Contents
Where COSO comes from
COSO (the Committee of Sponsoring Organizations of the Treadway Commission) is a joint initiative of US professional bodies in auditing, accounting and finance. It published its first internal control framework in 1992, revised in 2013, followed by its first enterprise risk management framework in 2004, completely overhauled in 2017.
The definition
COSO defines enterprise risk management as the culture, capabilities and practices, integrated with strategy-setting and its execution, that organisations rely on to manage risk in creating, preserving and realising value.
Three ideas follow from this: risk is managed at the point where strategy is chosen, not only afterwards; culture matters as much as procedures; and the goal is value, not the absence of risk.
The 5 components and 20 principles
| Component | Principles |
|---|---|
| Governance and culture | 1. The board exercises risk oversight · 2. The organisation establishes operating structures · 3. It defines desired culture · 4. It demonstrates commitment to core values · 5. It attracts, develops and retains capable individuals |
| Strategy and objective-setting | 6. It analyses business context · 7. It defines risk appetite · 8. It evaluates alternative strategies · 9. It formulates business objectives |
| Performance | 10. It identifies risk · 11. It assesses severity of risk · 12. It prioritises risks · 13. It implements risk responses · 14. It develops a portfolio view |
| Review and revision | 15. It assesses substantial change · 16. It reviews risk and performance · 17. It pursues improvement in enterprise risk management |
| Information, communication and reporting | 18. It leverages information and technology · 19. It communicates risk information · 20. It reports on risk, culture and performance |
COSO ERM or COSO Internal Control?
The two frameworks are complementary:
- COSO Internal Control (2013) aims to provide reasonable assurance over three categories of objectives: operations, reporting and compliance. It rests on five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
- COSO ERM (2017) is broader: it integrates risk into the strategy and performance of the entire organisation.
Internal control is therefore one part of the risk management framework, not a synonym for it.
Applying COSO to compliance
In 2020, COSO and the SCCE published guidance that applies each of the 20 principles to compliance risk management. It shows that an effective compliance and ethics programme is not a standalone function: it is embedded in governance, strategy and performance measurement. See building a compliance culture.
Where to start in a Moroccan company
- Start from strategy: list the three to five major objectives for the year.
- Identify the risks that threaten each of them, together with operational staff.
- Assess and prioritise these risks by severity and likelihood.
- Define the risk appetite and have it approved by senior management or the board. See risk appetite.
- Choose the responses (accept, reduce, transfer, avoid) and appoint an owner for each risk.
- Report regularly to the board, with a handful of key indicators.
Further reading
- 3 min read
- 3 min read
- 3 min read
Frequently asked questions
How many principles does COSO ERM have?
The 2017 COSO ERM framework has twenty principles, grouped into five components: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.
What is the difference between COSO ERM and COSO Internal Control?
COSO Internal Control (2013) aims to provide reasonable assurance over operations, reporting and compliance. COSO ERM (2017) is broader and links risk management to the strategy and performance of the whole organisation.
Is COSO mandatory in Morocco?
No, it is a voluntary framework. It is, however, widely used by auditors, banks and large companies, and it helps meet the expectations of the governance codes and sector regulators.
General information, not legal advice.
Report an errorReferences (2)
- COSO (2017). Enterprise Risk Management — Integrating with Strategy and Performance.
- COSO (2013). Internal Control — Integrated Framework.