COSO ERM implementation for strategy set with the risks already priced in.

What it is

What is COSO ERM and what is it used for?

COSO ERM is the enterprise risk management framework published by COSO, the Treadway Commission's committee formed by five professional associations: the American Accounting Association, the AICPA, Financial Executives International, the Institute of Management Accountants and The Institute of Internal Auditors. COSO describes enterprise risk management as the culture, capabilities and practices, integrated with strategy-setting and performance, that organisations rely on to manage risk in creating, preserving and realising value.

Its central idea is placement. Risk is considered when the strategy is chosen and when objectives are set, then again as performance is managed, rather than collected in a register after the decisions have been made. Boards use it to structure risk oversight, executives to test strategic options against the organisation's appetite, and internal audit to evaluate whether risk management works. This page covers the ERM framework; COSO's Internal Control—Integrated Framework has its own Sterling page.

Current edition. Enterprise Risk Management—Integrating with Strategy and Performance, issued by COSO in 2017, replaced the Enterprise Risk Management—Integrated Framework of 2004. COSO has since added applied guidance built on it, on topics including risk appetite, compliance risk, cyber risk and ESG-related risks. No revision of the 2017 framework has been announced. Because the framework carries no certificate, there is no transition period to manage; a new edition would mean a review of your programme, not a new audit.

Who it is for

Who needs COSO ERM?

No certificate hangs on COSO ERM, so the reason to adopt it is always a governance need. Organisations come to Sterling for COSO ERM from four starting points:

• The board wants risk oversight it can defend. Directors are asked how they oversee risk and what appetite they set, and a list of top ten risks no longer answers the question. The framework gives the board a structure for its own role and for what it expects from management.
• A lender, investor or major customer asks how you manage risk. Due diligence questionnaires and tender documents increasingly ask for an enterprise risk management framework by name. You need a programme that stands up to follow-up questions, not a policy written the week before.
• A regulator or supervisor expects enterprise-wide risk management. Financial services, public bodies and listed companies often face supervisory expectations for risk governance. Sterling builds the programme and works alongside your legal advisers on what your jurisdiction requires.
• The group needs one risk language across companies. Subsidiaries score risk differently, report on different calendars and escalate on different triggers. COSO ERM gives the parent one set of components and principles that every entity applies in proportion to its size.

What you gain is a board and executive that discuss risk and strategy in the same meeting. That depends on leadership using the programme, not on the framework document alone.

Requirements

What are the main COSO ERM requirements?

COSO ERM sets out five interrelated components and twenty principles. They are principles, not clauses: COSO does not prescribe forms, scales or a methodology, and each organisation decides how to apply them in proportion to its size and complexity. The list below maps each component and its principles in plain language; your programme is checked against the framework principle by principle during the gap analysis.

• Governance and Culture: board risk oversight, operating structures, the desired culture, commitment to core values, and attracting, developing and retaining capable individuals.
• Strategy and Objective-Setting: analysing the business context, defining risk appetite, evaluating alternative strategies and formulating business objectives.
• Performance: identifying risk, assessing its severity, prioritising risks, implementing risk responses and developing a portfolio view of risk across the organisation.
• Review and Revision: assessing substantial change, reviewing risk and performance together, and pursuing improvement in enterprise risk management.
• Information, Communication and Reporting: using information and technology, communicating risk information, and reporting on risk, culture and performance.

Implementation route

How do you implement COSO ERM?

There is no certification route: you build the programme, operate it and then evaluate it. Sterling supports the design and the first cycle; the board owns the result, and any independent opinion comes from your internal audit function or a reviewer you choose.

1. 01
   Agree what the programme must cover.Confirm the entities, strategic decisions and reporting lines in scope, what the board expects, and any lender, regulator or group requirement behind the work.
2. 02
   Gap analysis: compare current practice with the twenty principles.Existing risk registers, committee charters, appetite statements and reports are assessed component by component; what works is kept and actions, owners and dates are agreed.
3. 03
   Set governance, culture and appetite.The board's oversight role, the operating structure and a risk appetite statement are agreed with leadership, then tied to strategy-setting and business objectives.
4. 04
   Run the performance cycle.Risks are identified and assessed for severity with the people who own them, prioritised against appetite, given responses and rolled up into a portfolio view.
5. 05
   Report, review and revise.The first risk and performance report reaches the board; internal audit or management evaluates whether the programme operated as designed, and substantial changes trigger reassessment. Sustain™ supports each later cycle.

Check what you are being offered before you sign. COSO runs no certification scheme for organisations, so a "COSO ERM certified" certificate for your company is a document of the seller's own making. COSO's ERM Certificate Program is training for individuals, not a verdict on an organisation. Ask instead who in your leadership will own the risk appetite, how the portfolio view will be produced and what will still run when the consultant leaves. The certification buyer's checklist

Cost

How much does COSO ERM implementation cost?

A single company refreshing an existing risk process needs far less than a group building enterprise risk management across several countries for the first time. The fee follows the work, and a Sterling proposal shows every part of it.

Timeline

How long does COSO ERM implementation take?

The pace is set less by documents than by decisions. Appetite and oversight roles need board approval, and the programme proves itself only when one full cycle, from assessment to a board report, has run. As an estimate, most programmes take four to nine months to that point, depending on scope and how quickly leadership decides.

If a lender, regulator or annual report sets the date, tell us at the outset and we will say what is realistic and which decisions must come early.

Your engagement

What your COSO ERM engagement includes

Sterling delivers the programme through the Sterling OS™ phases. You choose one level of support: Design™, where we guide and your team does the work, or Drive™, where we manage the build with your people. After the first cycle, Sustain™ keeps evaluations and reassessments on schedule, and Automate™ is Effivity, the software the programme runs on. Sterling does not certify, attest, validate or accredit.

• Scope, gap analysis and programme plan

  Principle-by-principle findings, with owners, dates and decision points agreed before work starts.

• Governance and appetite design

  Board and committee roles, the operating structure and a risk appetite statement drafted with your leadership.

• Effivity ISO & GRC software

  Your risk register, responses and reports run in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for the people who will evaluate the programme, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• The first performance cycle

  Facilitated risk assessments, prioritisation against appetite, responses and the first portfolio view.

• Board reporting and evaluation

  The first risk and performance report, and an evaluation of the programme with the gaps closed on evidence.

The framework is owned by your board and management; no certificate is issued by anyone.

Often combined with

Standards organisations pair with COSO ERM

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.
• ISO 22316ISO 22316 implementation for organisational resilience: gap analysis against the principles and attributes, board evaluation, Effivity.