COSO'S ENTERPRISE RISK MANAGEMENT FRAMEWORK

The Committee of Sponsoring Organisations of the Treadway Commission (COSO) was established in the mid-1980s, initially to sponsor research into the causes of fraudulent financial reporting. Its current mission is to: 'help organizations improve performance by developing thought leadership that enhances internal control, risk management, governance and fraud deterrence.'

COSO

Although COSO's guidance is non-mandatory, it has been influential because it provides frameworks against which risk management and internal control systems can be assessed and improved. Corporate scandals, arising in companies where risk management and internal control were deficient, and attempts to regulate corporate behaviour as a result of these scandals have resulted in an environment where guidance on best practice in risk management and internal control has been particularly welcome.

The ERM model

COSO originally created an enterprise risk management (ERM) model in 1992 which was shaped like a pyramid and focused on the evaluation of existing controls. This was updated in 2013 to the COSO cube, which focused on the design and implementation of a risk management framework. The COSO cube became a widely-accepted framework for organisations to use and it became established as a model that could be used in different environments worldwide.

COSO intended the cube to illustrate the links between objectives that are shown on the top and the eight components shown on the front, which represent what is needed to achieve the objectives. The third dimension represents the organisation's units, which portrays the model's ability to focus on parts of the organisation as well as the whole.

There are a number of issues under each of the eight components listed on the front of the cube that organisations have had to tackle - issues which can be featured in exam questions for the Strategic Business Leader (SBL) exam.

Internal environment

The internal environment establishes the tone of the organisation, influencing risk appetite, attitudes towards risk management and ethical values.