A supervisor claims enterprise risk management is simply buying enterprise antivirus. What corrects that claim?
Select an answer to reveal the explanation.
Short Explanation
Antivirus is one lock on one door. ERM is the whole building plan—strategy, money, ops, and hazard risks—so calling a software buy “enterprise risk management” sells the job way short.
Full Explanation
Enterprise risk management encompasses a broad portfolio of risk types that can affect objectives—strategic, operational, financial, and hazard exposures among them—not a single IT product purchase. Correcting the claim that ERM is simply buying enterprise antivirus restores scope: antivirus may be one control for cyber hazard, but it does not constitute ERM for a civic enterprise.
Limiting ERM to cybersecurity tools excludes operational, strategic, and financial risks leadership still faces. Treating antivirus licensing of every laptop as full ERM satisfaction confuses endpoint hygiene with enterprise risk governance. Claiming ERM applies only after antivirus fails so tool purchase is the entire program by design inverts prevention and collapses the discipline into one product lifecycle.
Exam caveat: ERM ≠ one security SKU. CRMC awareness items often test breadth versus tool myopia.
Operational check: inventory risk categories in the enterprise register; confirm strategic and operational items exist alongside technology hazards; treat antivirus as a control entry, not the ERM program charter. In ERM charters, list risk categories explicitly and name antivirus or similar tools only under technology controls. Correct any slide that equates endpoint licensing with enterprise risk management.