COSO ERM, tie risk to strategy and performance
See how risk connects to goals, and give leadership a consistent view.
Official sources
Use these official places to read the text and find the latest version.
Get the document
The frameworks are sold by COSO. Executive summaries are free on the COSO site.
Open the official page ↗What COSO ERM is
COSO’s Enterprise Risk Management framework links risk to strategy and performance. It is widely used by boards, finance teams and auditors.
It sits next to COSO’s Internal Control framework, which underlies financial reporting controls.
How COSO ERM got to where it is today
The milestones that changed what organisations have to do.
Internal Control framework
COSO publishes its original internal control framework.
ERM framework
First enterprise risk management framework.
Internal Control update
Internal Control framework updated.
ERM updated
Reworked to link risk to strategy and performance.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
The board wants one view of risk.
You report on internal control.
Risk is managed in silos.
Strategy decisions ignore risk.
What it asks of you
The requirements fall into six areas.
Governance and culture
Tone from the top and risk culture.
Strategy and objectives
Link risk to goals.
Performance
Identify, assess and respond to risk.
Review and revision
Check changes and performance.
Information and communication
Report risk upward and outward.
Internal control link
Connect ERM with control.
COSO ERM: 5 components, 10 themes and 20 principles
COSO ERM ties risk management to strategy and performance. It has five components and twenty principles that take an organisation from governance and strategy through to reporting.
10 themes · 20 principles
GCGovernance and CultureSets the tone, oversight and values that shape how risk is handled.2 themes · 5 principles
GC-structOversight and structuresWho watches risk and how work is organised.2 principles
- Principle 1
The board exercises oversight of risk.
What you do
- Give a board or senior committee a standing risk agenda item
- Document its risk responsibilities
- Principle 2
Operating structures are set up to pursue strategy and objectives.
What you do
- Define reporting lines and risk roles
- Review the structure when the business changes
Evidence to keep
- Board or committee minutes
- Org chart with risk roles
- Reporting lines
GC-cultCulture and peopleDesired behaviour, values and talent.3 principles
- Principle 3
The desired culture is defined.
What you do
- Describe the risk attitudes you want
- Measure against them
- Principle 4
Commitment to core values is shown.
What you do
- Leaders model and enforce the code
- Address breaches visibly
- Principle 5
The organisation attracts, develops and keeps capable people.
What you do
- Include risk skills in hiring and training
- Plan succession for key roles
Evidence to keep
- Code of conduct
- Culture survey
- Training and hiring records
SOStrategy and Objective-SettingLinks risk appetite and context to strategy and business objectives.2 themes · 4 principles
SO-ctxContext and appetiteUnderstanding the setting and how much risk to take.2 principles
- Principle 6
Business context is analysed.
What you do
- Review market, regulatory and internal factors
- Update at planning cycles
- Principle 7
Risk appetite is defined.
What you do
- Set limits and thresholds in plain terms
- Get leadership approval
Evidence to keep
- Business context analysis
- Risk appetite statement
SO-stratStrategy and objectivesChoosing a strategy and setting goals with risk in mind.2 principles
- Principle 8
Alternative strategies are evaluated.
What you do
- Compare risk and reward of each option
- Record the reasoning
- Principle 9
Business objectives are formulated.
What you do
- Set measurable objectives within appetite
- Review the risk to each
Evidence to keep
- Strategy options analysis
- Objectives with risk notes
PFPerformanceIdentifies, assesses and responds to risks that could affect objectives.2 themes · 5 principles
PF-assessIdentify and assessFinding risks and judging how serious they are.3 principles
- Principle 10
Risk is identified.
What you do
- Run workshops and reviews to list risks
- Assign owners
- Principle 11
The severity of risk is assessed.
What you do
- Rate likelihood and impact on one scale
- Use data where possible
- Principle 12
Risks are prioritised.
What you do
- Rank by severity and appetite
- Focus resources on the top ones
Evidence to keep
- Risk register
- Severity ratings
- Prioritised risk list
PF-respRespond and portfolioChoosing responses and viewing risk as a whole.2 principles
- Principle 13
Risk responses are implemented.
What you do
- Choose and fund actions, such as accept, avoid, reduce or share
- Monitor results
- Principle 14
A portfolio view of risk is developed.
What you do
- Combine risks across units to see total exposure
- Report it to leadership
Evidence to keep
- Response plans
- Portfolio risk view
RRReview and RevisionChecks how well ERM works and adapts it as things change.2 themes · 3 principles
RR-changeChangeSpotting changes that affect risk.1 principle
- Principle 15
Substantial change is assessed.
What you do
- Trigger a risk review after acquisitions, new products or major incidents
- Update the register
Evidence to keep
- Change assessment notes
RR-improveReview and improvementChecking performance and getting better.2 principles
- Principle 16
Risk and performance are reviewed.
What you do
- Compare outcomes to targets and appetite
- Investigate gaps
- Principle 17
Improvement in enterprise risk management is pursued.
What you do
- Act on review findings
- Track improvements
Evidence to keep
- Performance reviews
- Improvement plan
ICInformation, Communication and ReportingGets the right risk information to the right people.2 themes · 3 principles
IC-infoInformation and technologySystems and data that support risk management.1 principle
- Principle 18
Information and technology are used to support ERM.
What you do
- Use a central register or tool
- Ensure data quality
Evidence to keep
- Risk data sources
- Tooling description
IC-repCommunication and reportingSharing risk information inside and outside.2 principles
- Principle 19
Risk information is communicated.
What you do
- Use set channels and timings
- Tailor messages to audiences
- Principle 20
The organisation reports on risk, culture and performance.
What you do
- Produce regular reports to leadership and the board
- Include culture and performance indicators
Evidence to keep
- Risk reports
- Communication plan
Nothing matches. Clear the search or pick another component.
Outcomes and implementation examples are from COSO Enterprise Risk Management: Integrating with Strategy and Performance (2017), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Set risk culture
Roles and appetite.
- 2
Link risks to objectives
Strategic and operational.
- 3
Assess and prioritise
Likelihood and impact.
- 4
Respond
Accept, reduce, share or avoid.
- 5
Report and review
Regularly to leadership.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Governance and culture | Policy management |
| Strategy and objectives | Objective-linked risk register |
| Performance | Risk register and treatment |
| Review and revision | Review cycles |
| Information and communication | Dashboards |
| Internal control link | Controls library |
Free COSO ERM readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Risk appetite statement
- Objective-linked risk register
- Board risk report
- Review calendar
Share or cite this page
Writing about COSO ERM? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/coso-erm/">COSO ERM explained in plain English - Optimus CyberX</a>Common questions
Is it required?
No. Listed companies often adopt it voluntarily.
ISO 31000 or COSO?
They are compatible. Pick the one your stakeholders know.
Can we certify?
No. There is no COSO certificate. You can adopt the framework and have an auditor or adviser review how you apply it.
Is it for non-US companies?
Yes. Although COSO is a US body, the frameworks are used internationally by boards, finance teams and auditors.
Related frameworks
See how ready you are for COSO ERM
Answer questions across every area. We email you a report showing where you comply and where you do not.