COSOERM

COSOERM is a proposed framework that seeks to unify the COSO internal control model with enterprise risk management (ERM) practices into a single, coherent standard for governance, risk, and compliance. It aims to align internal control objectives with strategic risk management, enabling organizations to manage risk in pursuit of objectives while ensuring reliable reporting and accountability.

Origins and purpose: COSOERM emerged from professional discussions in the 2020s about harmonizing internal control and ERM to support better decision-making and governance. It is not an official COSO publication, but it draws on COSO’s published concepts and ERM literature to offer an integrated approach that can be adopted by diverse organizations, including private companies, public institutions, and nonprofits.

Structure and components: The framework is described as comprising interrelated components that link strategy, risk, and control activities. Core areas typically highlighted include governance and culture; strategy and objective-setting; risk identification and assessment; risk response and treatment; control activities and information, communication and reporting; and monitoring and assurance. The model emphasizes alignment with risk appetite, ongoing monitoring, and iterative improvement to adapt to changing objectives and external conditions.

Implementation and use: Organizations considering COSOERM typically begin by mapping existing control and risk processes to the framework, conducting a gap analysis, and designing an integrated program that covers governance, accountability, and documentation. Practical guidance focuses on defining roles, establishing governance structures, and embedding the ERM lifecycle into planning, execution, and reporting cycles.

Reception and considerations: COSOERM is discussed as a useful concept for achieving greater coherence between internal control and risk management. Critics note potential complexity and overlap with existing COSO and ERM resources, while supporters view it as a clarifying, adaptable approach to integrated governance.