Management needs to comprehensively identify risks and should consider all significant interactions between the entity and other parties as well as internal factors at both the entitywide and activity level.
The risks must be identified comprehensively by management.
A common theme among the CIOs we interviewed was that the message of the importance of IT to the organization must be communicated at the highest levels.