Green Gooey Company is evaluating all of its internal control processes. Betty Webit, the controller, believes that overall the processes are fairly decent, but she is concerned that there is a lack of integration between the internal control structure and Green Gooey’s enterprise risk management (ERM) system. She turns to you, a forensic accountant, for advice on how to integrate the ERM system with internal controls.
What type of general advice might you give to Betty Webit? How might ERM and the internal control structure be integrated at the organization level? Should the same person be in charge of both? What are some ERM considerations that are not directly relevant to internal control?