Which business area in the enterprise risk management (ERM) strategy is concerned with formal risk assessments when forming new or renewing existing…

The procurement department is fundamentally responsible for the entire lifecycle of vendor and supplier relationships, from initial sourcing and vetting to contracting, performance management, and renewal. Within an Enterprise Risk Management (ERM) framework, conducting formal risk assessments is a critical due diligence step managed by procurement. This process evaluates potential financial, operational, compliance, and security risks associated with a third party before entering into or renewing a business relationship. This function is central to managing an organization's supply chain and third-party risk exposure, making it the correct business area concerned with these formal assessments.

A. Software development: This area focuses on creating and maintaining software; while they may assess a vendor's technology, they do not own the formal business relationship or its overall risk assessment.

C. Quality assurance: This function tests whether a vendor's product or service meets predefined quality standards, which is only one component of a comprehensive risk assessment.

D. Marketing: This department is focused on promotion and sales and is not involved in the formal risk assessment or management of procurement and vendor relationships.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication (SP) 800-39

Managing Information Security Risk. Section 2.3

"Risk Management and the System Development Life Cycle

" explicitly lists "Acquisition/Procurement" as a key phase where risk management activities

including assessments

are essential for managing risks associated with externally provided systems and services.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management — Integrating with Strategy and Performance. Principle 14

"Assesses Substantial Change

" emphasizes that organizations must assess risks arising from significant changes

including new or changing business partners (vendors). The procurement function is the primary owner of the due diligence process for these relationships. (See Component: Review and Revision

Page 59).

3. Hallikas

J.

Karvonen

I.

Pulkkinen

U.

Virolainen

V. M.

& Tuominen

M. (2004). Risk management processes in supplier networks. International Journal of Production Economics

90(1)

47-58. This academic paper details the risk management process in supply chains

highlighting that risk assessment is a core part of the supplier selection and procurement process. (Section 3

"A framework for risk management in supplier networks"). https://doi.org/10.1016/j.ijpe.2004.02.007