Consistent risk management principles
ISO 31000
When comparing the ISO 31000 and the COSO ERM frameworks, we see that both emphasize consistent core principles of risk management. These principles guide organizations in developing, implementing, and practicing risk management processes to their specific needs. For example, from ISO 31000 we can extract eight principles of risk management to apply to our organizations:
- Risk management should be integrated into the organization’s governance structure and activities, including strategic planning and decision-making processes.
- The approach to risk management should be structured and comprehensive to ensure consistency and reliability in managing risks while covering all aspects of risk management, from governance to reporting.
- The risk management model should be customized to fit the organization’s internal and external needs while aligning with its strategy, objectives, and risk appetite.
- Risk management leaders should involve various stakeholders to consider diverse perspectives and expertise and promote active participation in the risk management process to enhance understanding and commitment.
- Risk management should be a dynamic process responsive to change, ensuring that risks are continuously identified, assessed, and managed as the risk landscape evolves.
- Risk-based decisions should be based on the best available information, including empirical data, experience, stakeholder feedback, and expert judgment.
- Risk management leaders should recognize the influence of human behavior, implicit bias, and cultural factors on all aspects of risk management.
- Risk management practices should continually improve through learning and experience to respond to emerging risks and evolving business environments.
COSO ERM Framework
The COSO ERM framework emphasizes the same general risk management principles organized under five interrelated components: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication, and Reporting.
In terms of Governance and Culture, the COSO ERM framework emphasizes the importance of board oversight, where the board of directors actively monitors risk management and ensures it aligns with the organization’s goals. Establishing clear operating structures is crucial so everyone within the organization understands their responsibilities in managing risk. A risk-aware culture should be promoted, aligning with the organization’s values and objectives. Leadership’s commitment to ethical values and integrity is essential for fostering a culture that effectively manages risk. Additionally, attracting and retaining capable individuals with the necessary skills and knowledge is vital for handling risks appropriately.
Regarding Strategy and Objective-Setting, the organization must consider internal and external factors to understand its operating environment and identify potential risks. Defining the organization’s risk appetite — how much risk it is willing to take to achieve its goals — is critical. Evaluating alternative strategies helps in understanding how different approaches might affect risk exposure. Setting clear, achievable business objectives that align with the overall strategy and risk appetite ensures that risk management is an integrated part of strategic planning.
In the Performance component, the organization identifies risks that could impact its objectives through various methods to uncover potential issues. Management assesses the severity of these risks based on their likelihood and potential impact to gauge prioritization. The organization then decides how to respond to these risks by avoiding, accepting, reducing, or sharing the risk and takes appropriate actions. Developing a comprehensive view allows management to understand how different risks interact and affect the organization.
Review and Revision involve identifying and evaluating significant changes in the business environment that could impact the organization’s risk profile and objectives. Regular reviews assess how well risks are being managed and whether objectives are being met. Continuous improvement is encouraged, with the organization constantly seeking ways to enhance its risk management processes and capabilities.
Finally, in the Information, Communication, and Reporting component, the organization leverages information systems and technology to support risk management, ensuring that relevant data is collected and communicated effectively. Clear communication channels are established so that important risk information is shared with stakeholders in a timely manner. Reporting on risk management activities, cultural aspects, and performance provides transparency and accountability to stakeholders.
Adhering to these risk management principles allows organizations to integrate risk management into their core operations, decision-making, and culture. This comprehensive approach helps organizations effectively manage risks, make informed decisions, and ultimately achieve their strategic objectives in the face of emerging risks.
