Apply COSO ERM Framework

The need for structured enterprise risk management grew out of a series of spectacular corporate failures and financial scandals that shook investor confidence in the late twentieth and early twenty-first centuries. Before these events, most organizations treated risk management as a siloed compliance exercise—individual departments managed their own risks without an overarching strategic lens. The collapse of companies like Enron and WorldCom, coupled with the broader financial upheavals of the early 2000s, underscored a critical gap: organizations lacked a unified framework for identifying, assessing, and responding to risks that cut across functional boundaries and threatened strategic objectives. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) had already established credibility with its 1992 Internal Control—Integrated Framework. Recognizing that internal control alone was insufficient to address the full spectrum of enterprise risks, COSO developed a broader framework specifically focused on Enterprise Risk Management (ERM). This initiative aimed to provide boards of directors, C-suite executives, and risk professionals with a common language, a structured methodology, and a set of principles for integrating risk considerations into strategy-setting and performance management.

The central question the COSO ERM Framework addresses is both strategic and operational: How can an organization systematically integrate risk considerations into its strategy-setting process and day-to-day performance management to create, preserve, and realize value? Unlike narrower compliance-oriented approaches, the 2017 framework positions enterprise risk management as a discipline inseparable from governance, strategy, and organizational culture. For CPA candidates preparing for the ISC exam, understanding how to apply this framework is essential because it represents the prevailing standard for evaluating whether an entity's risk management practices are robust, integrated, and aligned with its mission and vision.

The 2017 COSO ERM Framework is structured around five interrelated components supported by 20 principles. These components move from the broadest governance considerations down to the granular activities that operationalize risk management. Rather than viewing ERM as a bolt-on compliance function, the framework treats it as a thread woven through the fabric of governance, strategy, objective-setting, and performance. Each component builds upon the preceding one, forming a logical cascade from board-level oversight to operational execution. Understanding these components and their associated principles is the foundational knowledge required to apply the framework in practice.

The 2017 COSO ERM Framework deliberately moved away from the three-dimensional cube model of the 2004 version, adopting instead a set of intertwined ribbons (often depicted as a double-helix or cascading flow) to emphasize that the five components are not separate silos but rather continuously interacting processes. The diagram below illustrates how mission, vision, and core values sit at the top of the framework, channeling into strategy development, business objective formulation, and ultimately enhanced organizational value. Each component nests within the next, and the entire system is bounded by the entity's governance structure and information flows.

As visible in the diagram, the framework begins with Governance & Culture (the widest band), which sets the tone for the entire enterprise. The narrowing bands emphasize that as the organization moves from governance to strategy to performance to review, each level operates within boundaries set by the level above. Information, Communication & Reporting runs throughout the entire structure, serving as the nervous system that connects every component. A critical insight for CPA candidates is that these components are not sequential steps performed once; they are iterative processes that continuously inform and adjust one another as the organization's internal and external environments evolve.

Three interconnected concepts form the quantitative backbone of COSO ERM: risk appetite, risk tolerance, and risk capacity. Risk capacity represents the maximum amount of risk an entity can absorb before threatening its viability—it is constrained by financial resources, regulatory limits, and operational capabilities. Risk appetite is the broad amount and type of risk the entity is willing to accept in pursuit of value; it is established by the board and management as part of the Strategy & Objective-Setting component. Risk tolerance defines the acceptable variation in performance around specific business objectives. These three concepts form a hierarchy: capacity sets the outer boundary, appetite operates within capacity, and tolerance translates appetite into operational guardrails for individual objectives.

In practice, the Performance component operationalizes these concepts through a structured process: the entity first identifies risks that could affect the achievement of each business objective; then it assesses severity by evaluating impact and likelihood; next it prioritizes risks by comparing their severity against risk appetite; it then selects appropriate risk responses (accept, avoid, pursue, reduce, or share); and finally it develops a portfolio view of risk to understand how individual risks interact and aggregate across the entity.

The 20 principles are the operational heart of the COSO ERM Framework. They translate the five components into specific, actionable expectations that auditors and management can evaluate. For CPA candidates, understanding these principles is essential because audit engagements frequently assess whether an entity's ERM practices satisfy each principle. The following table maps every principle to its parent component and highlights the core requirement. Note that the numbering is sequential (1–20) across all five components.

When evaluating an entity's ERM maturity, auditors assess whether each of the 20 principles is present (the principle exists within the entity's ERM processes) and functioning (the principle is operating as intended). A principle may be present but not functioning if, for example, a risk appetite statement exists on paper but management routinely exceeds it without board review. Conversely, some organizations demonstrate functioning principles informally even without explicit documentation—though for entities subject to regulatory scrutiny, documentation is generally expected. The ISC exam may present scenarios requiring you to determine which principle is deficient based on described circumstances.

Consider a mid-size regional bank, Greenfield Bancorp, that is evaluating whether to expand into commercial real estate lending. The bank's CRO has been tasked with applying the COSO ERM Framework to assess this strategic decision. Walk through the following worked example to see how each component and selected principles come into play.

Like any governance framework, COSO ERM has notable strengths that have driven its widespread adoption, as well as limitations that organizations and auditors should recognize. Understanding both dimensions is critical for CPA candidates because exam scenarios may require you to evaluate whether COSO ERM is the most appropriate framework for a given situation, or whether its implementation has been compromised by inherent constraints.

The COSO ERM Framework does not exist in isolation. It intersects with and complements several other governance and risk management frameworks that CPA candidates should understand. The most commonly compared frameworks include the COSO Internal Control—Integrated Framework (2013), ISO 31000 Risk Management, and COBIT (for IT governance). Understanding the distinctions helps in selecting the right tool for the right context and in recognizing how these frameworks can be layered within a single organization.

In advanced practice, organizations often layer these frameworks. For example, a publicly traded U.S. company might use the COSO Internal Control Framework to satisfy SOX Section 404 requirements, the COSO ERM Framework to manage enterprise-wide risks at the strategic level, and COBIT to govern IT-specific risks. The ISC exam may test your ability to recognize which framework addresses a given scenario and whether the entity has appropriately scoped its use of each framework. Looking ahead, emerging topics such as ESG (Environmental, Social, and Governance) risk, cyber risk, and climate-related financial disclosures are increasingly being mapped to COSO ERM principles—making this framework more relevant than ever to the evolving CPA profession.