Skip to content
The Tell
← Internal controls & ICFR

Framework · COSO

Enterprise Risk Management framework

COSO's 2017 framework that links enterprise risk management to strategy and performance.

Go to the official source ↗

Our summary

COSO’s enterprise risk management framework, updated in 2017, shows how organisations can manage risk as part of setting strategy and measuring performance — not as a separate compliance exercise.

It complements COSO’s Internal Control framework: internal control focuses on reliable operations, reporting and compliance, while ERM looks at risk across the whole organisation and its strategy.

How auditors use it: to assess the maturity of an organisation’s risk management, and to align the internal audit plan with the risks that matter most to strategy.

More in Internal controls & ICFR

Achieving Effective Internal Control over Sustainability Reporting (ICSR)

Shows how to apply the 17 COSO internal control principles to ESG and sustainability data, so it can be trusted and assured like financial data.

Corporate Governance Regulations (Saudi Capital Market Authority)

The Saudi rules that require listed companies to have a board-approved internal control system, an internal audit unit and an independent audit committee.

Internal Control — Integrated Framework

The most widely used framework for designing and evaluating internal control, including over financial reporting.