COSO ERM: Risk, Strategy and Performance
COSO ERM connects risk management with strategy and performance, helping leaders discuss objectives, uncertainty, appetite and response in an integrated way.
Key Takeaways
- ✓Links risk with strategy, objectives and performance.
- ✓Distinguishes governance oversight from management activities.
- ✓Tailor appetite and responses to context; do not apply a generic tolerance to every decision.
- ✓Connect risk assessments with monitoring and learning.
- ✓COSO ERM complements, but does not replace, an internal control system.
Purpose
COSO ERM helps connect risk oversight and management to strategy choices and the achievement of objectives. Its approach links governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.
GRC use
It can structure enterprise-level discussions about risk appetite, accountability, prioritization and response. Practical use should connect decisions and objectives with scenarios, assessments and monitoring rather than reducing the work to an isolated risk register.
Boundaries
It does not prescribe one solution or guarantee outcomes. Adapt it to context and use it alongside applicable sector and regulatory obligations.
Putting it into practice
Start with a concrete strategic decision and state the outcomes sought, uncertainties that could affect them and who has authority to respond. Compare exposures with leadership-approved appetite, identify signals that could change the assessment and agree how exceptions will be escalated. Maintain traceability among objectives, scenarios, responses, owners and indicators.
Illustrative example
A company considering entry into a new market could test the opportunity against supply, regulatory and operational-capacity risks. COSO ERM can make assumptions visible and connect responses to the decision and its monitoring; it does not make the decision for leadership or remove uncertainty.
Adoption sequence
1. Clarify the objective or strategic decision in scope and who is accountable for it.
2. Define risk criteria and appetite approved by the appropriate governing bodies; document assumptions and boundaries.
Frequently asked questions
Is COSO ERM a certifiable standard?
Do not present it as a management-system certification; it is a management framework organizations adapt.
How does it differ from COSO ICIF?
ERM focuses on integrating risk with strategy and performance; ICIF structures internal-control design and assessment.
Should one risk appetite apply to every risk?
Not necessarily. Leadership should contextualize criteria and tolerances around objectives, decisions and exposure.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Related Content
COSO Enterprise Risk Management: A Practical Guide to the ERM Framework
Practical guide to COSO Enterprise Risk Management, its five components, strategy connection, implementation, measurement, and GRC integration.
Open FAIR: Quantifying Information Risk for Decisions
An overview of the Open FAIR taxonomy and quantitative risk analysis, including loss-event frequency, loss magnitude, uncertainty and decision use.