COSO ERM Framework: 5 Components and 20 Principles | growGRC
COSO ERM Framework
A practical guide to the COSO Enterprise Risk Management framework, covering its five components, 20 principles, risk appetite, risk responses, portfolio view, implementation, and GRC use.
Published: 8/20/2026Updated: 8/20/2026By growGRC Editorial Team
Executive Summary
COSO Enterprise Risk Management — Integrating with Strategy and Performance provides a structured approach for integrating risk with strategy and performance. Its five components and 20 principles help organizations connect governance, strategy, risk appetite, risk responses, portfolio view, review, and risk information with decision-making.
Key Takeaways
✓COSO ERM integrates risk management with strategy and performance.
✓The framework contains five interrelated components.
✓The five components are supported by 20 principles.
✓Risk appetite connects strategic choices and objectives with acceptable risk exposure.
✓A portfolio view helps management understand aggregate and interconnected risks.
✓COSO ERM can complement the COSO Internal Control Framework in a broader GRC program.
COSO ERM Framework
The COSO Enterprise Risk Management — Integrating with Strategy and Performance framework provides a structured approach for integrating risk with strategy and performance.
The framework helps organizations consider risk when setting strategy and objectives, executing plans, evaluating performance, and reviewing changes. It is broader than a control-only perspective because it places enterprise risk management within the context of governance, strategy, and organizational performance.
What is COSO ERM?
COSO ERM refers to the Enterprise Risk Management — Integrating with Strategy and Performance framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
The framework is designed to help organizations create, preserve, and realize value by integrating risk management with decision-making and performance.
COSO ERM is not a risk register, a single risk methodology, or a prescribed list of risk controls. It is a framework that organizations can adapt to their strategy, objectives, operating model, and risk profile.
Why COSO ERM matters
Risk is not limited to compliance or control failures. Strategic choices, operational decisions, market conditions, technology changes, people, third parties, and external events can all affect performance.
COSO ERM provides a common structure for considering these uncertainties alongside strategy and objectives.
This perspective can help management and boards:
Understand how risk affects strategy.
Consider risk when setting objectives.
Identify and assess risks that could affect performance.
COSO ERM is the Enterprise Risk Management — Integrating with Strategy and Performance framework developed by COSO to integrate risk with strategy and performance.
How many principles does COSO ERM have?
The COSO ERM framework is organized around five components supported by 20 principles.
What are the five COSO ERM components?
The five components are Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting.
What is risk appetite in COSO ERM?
Risk appetite expresses the types and amount of risk an organization is willing to accept in pursuit of its strategy and objectives and helps connect risk with decision-making.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
The COSO ERM framework is organized around five interrelated components:
1. Governance and Culture.
2. Strategy and Objective-Setting.
3. Performance.
4. Review and Revision.
5. Information, Communication, and Reporting.
These components are intended to operate together rather than as independent stages.
1. Governance and Culture
Governance establishes oversight responsibilities and organizational expectations for enterprise risk management.
This component addresses areas such as board risk oversight, operating structures, desired behaviors, commitment to core values, and accountability for risk.
Culture influences how people identify, discuss, escalate, and respond to risk.
Effective governance and culture help establish the foundation for integrating risk into organizational decision-making.
2. Strategy and Objective-Setting
Strategy and risk are closely connected.
Organizations consider risk profiles when evaluating strategic alternatives, define risk considerations associated with strategy, and establish business objectives that support the selected strategy.
Risk appetite provides an important connection between strategy and risk. It expresses the types and amount of risk an organization is willing to accept in pursuit of its objectives.
Risk appetite should inform objective-setting and decision-making rather than exist as a separate document with no operational connection.
3. Performance
The Performance component focuses on identifying and assessing risks that may affect the achievement of strategy and business objectives.
Organizations identify risks, assess their severity, prioritize relevant risks, and select responses.
Risk responses can include accepting, avoiding, pursuing, reducing, or sharing risks, depending on the circumstances and the organization's objectives and risk appetite.
The organization then develops a portfolio view of risk to understand how individual risks interact and how the overall risk profile may affect performance.
4. Review and Revision
Risk and strategy change over time.
The Review and Revision component supports evaluating changes and understanding how they affect the organization's risk profile and performance.
Organizations may review risk exposure after significant changes in strategy, objectives, operating conditions, technology, regulation, markets, or other relevant circumstances.
Lessons learned can be used to improve enterprise risk management and decision-making.
5. Information, Communication, and Reporting
Effective ERM depends on relevant information and communication.
Organizations need information that supports risk-informed decisions and reporting to management and the board.
Communication should help people understand objectives, risk appetite, significant risks, risk responses, changes in exposure, and matters requiring escalation.
Reporting should provide information at the appropriate level and frequency for decision-making and oversight.
The 20 COSO ERM principles
The five components are supported by 20 principles.
Governance and Culture
1. Exercises Board Risk Oversight.
2. Establishes Operating Structures.
3. Defines Desired Culture.
4. Demonstrates Commitment to Core Values.
5. Attracts, Develops, and Retains Capable Individuals.
Strategy and Objective-Setting
6. Analyzes Business Context.
7. Defines Risk Appetite.
8. Evaluates Alternative Strategies.
9. Formulates Business Objectives.
Performance
10. Identifies Risk.
11. Assesses Severity of Risk.
12. Prioritizes Risks.
13. Implements Risk Responses.
14. Develops Portfolio View.
Review and Revision
15. Assesses Substantial Change.
16. Reviews Risk and Performance.
17. Pursues Improvement in Enterprise Risk Management.
Information, Communication, and Reporting
18. Leverages Information and Technology.
19. Communicates Risk Information.
20. Reports on Risk, Culture, and Performance.
The principles provide a structured way to interpret the five components. They do not constitute a universal list of controls that every organization must implement identically.
COSO ERM and risk appetite
Risk appetite is a central concept in COSO ERM.
It helps connect strategic choices and business objectives with the amount and type of risk the organization is willing to accept.
A practical risk appetite process should be connected to decision-making. If risk appetite is documented but never used when evaluating strategy, investments, products, projects, or operational decisions, its value is limited.
Risk appetite can be expressed qualitatively, quantitatively, or through a combination of both approaches, depending on the organization's needs.
COSO ERM and risk responses
Risk responses should be selected in the context of objectives, risk appetite, and the organization's ability to create, preserve, or realize value.
Common response approaches include:
Accepting risk.
Avoiding risk.
Pursuing risk when it is associated with opportunity.
Reducing risk.
Sharing risk.
A response should be supported by appropriate accountability, actions, and monitoring.
COSO ERM and portfolio view
Individual risks do not always operate independently.
A portfolio view helps management consider relationships, concentrations, dependencies, correlations, and aggregate exposure across risks.
For example, multiple technology, third-party, cyber, operational, and regulatory risks may interact and create an aggregate exposure that is not apparent when each risk is reviewed separately.
A portfolio perspective can therefore improve strategic risk discussions and resource allocation.
COSO ERM and GRC
COSO ERM can provide a reference model for connecting enterprise risk management with broader GRC processes.
A GRC program can use the framework to establish traceability between:
Strategy.
Objectives.
Risk appetite.
Risks.
Risk responses.
Controls.
Owners.
Evidence.
Monitoring.
Reporting.
Remediation.
This does not mean every GRC process must use COSO terminology. The framework can serve as a reference structure while organizations retain their existing processes and taxonomies where appropriate.
COSO ERM vs. COSO Internal Control
COSO ERM and the COSO Internal Control — Integrated Framework are related but serve different primary purposes.
COSO ERM focuses on integrating risk with strategy and performance. It provides a broader enterprise risk management perspective.
COSO Internal Control focuses on the system of internal control and its ability to support objectives across operations, reporting, and compliance.
Organizations can use both frameworks together. ERM can provide the enterprise risk perspective, while internal control can provide a structure for designing and evaluating controls that address relevant risks.
Example: launching a new digital product
Suppose an organization is considering a new digital product.
At the strategy level, management evaluates the business context and strategic alternatives. Risk appetite helps define the boundaries for acceptable exposure.
The organization then identifies risks such as technology failure, cybersecurity, regulatory obligations, third-party dependency, customer adoption, and financial performance.
Management assesses the severity of those risks, prioritizes them, selects responses, and considers their aggregate effect as a portfolio.
Information and reporting support executive and board decisions. As the product and external environment change, the organization reviews risk and performance and revises its approach.
This illustrates how COSO ERM integrates risk into strategy and performance rather than treating risk management as a separate reporting exercise.
How to implement COSO ERM
A practical implementation can follow these steps:
1. Define the scope and organizational objectives.
2. Establish governance and risk oversight responsibilities.
3. Define or review the desired risk culture.
4. Connect strategy and objective-setting with risk considerations.
5. Define and operationalize risk appetite.
6. Identify and assess risks affecting strategy and objectives.
7. Prioritize risks and select appropriate responses.
8. Develop a portfolio view of significant risks.
9. Establish information, communication, and reporting processes.
10. Review changes in risk and performance.
11. Track improvement actions and lessons learned.
12. Integrate relevant ERM outputs into management and board decision-making.
Implementation should be proportionate to the organization's size, complexity, strategy, risk profile, and operating environment.
COSO ERM assessment
An ERM assessment should consider whether the five components and relevant principles are present and functioning and whether they operate together in an integrated manner.
An assessment may examine governance, strategy alignment, risk appetite, risk identification and assessment, response decisions, portfolio analysis, reporting, monitoring, and continuous improvement.
The objective should not be to produce a superficial checklist score. The assessment should help determine whether ERM is actually influencing decisions and performance.
Benefits of COSO ERM
A structured COSO ERM implementation can help organizations:
Integrate risk with strategy.
Improve risk-informed decision-making.
Clarify risk appetite and accountability.
Identify emerging and interconnected risks.
Strengthen portfolio-level risk analysis.
Improve communication with management and boards.
Connect risk information with performance.
Support continuous improvement in risk management.
Limitations
COSO ERM does not eliminate uncertainty and does not guarantee that objectives will be achieved.
Risk management depends on judgment, assumptions, information quality, organizational behavior, changing conditions, and the effectiveness of management decisions.
The framework should therefore be treated as a structured approach to managing uncertainty rather than as a guarantee or a rigid methodology.
Conclusion
The COSO ERM framework integrates enterprise risk management with strategy and performance.
Its five components and 20 principles provide a common structure for governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.
For GRC professionals, COSO ERM is particularly valuable when it is connected to strategy, risk appetite, risk responses, portfolio analysis, monitoring, reporting, and decision-making.
articleSIMILAR TO
COSO Internal Control vs. COSO ERM
A practical comparison of COSO Internal Control and COSO ERM, including their purposes, components, principles, GRC applications, differences, and how to use both frameworks together.
