Evaluation of Risk Management Implementation Readiness in A Medium-Sized Enterprise: The Case of PT XYZ

This study aims to evaluate PT XYZ’s readiness to implement risk management. Theevaluation is based on the “Learn” component of the GRC Capability Model and the“Governance and Culture” component of the COSO ERM 2017 framework. PT XYZprovides integrated security system products in Indonesia and falls within mediumsized enterprise category. Over the next three years, the company intends to expand.However, it must first ensure that it is ready to implement risk management. Theliterature review focuses on the GRC Capability Model, which is linked to COSO ERM2017. An interview and observation process was used to collect the data and factsrequired to conduct the assessment. These were then analyzed using the “Learn”component of the GRC Capability Model. While the basic findings of the study indicatethat PT XYZ is ready to implement risk management, several areas also requireimprovement, as mentioned in the conclusion.