliver concrete definition of process steps and clear interfaces towards other organizational processes. The process workflows can deliver the following benefits to operators:

• Blueprints for developing their own customized risk management processes
• Understanding of the methodology for using eTOM provided components for construction of business processes in general
• Interactions between core eTOM processes and Enterprise Risk Management processes.