1. Introduction to the Technique
The COSO Enterprise Risk Management (ERM) Framework is a strategic tool that helps organizations identify, assess, manage, and monitor risks to achieve their objectives. Internal auditors often use the COSO ERM model to evaluate how well risk management is embedded within the company’s culture, operations, and decision-making. The 2017 updated COSO ERM framework focuses on integrating risk with strategy and performance, making it highly relevant during the risk assessment and planning phase of an internal audit.

COSO ERM consists of five interrelated components:

• Governance and Culture

• Strategy and Objective-Setting

• Performance

• Review and Revision

• Information, Communication, and Reporting

2. Template for Applying the COSO ERM Framework in Internal Audit
Auditors can structure their assessment using a checklist or matrix based on the five components and related principles:

• Governance and Culture: Is the risk-aware culture well-defined and practiced?

• Strategy and Objective-Setting: Are risks considered during strategic planning?

• Performance: Are key risks identified, assessed, and linked to performance metrics?

• Review and Revision: Are risk responses adjusted over time?

• Information, Communication & Reporting: Are risk insights shared timely and clearly?

3. Practical Example: ACME’s New Product Launch
At ACME Corp, CEO Liora announces a high-stakes initiative to launch a new AI-driven product line. Internal Auditor Auren is asked to provide advisory insight into risk governance and control readiness. Using the COSO ERM framework, Auren conducts structured interviews with Project Manager Aven, heads of marketing, operations, and IT, and reviews project documentation.

• Governance and Culture: Auren finds that while ACME has a tone-at-the-top culture around innovation, risk ownership is unclear, especially for emerging technology risks.

• Strategy and Objective-Setting: The launch strategy aligns with ACME’s growth goals, but formal risk assessments were not conducted during initial planning.

• Performance: Project KPIs exist, but do not reflect cybersecurity or supply chain risk indicators—two major concerns for tech-based launches.

• Review and Revision: The team has no formal process for updating risk assessments when suppliers or launch dates change.

• Information, Communication & Reporting: Risk communication is limited to ad-hoc meetings, and risk dashboards are not used.

Based on these insights, Auren recommends establishing a cross-functional risk committee, embedding risk metrics into performance dashboards, and assigning ownership to specific risk categories. These actions align with the COSO ERM principles and help integrate risk thinking into strategic execution.

By applying COSO ERM practically, Auren moves beyond compliance-focused auditing into strategic advisory, guiding ACME to launch smarter—with risks managed, not just identified.