3.3 COSO Enterprise Risk Management (ERM) Framework

COSO (Committee of Sponsoring Organizations of the Treadway Committee). The COSO standard, like the ISO 31000 standard previously discussed, is not a mandatory requirement by an organization seeking to build a risk management offering. The COSO 2017 definition of risk has moved away from its more traditional roots by stating that risk is “the possibility that events will occur and affect the achievement of strategy on business objectives.” When comparing it to the ISO 31000:2018 definition of risk, both definitions lean towards the uncertainty of risk and its effect on objectives with the goal of implementing an effective risk management offering in an organization. The effects could have an upside or a downside on the objectives of the organization.

Traditionally, the COSO ERM Framework was almost exclusively used by the financial sector due to its focus on financial reporting, audit, and compliance. The COSO ERM Framework, which was introduced in 2017, uses an intertwining double helix in the form of a ribbon-like rainbow instead of a cube known as the COSO ERM cube.

The update was deemed necessary to address the changing business landscapes and failures and to integrate an organization’s risks with its strategies. There are five components for successful enterprise risk management that can be applied to an organization’s mission and core values:

1. Governance and Culture: oversight from the top down.
2. Strategy and Objective Setting: activities related to related to risk appetite and performance
3. Performance: risk assessment and risk responses to address risks that could adversely affect the organization’s performance.
4. Review and Revision: review the performance of ERM in the organization and make changes where necessary.
5. Information, Communication and Reporting: communicating the effect of ERM on the organization using information obtained from inside and outside the organization.

There are 20 principles across the five components stated above that have a relationship with each of the components. The COSO ERM Framework is connected to the organization by the components and the principles in the 2017 model. The interrelated components and principles in the form of a double helix are the DNA of a COSO ERM Framework, allowing an organization to manage risks and drive performance while maximizing value.