Request a demo
Risks
🕑 15 minutos de lectura

What is the COSO model and how does it help manage risk?

Written by

Departamento de Consultoría
. Consulting Department, GlobalSuite Solutions.
Talk to an expert

What is the COSO model?

COSO (Committee of Sponsoring Organizations of the Treadway Commission) is a US-based organisation made up of private-sector bodies, set up to provide organisations with a common model of guidance on core aspects of:

  • executive management and governance,
  • business ethics,
  • internal control,
  • enterprise risk management,
  • fraud control, and
  • financial reporting.

How the COSO model has evolved

1992: publication of the Internal Control – Integrated Framework (the COSO Report or COSO I), an integrated framework to help companies assess and improve their internal control systems.

2004: publication of COSO ERM (Enterprise Risk Management – Integrated Framework), or COSO II, which helps companies improve internal control through a more complete risk management process.

2013: publication of COSO III, an update of the 1992 internal control framework.

2017: publication of COSO ERM 2017 (Enterprise Risk Management – Integrating with Strategy and Performance), which broadens the risk management framework to cover more of the risks organisations face and links it directly to strategy and performance.

The components and principles of internal control (COSO 2013)

The 2013 internal control framework (Internal Control – Integrated Framework) is the reference for internal control over financial reporting, for example under the SOX Act. It organises internal control into five components and seventeen principles. For the system to be considered effective, all five components have to be present, functioning and operating together; the principles explain what each one means in practice.

Control environment5 principles
  1. 1Integrity and ethical values
  2. 2Independent board oversight
  3. 3Structure, authority and responsibility
  4. 4Commitment to competence
  5. 5Accountability
Risk assessment4 principles
  1. 6Clear, specific objectives
  2. 7Risk identification and analysis
  3. 8Fraud risk
  4. 9Significant change
Control activities3 principles
  1. 10Control activities that reduce risk
  2. 11General controls over technology
  3. 12Policies and procedures
Information and communication3 principles
  1. 13Relevant, quality information
  2. 14Internal communication
  3. 15External communication
Monitoring activities2 principles
  1. 16Ongoing or separate evaluations
  2. 17Evaluating and communicating deficiencies
Source: COSO, Internal Control – Integrated Framework (2013). Principle names shortened.

If what you need is a framework for risk management across the whole organisation, beyond internal control, the reference is COSO ERM 2017, covered below.

The five components and twenty principles of COSO ERM 2017

COSO ERM 2017 groups its twenty principles into five components. The principles are the practical checklist for seeing what the organisation already has in place and what is missing.

Governance and culture5 principles
  1. 1Board risk oversight
  2. 2Operating structures
  3. 3Desired culture
  4. 4Commitment to core values
  5. 5Attracting, developing and retaining talent
Strategy and objective-setting4 principles
  1. 6Analysing business context
  2. 7Defining risk appetite
  3. 8Evaluating alternative strategies
  4. 9Formulating business objectives
Performance5 principles
  1. 10Identifying risk
  2. 11Assessing severity
  3. 12Prioritising risks
  4. 13Implementing risk responses
  5. 14Portfolio view of risk
Review and revision3 principles
  1. 15Assessing substantial change
  2. 16Reviewing risk and performance
  3. 17Improving risk management
Information, communication and reporting3 principles
  1. 18Using information and technology
  2. 19Communicating risk information
  3. 20Reporting on risk, culture and performance
Source: COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017). Principle names shortened.

Components of the COSO ERM model

The five components of COSO ERM 2017 work together to integrate risk management with strategy and performance:

01 Governance and Culture Oversight, ethical values and operating structure.
02 Strategy and objective-setting Risk appetite aligned with strategy.
03 Performance Identify, assess and respond to risks.
04 Review and revision Ongoing monitoring and improvement over time.
05 Information and communication Information flowing across the organisation.
Governance and Culture and Information and communication act as a cross-cutting foundation that supports the three central components throughout the process.

{sc} Governance and Culture

The organisation must reinforce the importance and understanding of its risk management, set the oversight responsibilities needed to carry it out and define the ethical values to follow.

The main actions are:

  • Have the Board of Directors approve a policy for overseeing the organisation’s risk.
  • Establish the operating structure.
  • Define the desired culture and values.
  • Senior management must show its commitment to core values, for example by setting up committees and collective bodies to monitor compliance with them.
  • Attract, develop and retain capable people.

{sc} Strategy and objective-setting

A strategic planning process that defines enterprise risk management, the strategies and working objectives, and sets a risk appetite aligned with them.

To carry out this block, the organisation must:

  • Analyse the business context.
  • Define the risk appetite.
  • Evaluate the strategies to pursue.
  • Formulate the business objectives.

{sc} Performance

This involves identifying and assessing the risks that may affect the achievement of business objectives. Risks are prioritised by severity in line with the defined risk appetite. The organisation then selects its risk responses and checks how much risk it has taken on.

This component includes:

  • Identifying risks.
  • Assessing the severity of each risk identified.
  • Identifying, selecting and implementing risk responses.

{sc} Review and revision

When reviewing performance, the organisation checks how its enterprise risk management is working over time and, in light of any substantial changes, decides which reviews or changes are needed.

The review covers:

  • Assessing the relevant changes that have taken place.
  • Reviewing risks and the performance achieved in managing them.
  • Pursuing improvement in risk management.

{sc} Information, communication and reporting

Enterprise risk management needs an ongoing process of obtaining and sharing the necessary information, from both internal and external sources. Communication has to flow up and down across the whole organisation.

This component requires:

  • Supporting risk management with systems and technology.
  • Using appropriate communication channels.
  • Reporting on risk, culture and performance to all stakeholders.

What is the ERM methodology for enterprise risk management?

Enterprise risk management (ERM, Enterprise Risk Management) is a plan-based business strategy that aims to identify, assess and prepare for any risk or event that could affect an organisation’s operations and objectives, positively or negatively.

The aim of ERM is to assess the risks that matter to the company (financial, strategic and operational), prioritise them and make informed decisions about how to handle them. The risk management plans it produces estimate the impact of various threats and describe the possible responses if one of them materialises.

An effective ERM process should be an important strategic tool for business leaders. The risk insights that come out of ERM should be a major input to the organisation’s strategic plan.

Because risks constantly emerge and evolve, it is important to understand that ERM is a process that has to stay active and alive, with ongoing updates and improvements.

The structure of the enterprise risk management framework applies regardless of the size of the organisation or how it chooses to categorise its risks, and it is designed to help management and boards handle the following main aspects properly:

  • Identifying all the risks that may affect strategy and business operations, and how they relate to each other.
  • The acceptable level of risk.
  • How to manage risks (culture, governance and policies).
  • How to obtain the information needed to manage risks.
  • How to control risks.
  • How to measure and assess the different risks.
  • How to respond to risks.
  • Which tests of the response to adverse scenarios are most suitable.

One of the main models developed for effective enterprise risk management (ERM) today is the COSO ERM 2017 model.

Benefits for organisations

– It helps you better understand how to manage risk and the role it plays in choosing the best strategies to pursue.

– It lets you set objectives that link performance and integrated enterprise risk management to increase the company’s profitability.

– It provides universal guidelines on corporate governance and oversight.

– It helps you recognise the new context created by the globalisation of the economy and the need to adapt to the changes and complexity of the business world.

– It is a basis for broadening knowledge of risk management and meeting the expectations of directors and other stakeholders.

– It is compatible with the development and use of new information and communication technologies (ICT), and their application to data handling and decision-making.

COSO ERM in 2026: towards a more strategic ERM

The reference framework is still COSO ERM 2017, but COSO has continued to publish complementary guidance worth knowing about, because it shows where risk management practice is heading:

  • From guidance to action (2026): in May 2026, COSO published From Guidance to Action: Exploring Practical Enterprise Risk Management, a paper aimed at strengthening the strategic relevance and real impact of ERM programmes. One telling figure from its global survey: although 98% of practitioners believe ERM should play a more strategic role, only 7% say it is fully integrated into their strategic decisions. So the challenge is no longer what ERM is, but how to make it work day to day.
  • Alternative data (2024): the guidance Alternative Data: The COSO Perspective looks at how to bring non-traditional data sources (social media analytics, IoT sensors, web scraping or ESG indicators) into ERM without introducing unacceptable risks around data quality, privacy or bias.
  • AI governance: artificial intelligence is the emerging risk category that ERM has to take on board (model risk, data governance, bias and shadow AI). COSO’s principles-based approach fits well with complementary frameworks such as the NIST AI RMF.

The takeaway for organisations is clear: the value of COSO ERM is not in documenting it but in using it as a decision-making tool that connects risk, strategy and performance.

How GlobalSuite Solutions can help

At GlobalSuite Solutions we have GlobalSuite® software, developed entirely by our team, which lets you implement, manage and maintain a Risk Management System based on the objectives you have set. It also lets you assess and track the treatment of the risks defined, helping you take COSO ERM from theory to day-to-day operations.

Want to see how it would work in your organisation? Request a demo and we will show you.

Share:

Departamento de Consultoría
. Consulting Department, GlobalSuite Solutions.

Explore more

Tabla de contenidos