Organizations can experience serious financial and/or reputational losses if business activities are disrupted by an incident of information systems under the current business environment. The loss includes the intangible decline in brand image, customer separation, and the tangible loss such as decrease in business profits. Thus, it is necessary to take proactive initiatives by managing many kinds of risks an organization may have. Therefore, the enterprise risk management has been received a special attention by some advanced private companies, but not many public organizations. This paper describes an approach and some issues when the enterprise risk management was introduced in a domestic public organization.