The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework for risk management, often referred to as the Enterprise Risk Management (ERM) framework, is a widely respected and applied model for assessing and managing risks in business.
Objective Setting: Defining clear objectives as a prerequisite to risk identification.
- Event Identification: Recognizing internal and external events affecting the achievement of an entity's objectives.
- Risk Assessment: Analyzing risks in terms of likelihood and impact.
- Risk Response: Deciding how to address risks (avoid, accept, reduce, share).
- Control Activities: Actions to mitigate risk to acceptable levels.
- Information and Communication: Ensuring relevant information is identified, captured, and communicated.
- Monitoring: Ongoing or separate evaluations to ensure controls are functioning as intended.
- Internal Environment: Setting the basis for how risk is viewed and addressed by an organization’s people.
- Entity-Level Controls: Controls that operate across an organization.
- Preventive Controls: Designed to deter the occurrence of an undesirable event.
- Detective Controls: Designed to discover undesirable events that have already occurred.
- Corrective Controls: Actions to repair effects of a realized risk event.
- Strategic Objective Alignment: Aligning risk appetite and strategy.
- Performance Management: Using risk management in performance improvement.
- Risk Appetite: The amount of risk an organization is willing to accept in pursuit of its objectives.
- Risk Tolerance: The acceptable level of variation in performance relative to the achievement of objectives.
- Portfolio View: Managing risk in the aggregate.
- Emerging Risks: Identifying and managing risks that are new or evolving.
- Scenario Analysis: Analyzing hypothetical events that could significantly impact the organization.
- Risk Culture: The organization’s norms and behaviors related to risk management.
- Board of Directors: Oversight role in risk management.
- Risk Management Policy: Guidelines and policies to manage risk.
- Compliance Risk: Risks associated with legal or regulatory sanctions, financial loss, or damage to reputation.
- Operational Risk: Risks arising from internal processes, people, and systems or external events.
- Financial Risk: Exposure to financial losses.
- Technology Risk: Risks associated with failed or inadequate information technology.
- Human Resources Risk: Risks related to the employment and management of people.
- Market Risk: Risk of losses in on- and off-balance sheet positions arising from movements in market prices.
- Credit Risk: Risk of loss from a borrower’s or counterparty’s failure to meet contractual obligations.
- Risk Concentration: Instances where a high level of risk is concentrated in a particular area.
- Quantitative Analysis: Using numerical methods to assess risk.
- Qualitative Analysis: Using subjective judgment based on non-quantifiable information to assess risk.
- Business Continuity Planning: Preparing to maintain or restore business processes in the event of disruption.
- Crisis Management: Preparing and managing a crisis to protect an organization’s reputation and value.
- Sustainability Risk: Risk associated with environmental, social, and governance factors.
- Reputation Risk: Risk of damage to the public standing of an organization.
- Legal Risk: Risks from lawsuits or non-compliance with laws.
- Tax Risk: Risks associated with taxation issues.
- Foreign Exchange Risk: Risks associated with changes in foreign exchange rates.
- Interest Rate Risk: Risk from variability in interest rates.
These concepts are foundational to implementing a robust risk management process by the COSO framework, aiming to manage uncertainty and enhance the capacity to build value.