The COSO ERM Framework: 5 Components and 20 Principles Explained

The COSO ERM framework, Enterprise Risk Management: Integrating with Strategy and Performance, tells boards and executives how to manage risk as part of setting and executing strategy. COSO published it on 6 September 2017. It has five components and 20 principles: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting. It is not the COSO internal control framework, and confusing the two is the most common mistake made about it.

COSO ERM vs. COSO internal control

COSO publishes two frameworks. Both have five components, which is why people confuse them, but they answer different questions.

Internal control is one part of enterprise risk management. ERM decides which risks to take; internal control makes sure the processes that carry those risks work as designed.

What COSO is

COSO is the Committee of Sponsoring Organizations of the Treadway Commission. Five organizations sponsor it: the American Accounting Association, the AICPA, Financial Executives International, The Institute of Internal Auditors and the Institute of Management Accountants.

The 2004 framework's eight components were internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring. The 2017 update replaced the cube with five components built around the life of a strategy, from setting it to reviewing it.

The five components and 20 principles

1. Governance and culture

Governance sets the tone and assigns oversight; culture shapes how people treat risk every day.

1. Exercises board risk oversight
2. Establishes operating structures
3. Defines desired culture
4. Demonstrates commitment to core values
5. Attracts, develops and retains capable individuals

2. Strategy and objective-setting

Risk enters the strategy before it is approved, not after.

1. Analyzes business context
2. Defines risk appetite
3. Evaluates alternative strategies
4. Formulates business objectives

Principle 8 is the heart of the 2017 framework: compare the risk profile of each strategic option, not only the risks of the option already chosen. See our guide to risk appetite.

3. Performance

The risk process most people picture: identify, assess, prioritize, respond.

1. Identifies risk
2. Assesses severity of risk
3. Prioritizes risks
4. Implements risk responses
5. Develops portfolio view

The portfolio view (principle 14) looks at risks together, so the board sees concentrations and offsets a list of single risks hides. See top strategies to prioritize risk.

4. Review and revision

The organization checks whether its ERM still fits the business.

1. Assesses substantial change
2. Reviews risk and performance
3. Pursues improvement in enterprise risk management

5. Information, communication and reporting

Risk information reaches the people who decide, in time to matter.

1. Leverages information and technology
2. Communicates risk information
3. Reports on risk, culture and performance

How to apply the framework

1. Assess against the 20 principles. Rate each principle as present and functioning, partly in place or missing. The gaps become the plan.
2. Start with strategy, not the register. Bring risk into the next strategy and budget cycle (principles 6 to 9). A risk register built apart from strategy stays apart from it.
3. Set risk appetite in plain words and numbers. The board approves it; management translates it into tolerances for each objective.
4. Build the portfolio view. Map the top risks against objectives, and show the board the few that could move the plan. A risk heat map or an enterprise risk map helps here.
5. Report risk with performance. Put key risk indicators in the same report as key performance indicators.
6. Give the board assurance. Internal audit tests whether the principles work; an assurance map shows who covers what.

Common mistakes

• Treating COSO ERM as a controls exercise. That is the internal control framework. ERM starts with strategy.
• Running ERM as an annual register update. The 2017 framework asks for risk in decisions all year.
• Setting risk appetite in adjectives. "Low appetite for compliance risk" guides no one. Name the measure and the limit.
• Reporting risks without objectives. A risk matters only by what it does to an objective.

COSO ERM vs. ISO 31000

Both describe enterprise risk management. ISO 31000 (2018) is a short international standard with principles, a framework and a process, written for any organization. COSO ERM is longer, written for boards and executives, and tied to strategy and performance. Many organizations use ISO 31000's process inside COSO's governance structure.

Frequently asked questions

What does COSO stand for?

The Committee of Sponsoring Organizations of the Treadway Commission.

What are the five components of COSO ERM?

Governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.

What are the 17 principles of the COSO framework?

The 17 principles belong to the internal control framework (2013), not to ERM. The ERM framework (2017) has 20 principles, listed above.

Is COSO ERM mandatory?

No. No law requires it. Many boards adopt it voluntarily, and auditors and regulators often use it as a benchmark.

Does COSO ERM replace the 2004 framework?

Yes. The 2017 framework supersedes the 2004 Enterprise Risk Management: Integrated Framework.

Further reading

• COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017)
• COSO, Compliance Risk Management: Applying the COSO ERM Framework
• The best risk management and ERM books
• Risk management dictionary