COSO ERM framework
The COSO Enterprise Risk Management framework provides a structured approach to integrating risk with strategy and performance. Its 2017 version has five components covering governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting, supported by 20 principles. This framework differs from COSO’s Internal Control—Integrated Framework and from the earlier 2004 ERM cube. The edition and purpose must be clear when describing components.
Worked example
A board uses the framework to examine whether its chosen growth strategy matches risk appetite, whether managers evaluate the combined exposure and whether changing conditions trigger review. It does more than assign likelihood and impact scores to individual events.
Common mistake
Do not describe ERM as merely a likelihood-impact matrix or combine the 2004, 2013 internal-control and 2017 ERM component lists.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | SBL | Supporting | September 2026–June 2027 |