FFIEC IT Examination Handbook AIO-II.A.2: II.A.2 Enterprise Risk Management (Architecture, Infrastructure, and Operations)

Management implements an enterprise risk management structure that incorporates AIO with a consistent, current review of products, processes, applications, infrastructure, interconnectivity and related risks, and maintains a risk management process for all AIO activities including outsourced ones that assesses AIO risk initially, designs architecture to business goals with alignment, integration, change management and performance in view, uses infrastructure and implementation processes that support strategy, identifies critical infrastructure assets and interconnectivity, monitors changes in risk and updates the assessment, documents roles, procedures and reporting, and defines risk tolerances and risk and performance metrics.