Enterprise Risk Assessment Survey November 2019 Question Title * 1. How often does your organization monitor its identified enterprise risks? (check all that apply) Weekly Monthly Quarterly Annually We do not review our risks Question Title * 2. How does your organization review these risks? (check all that apply) Ad hoc review (e.g. Google searches, review industry publications) Set up regular alerts (e.g. Google alerts, Law firm alerts) Assign ownership to various team members Use a third party monitoring service We do not review our risks Other (please specify) Question Title * 3. How do you know when a risk has changed enough to communicate a new development? Question Title * 4. How does your organization share this information? (check all that apply) Email Package in report or PowerPoint Present at regular risk committee meetings Enter into dedicated risk management software platform Other (please specify) Question Title * 5. What would trigger a change to your mitigation plans? Question Title * 6. Who receives an update on significant developments to identified risks? (check all that apply) Board CEO Executive team Business unit heads Other (please specify) Question Title * 7. What metrics do you use to measure the ROI of your program? Question Title * 8. (Optional) Tell me about your ideal toolset for monitoring and reporting on the risks you manage. Question Title * 9. (Optional) If you would be open to further discussing the tools that RANE is developing to enable ongoing support of your ERM program, please leave your contact details below. Name Company Email Address Phone Number Done