{"id":867,"date":"2020-01-04T12:55:37","date_gmt":"2020-01-04T12:55:37","guid":{"rendered":"https:\/\/alminawi.com\/?p=867"},"modified":"2025-12-07T18:21:34","modified_gmt":"2025-12-07T18:21:34","slug":"tts-series-d-internal-audit-risk-assessment-planning-episode-04-coso-erm-framework","status":"publish","type":"post","link":"https:\/\/e.americanpro.org\/?p=867","title":{"rendered":"T&#038;Ts Series D, Internal Audit, Risk Assessment &#038; Planning, Episode 04: COSO ERM Framework"},"content":{"rendered":"<p data-start=\"95\" data-end=\"655\"><strong data-start=\"95\" data-end=\"131\">1. Introduction to the Technique<\/strong><br data-start=\"131\" data-end=\"134\" \/>The <strong data-start=\"138\" data-end=\"189\">COSO Enterprise Risk Management (ERM) Framework<\/strong> is a strategic tool that helps organizations identify, assess, manage, and monitor risks to achieve their objectives. Internal auditors often use the COSO ERM model to evaluate how well risk management is embedded within the company\u2019s culture, operations, and decision-making. The 2017 updated COSO ERM framework focuses on integrating risk with strategy and performance, making it highly relevant during the risk assessment and planning phase of an internal audit.<\/p>\n<p data-start=\"657\" data-end=\"711\">COSO ERM consists of <strong data-start=\"678\" data-end=\"710\">five interrelated components<\/strong>:<\/p>\n<ul data-start=\"712\" data-end=\"857\">\n<li data-start=\"712\" data-end=\"738\">\n<p data-start=\"714\" data-end=\"738\">Governance and Culture<\/p>\n<\/li>\n<li data-start=\"739\" data-end=\"773\">\n<p data-start=\"741\" data-end=\"773\">Strategy and Objective-Setting<\/p>\n<\/li>\n<li data-start=\"774\" data-end=\"789\">\n<p data-start=\"776\" data-end=\"789\">Performance<\/p>\n<\/li>\n<li data-start=\"790\" data-end=\"813\">\n<p data-start=\"792\" data-end=\"813\">Review and Revision<\/p>\n<\/li>\n<li data-start=\"814\" data-end=\"857\">\n<p data-start=\"816\" data-end=\"857\">Information, Communication, and Reporting<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"859\" data-end=\"1051\"><strong data-start=\"859\" data-end=\"928\">2. Template for Applying the COSO ERM Framework in Internal Audit<\/strong><br data-start=\"928\" data-end=\"931\" \/>Auditors can structure their assessment using a checklist or matrix based on the five components and related principles:<\/p>\n<ul data-start=\"1052\" data-end=\"1468\">\n<li data-start=\"1052\" data-end=\"1135\">\n<p data-start=\"1054\" data-end=\"1135\"><strong data-start=\"1054\" data-end=\"1081\">Governance and Culture:<\/strong> Is the risk-aware culture well-defined and practiced?<\/p>\n<\/li>\n<li data-start=\"1136\" data-end=\"1221\">\n<p data-start=\"1138\" data-end=\"1221\"><strong data-start=\"1138\" data-end=\"1173\">Strategy and Objective-Setting:<\/strong> Are risks considered during strategic planning?<\/p>\n<\/li>\n<li data-start=\"1222\" data-end=\"1311\">\n<p data-start=\"1224\" data-end=\"1311\"><strong data-start=\"1224\" data-end=\"1240\">Performance:<\/strong> Are key risks identified, assessed, and linked to performance metrics?<\/p>\n<\/li>\n<li data-start=\"1312\" data-end=\"1377\">\n<p data-start=\"1314\" data-end=\"1377\"><strong data-start=\"1314\" data-end=\"1338\">Review and Revision:<\/strong> Are risk responses adjusted over time?<\/p>\n<\/li>\n<li data-start=\"1378\" data-end=\"1468\">\n<p data-start=\"1380\" data-end=\"1468\"><strong data-start=\"1380\" data-end=\"1423\">Information, Communication &amp; Reporting:<\/strong> Are risk insights shared timely and clearly?<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"1470\" data-end=\"1907\"><strong data-start=\"1470\" data-end=\"1521\">3. Practical Example: ACME\u2019s New Product Launch<\/strong><br data-start=\"1521\" data-end=\"1524\" \/>At ACME Corp, CEO <strong data-start=\"1542\" data-end=\"1551\">Liora<\/strong> announces a high-stakes initiative to launch a new AI-driven product line. Internal Auditor <strong data-start=\"1644\" data-end=\"1653\">Auren<\/strong> is asked to provide advisory insight into risk governance and control readiness. Using the COSO ERM framework, Auren conducts structured interviews with <strong data-start=\"1807\" data-end=\"1831\">Project Manager Aven<\/strong>, heads of marketing, operations, and IT, and reviews project documentation.<\/p>\n<ul data-start=\"1909\" data-end=\"2652\">\n<li data-start=\"1909\" data-end=\"2084\">\n<p data-start=\"1911\" data-end=\"2084\"><strong data-start=\"1911\" data-end=\"1938\">Governance and Culture:<\/strong> Auren finds that while ACME has a tone-at-the-top culture around innovation, risk ownership is unclear, especially for emerging technology risks.<\/p>\n<\/li>\n<li data-start=\"2085\" data-end=\"2247\">\n<p data-start=\"2087\" data-end=\"2247\"><strong data-start=\"2087\" data-end=\"2122\">Strategy and Objective-Setting:<\/strong> The launch strategy aligns with ACME\u2019s growth goals, but formal risk assessments were not conducted during initial planning.<\/p>\n<\/li>\n<li data-start=\"2248\" data-end=\"2395\">\n<p data-start=\"2250\" data-end=\"2395\"><strong data-start=\"2250\" data-end=\"2266\">Performance:<\/strong> Project KPIs exist, but do not reflect cybersecurity or supply chain risk indicators\u2014two major concerns for tech-based launches.<\/p>\n<\/li>\n<li data-start=\"2396\" data-end=\"2522\">\n<p data-start=\"2398\" data-end=\"2522\"><strong data-start=\"2398\" data-end=\"2422\">Review and Revision:<\/strong> The team has no formal process for updating risk assessments when suppliers or launch dates change.<\/p>\n<\/li>\n<li data-start=\"2523\" data-end=\"2652\">\n<p data-start=\"2525\" data-end=\"2652\"><strong data-start=\"2525\" data-end=\"2568\">Information, Communication &amp; Reporting:<\/strong> Risk communication is limited to ad-hoc meetings, and risk dashboards are not used.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2654\" data-end=\"2956\">Based on these insights, Auren recommends establishing a cross-functional risk committee, embedding risk metrics into performance dashboards, and assigning ownership to specific risk categories. These actions align with the COSO ERM principles and help integrate risk thinking into strategic execution.<\/p>\n<p data-start=\"2958\" data-end=\"3135\" data-is-last-node=\"\" data-is-only-node=\"\">By applying COSO ERM practically, Auren moves beyond compliance-focused auditing into strategic advisory, guiding ACME to launch smarter\u2014with risks managed, not just identified.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction to the TechniqueThe COSO Enterprise Risk Management (ERM) Framework is a strategic tool that helps organizations identify, assess, manage, and monitor risks to achieve their objectives. Internal auditors often use the COSO ERM model to evaluate how well risk management is embedded within the company\u2019s culture, operations, and decision-making. The 2017 updated COSO [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":806,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22],"tags":[],"class_list":["post-867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tt-internal-audit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/e.americanpro.org\/wp-content\/uploads\/2025\/06\/14.jpeg","_links":{"self":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=867"}],"version-history":[{"count":1,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/867\/revisions"}],"predecessor-version":[{"id":1315,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/867\/revisions\/1315"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/media\/806"}],"wp:attachment":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}