A practical guide to COSO Risk Assessment, its four principles, risk lifecycle, fraud risk, change, evidence, and GRC application.
Published: 8/24/2026Updated: 8/24/2026By growGRC Editorial Team
Executive Summary
Risk Assessment connects objectives, risks, responses, and controls so the organization can understand and manage uncertainty affecting objective achievement.
Key Takeaways
✓Risk Assessment contains four COSO principles: suitable objectives, risk identification and analysis, fraud risk, and significant change.
✓Risk assessment should connect objectives to risks and controls.
✓Fraud risk and significant change require explicit consideration.
✓Risk scores should use documented and consistent criteria.
✓GRC traceability should connect objectives, risks, controls, evidence, assessments, deficiencies, and remediation.
COSO Risk Assessment
Risk Assessment is one of the five components of the COSO Internal Control — Integrated Framework. It provides the process through which an organization identifies and analyzes risks to achieving its objectives and determines how those risks should be managed.
Effective risk assessment connects objectives, risks, risk responses, and internal controls. It should be dynamic enough to consider changes that may affect the organization's ability to achieve its objectives.
Why Risk Assessment matters
An organization cannot design effective controls without understanding the objectives those controls are intended to support and the risks that could prevent those objectives from being achieved.
A mature Risk Assessment process helps an organization:
Define objectives clearly enough to identify relevant risks.
Identify risks that could affect objective achievement.
Analyze risks according to their significance.
Consider fraud risk.
Identify and assess changes that could affect the system of internal control.
Link risk assessment results to control design and monitoring.
Risk assessment is therefore more than maintaining a risk register. It is a structured process for understanding uncertainty in relation to objectives.
The four COSO Risk Assessment principles
The Risk Assessment component contains four principles.
Principle 6 — Specifies suitable objectives
The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to those objectives.
Objectives provide the reference point for risk assessment. If an objective is vague, it becomes difficult to determine what could prevent its achievement and whether the resulting controls are appropriate.
Objectives should be considered across relevant categories, including operations, reporting, and compliance, as applicable to the organization's circumstances.
In a GRC program, objectives can be linked to strategic objectives, business process objectives, financial and operational reporting objectives, compliance obligations, technology and information objectives, and control objectives.
Principle 7 — Identifies and analyzes risk
The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how they should be managed.
Risk identification should consider internal and external factors and the organization's relevant activities, processes, technologies, dependencies, and operating environment.
Risk analysis commonly considers likelihood, magnitude or impact, velocity or timing where relevant, existing risk responses and controls, interdependencies, and risk appetite or tolerance.
The purpose is not to produce a mathematically perfect score. The purpose is to support informed decisions about risk responses and controls.
Principle 8 — Assesses fraud risk
The organization considers the potential for fraud in assessing risks to the achievement of objectives.
Fraud risk assessment should consider incentives and pressures, opportunities, rationalizations, and other circumstances that could create or increase fraud exposure.
Relevant areas can include financial reporting, procurement, payments, revenue, access to assets or systems, management override, conflicts of interest, and third-party relationships.
GRC evidence may include fraud risk assessments, fraud scenarios, anti-fraud controls, investigation records, whistleblower mechanisms, and management review activities.
Fraud risk should not be treated as a separate exercise disconnected from enterprise and process risk assessment.
Principle 9 — Identifies and analyzes significant change
The organization identifies and assesses changes that could significantly impact the system of internal control.
Changes can originate internally or externally. Examples include organizational restructuring, new products or services, mergers and acquisitions, leadership changes, new regulations, new technologies, cloud migrations, supplier changes, and significant business-process changes.
A change assessment should determine whether existing objectives, risks, controls, information flows, responsibilities, and monitoring activities remain appropriate.
Risk Assessment lifecycle
A practical GRC lifecycle is:
Objectives → Risk Identification → Risk Analysis → Risk Response → Control Design → Control Assessment → Monitoring → Change
This lifecycle should be iterative rather than treated as a once-a-year administrative exercise.
1. Establish objectives
Start with clear objectives. The objective establishes what the organization is trying to achieve.
2. Identify risks
Identify events or conditions that could prevent, delay, distort, or otherwise affect achievement of the objective.
3. Analyze risks
Evaluate the significance of identified risks using criteria appropriate to the organization.
4. Determine risk responses
Determine whether risks should be avoided, reduced, transferred, accepted, or addressed through another appropriate response.
5. Link risks to controls
Where controls are required, establish traceability between the risk and the control designed to address it.
6. Assess control effectiveness
Evaluate whether controls are appropriately designed and operating effectively.
7. Monitor and reassess
Monitor changes in risk, control performance, incidents, findings, and the operating environment.
Risk Assessment in a GRC operating model
A GRC platform should preserve relationships among:
This traceability allows organizations to answer which objectives are exposed to a specific risk, which controls address the risk, what evidence supports the control, which controls have deficiencies, which remediation actions reduce exposure, and what changes could invalidate the existing assessment.
Risk records should contain sufficient context to explain the rationale behind the assessment, not only a score.
Risk scoring
Organizations often use likelihood and impact to prioritize risks.
A simplified model is:
Inherent Risk = Likelihood × Impact
Where appropriate, organizations may separately evaluate residual risk after considering risk responses and controls.
Risk scoring should be supported by documented criteria. A score without defined methodology can create false precision and make assessments difficult to compare.
GRC implementations should distinguish at least between inherent risk, risk response, residual risk, risk appetite or tolerance, and risk acceptance.
Risk Assessment and control design
Risk assessment should inform control design.
For example, if a risk is unauthorized privileged access, the organization may determine that controls are needed for approval, provisioning, periodic review, monitoring, and timely removal.
The control should be linked to the risk it addresses, while evidence should demonstrate that the control operated as intended.
This creates a traceable chain:
Objective → Risk → Control → Evidence → Assessment
Change management
Principle 9 makes change an explicit part of Risk Assessment.
A GRC program should establish triggers for reassessment, such as new or changed regulations, material process changes, major technology implementations, significant incidents, organizational changes, new products or markets, and material changes in third-party dependencies.
A change should not automatically invalidate an existing control, but it should trigger an assessment of whether the current risk and control assumptions remain valid.
Common implementation mistakes
Treating the risk register as the entire Risk Assessment process
A risk register is a useful record, but Risk Assessment also requires clear objectives, analysis, fraud considerations, and change assessment.
Scoring risks without methodology
Likelihood and impact scores should be based on documented criteria and consistently applied.
Ignoring fraud risk
Fraud can arise from different incentives, opportunities, and management behaviors than ordinary operational risks. It requires explicit consideration.
Performing Risk Assessment only once a year
Annual cycles can provide structure, but significant changes and events may require reassessment throughout the year.
Failing to connect risks to controls
A risk assessment becomes much more useful when risk-to-control relationships are explicit and traceable.
Confusing risk with a control deficiency
A risk describes potential impact on an objective. A control deficiency describes a weakness in the design or operation of a control. They are related but not interchangeable.
Evidence for assessing Risk Assessment
Principle
Example evidence
6. Suitable objectives
Strategic objectives, process objectives, reporting objectives, compliance objectives
Change assessments, project reviews, regulatory impact assessments, technology-change records
The evidence should support both the process and the resulting conclusions.
Conclusion
COSO Risk Assessment provides the foundation for understanding what could prevent an organization from achieving its objectives and for determining how those risks should be managed.
Its four principles address suitable objectives, risk identification and analysis, fraud risk, and significant change. In a GRC environment, these principles are most effective when they are connected through traceability from objectives to risks, controls, evidence, assessments, deficiencies, and remediation.
article
SUPPORTS
COSO Risk Control Matrix: A Practical Guide
A practical guide to building and maintaining a COSO-aligned risk control matrix that connects objectives, risks, controls, evidence, owners, testing, and deficiencies.
