New COSO ERM framework published to meet today’s demands

Last month, the committee of Sponsoring Organizations of the Treadway Commission (COSO) updated its enterprise risk management (ERM) framework to bring it up to date with changes in risk management and the business environment. We take a look at what the changes entail and how risk managers can use the new publication to better deliver for their organisations. COSO first published its Enterprise Risk Management – Integrated Framework back in 2004. The publication has gained broad acceptance, particularly in the US. But during the past decade, the complexity of risk has changed and new risks have emerged. Meanwhile, boards and executives have enhanced their awareness and oversight of ERM, and asked for improved risk reporting. Therefore, COSO said it needed to update its framework to address the evolution of ERM and the desire of organisations to improve their approach to risk management to meet the demands of an evolving business environment. The updated document, now titled Enterprise Risk Management – Integrating with Strategy and Performance, highlights the importance of considering risk in both the strategy-setting process and in driving performance. Enterprise Risk Management – Integrating with Strategy and Performance clarifies the importance of ERM in strategic planning and embedding it throughout an organisation. According to COSO, the update: Provides greater insight into the value of ERM when setting and carrying out strategy Enhances alignment between performance and ERM to improve the setting of performance targets and understanding the impact of risk on performance Accommodates expectations for governance and oversight Recognises the globalisation of markets and operations and the need to apply a common, albeit tailored, approach across geographies Presents new ways to view risk to setting and achieving objectives in the context of greater business complexity Expands reporting to address expectations for greater stakeholder transparency Accommodates evolving technologies and the proliferation of data and analytics in supporting decision-making Sets out core definitions, components and principles for all levels of management involved in designing, implementing and conducting ERM practices. In addition, the new framework aims to provide greater insight into the links between strategy, risk and performance. It attempts to more clearly connect ERM with a multitude of stakeholder expectations and position risk in the context of an organisation’s performance. COSO also says the framework will “enable organisations to better anticipate risk so they can get ahead of it”, and answers the call for a “stronger emphasis on how enterprise risk management informs strategy and its performance”. Part one of the updated publication offers a perspective on current and evolving concepts and applications of ERM. Part two – the framework – is organised into five components that accommodate different viewpoints and operating structures, as well as enhance strategies and decision-making. The five components of the framework and a description of each from COSO are listed below: 1) Governance and Culture: Governance sets the organisation’s tone, reinforcing the importance of, and establishing oversight responsibilities for, ERM. Culture pertains to ethical values, desired behaviours and understanding of risk in the entity. 2) Strategy and Objective-Setting: ERM, strategy and objective-setting work together in the strategic-planning process. A risk appetite is established and aligned with strategy; business objectives put strategy into practice while serving as a basis for identifying, assessing and responding to risk. 3) Performance: Risks that may impact the achievement of strategy and business objectives need to be identified and assessed. Risks are prioritised by severity in the context of risk appetite. The organisation then selects risk responses and takes a portfolio view of the amount of risk it has assumed. The results of this process are reported to key risk stakeholders. 4) Review and Revision: By reviewing entity performance, an organisation can consider how well the ERM components are functioning over time and in light of substantial changes, and what revisions are needed. 5) Information, Communication and Reporting: ERM requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down and across the organisation. COSO also points out that Enterprise Risk Management – Integrating with Strategy and Performance provides a framework for boards and management in organisations of all sizes. “If an organisation has a mission, a strategy and objectives – and the need to make decisions that fully consider risk – then enterprise risk management can be applied. It can and should be used by all kinds of organisations, from small businesses to community-based social enterprises to government agencies to Fortune 500 companies,” states the body. In the Enterprise Risk Management – Integrating with Strategy and Performance foreword, COSO writes that understanding risk and use of ERM have improved “greatly over the past few decades”, but adds that the “margin for error is shrinking”. It says that organisations need to be more adaptive to change. “They need to think strategically about how to manage the increasing volatility, complexity and ambiguity of the world, particularly at the senior levels in the organisation and in the boardroom where the stakes are highest,” says COSO. According to the foreword, management holds overall responsibility for managing risks. But COSO says management should also enhance conversation with the board and other stakeholders about “using enterprise risk management to gain competitive advantage”. This starts by deploying ERM capabilities as part of selecting and refining a strategy, COSO adds. COSO says that ERM has traditionally played a strong supporting role at board level, but notes that boards are now increasingly expected to provide ERM oversight. The new framework therefore supplies important considerations for boards in defining and addressing their risk oversight responsibilities. These considerations include governance and culture; strategy and objective-setting; performance; information, communications and reporting; and the review and revision of practices to enhance performance. COSO also used its Enterprise Risk Management – Integrating with Strategy and Performance foreword to clear up what it describes as a “few misconceptions” about its original ERM framework and the process in general. It says that ERM is not a function or department. “It is the culture, capabilities, and practices that organisations integrate with strategy-setting and apply when they carry out that strategy, with a purpose of managing risk in creating, preserving and realising value,” says COSO. Secondly, it says ERM is much more than a risk list. According to COSO, ERM requires more than taking an inventory of all the risks within the organisation. “It is broader and includes practices that management puts in place to actively manage risk,” says the body. Thirdly, COSO explains that ERM addresses more than internal control. “It also addresses other topics such as strategy-setting, governance, communicating with stakeholders, and measuring performance. Its principles apply at all levels of the organisation and across all functions,” says the body. Furthermore, COSO makes clear that ERM is not a checklist, but rather a set of principles on which processes can be built, along with a system of monitoring, learning and improving performance. COSO goes on to say that using ERM to consider the risks of a chosen strategy is only one aspect of the process. As its new framework emphasis, there are two additional aspects to ERM that can have far greater effect on an entity’s value: the possibility of the strategy not aligning and implications from the chosen strategy. “Enterprise risk management is as much about understanding the implications from the strategy and the possibility of strategy not aligning as it is about managing risks to set objectives,” says the body. RIMS has moved to back COSO’s updated ERM framework. “This revision highlights the importance and value of enterprise risk management when setting and carrying out an organisation’s strategy,” said Carol Fox, RIMS vice-president of strategic initiatives and a participant on COSO’s advisory council. “We appreciate COSO’s inclusiveness in seeking feedback from risk management professionals, and applaud our volunteer members who took advantage of this unique opportunity to influence one of risk management’s major guidance documents,” Ms Fox added. The foreword to COSO’s new framework also looks at four key trends that will impact ERM in the future. These are: 1. Dealing with the proliferation of data: As more and more data becomes available and the speed at which new data can be analysed increases, ERM will need to adapt. The data will come from both inside and outside the entity, and it will be structured in new ways. Advanced analytics and data visualisation tools will evolve and be very helpful in understanding risk and its impact – both positive and negative. 2. Leveraging artificial intelligence and automation: Many people feel that we have entered the era of automated processes and artificial intelligence. Regardless of individual beliefs, it is important for ERM practices to consider the impact of these and future technologies and leverage their capabilities. Previously unrecognisable relationships, trends and patterns can be uncovered, providing a rich source of information critical to managing risk. 3. Managing the cost of risk management: A frequent concern expressed by many business executives is the cost of risk management, compliance processes and control activities in comparison to the value gained. As ERM practices evolve, it will become important that activities spanning risk, compliance, control and even governance be efficiently coordinated to provide maximum benefit to the organisation. This may represent one of the best opportunities for ERM to redefine its importance to the organisation. 4. Building stronger organisations: As organisations become better at integrating ERM with strategy and performance, an opportunity to strengthen resilience will present itself. By knowing the risks that will have the greatest impact on the entity, organisations can use ERM to help put in place capabilities that allow them to act early. This will open up new opportunities. “In summary, enterprise risk management will need to change and adapt to the future to consistently provide the benefits outlined in the framework. With the right focus, the benefits derived from enterprise risk management will far outweigh the investments and provide organisations with confidence in their ability to handle the future,” concludes COSO. The new COSO framework was developed by PwC and can be purchased from: www.coso.org

New COSO ERM framework published to meet today’s demands

Want to read this article?

Read Next

Vast majority of global wind and solar energy assets unprotected from fire

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

Intangible asset value higher than tangible but protection gap persists

Marsh launches AI-powered supply chain solution

New terrorism facility launched by Evolin Broking, backed by Chaucer

Vast majority of global wind and solar energy assets unprotected from fire

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

Intangible asset value higher than tangible but protection gap persists

Marsh launches AI-powered supply chain solution

New terrorism facility launched by Evolin Broking, backed by Chaucer

Want to read this article?

Read Next

Vast majority of global wind and solar energy assets unprotected from fire

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

Intangible asset value higher than tangible but protection gap persists

Marsh launches AI-powered supply chain solution

New terrorism facility launched by Evolin Broking, backed by Chaucer

Related Articles