Risk Management: ISO 31000 and COSO ERM

Risk Management Standards

• ISO 31000 and COSO ERM framework are popular risk management standards that outline similarities and differences.
• Organizations take business risks to achieve success with enterprise risk management helping identify, assess, and control these risks.
• Risk management standards like ISO 31000 and the COSO ERM framework, facilitate achieving objectives without encountering financial or legal issues

Committee of Sponsoring Organizations (COSO)

• COSO was founded in 1985 to oversee the National Commission on Fraudulent Financial Reporting.
• The commission issued over 150 recommendations in 1987.
• COSO consists of five organizations, including the American Accounting Association and the Institute of Management Accountants.
• COSO's mission involves enhancing organizational performance via guidance on internal controls, risk management, governance, and fraud deterrence.
• COSO publishes standards, frameworks, research, and thought papers that are available on its website.

International Organization for Standardization (ISO)

• ISO, founded in 1947, develops and publishes standards for companies and other entities.
• ISO is an independent, nongovernmental group with 168 national standards bodies.
• ISO has developed nearly 25,000 international standards for management systems, quality management, and information security, incorporating risk management.

COSO ERM Framework

• COSO's ERM framework was first published in 2004.
• The framework was updated in 2017 to address ERM complexity and improve organizational risk management.
• The updated version, "Enterprise Risk Management Integrating with Strategy and Performance," emphasizes risk consideration in business strategies and operational performance.
• The ERM framework, suitable for all sizes and sectors, comprises 20 principles organized into five components.
• The five components are governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.
• Each one includes various principles detailing specific actions and practices.
• COSO provides a "Compendium of Examples" supplement with case studies on ERM framework implementations.

ISO 31000

• ISO 31000 provides principles, a framework, and methods to manage risks like equipment failure, accidents, and financial fraud.
• The standard helps organizations formalize risk management practices.
• The standard was revised in 2018 as ISO 31000:2018, Risk Management Guidelines.
• ISO 31000:2018 offers enhanced strategic guidance on ERM, emphasizing senior management involvement and integration.
• The standard includes principles to create and protect value, and frameworks to apply risk management and governance structures.
• It also outlines a process to identify, evaluate, and mitigate risks with methods of communication, monitoring, review, and reporting.
• IEC 31010, a complementary standard updated in 2019, focuses on risk assessment and analysis techniques.

Similarities Between COSO and ISO 31000

• Both ISO 31000 and COSO focus on the methods to evaluate, manage, and monitor risks.
• Both lack certification for compliance.
• Both require ERM systems to be customized.
• Both emphasize embedding risk management in decision-making.
• Both emphasize the need to review risks and revise strategies.
• The standards were updated around the same time to improve ease of use.

Differences Between COSO and ISO 31000

• ISO 31000 is developed by a formal standards body with input from many countries unlike COSO which is a group of professional associations with input from PwC.
• COSO's framework is more focused on corporate governance and ERM practices, while ISO 31000 focuses on risk management in strategic planning.
• ISO 31000 is 16 pages plus a vocabulary guide, while COSO includes over 100 pages of text and visuals.
• ISO 31000 is intended for a broad audience interested in ERM, while COSO is targeted toward accounting and auditing professionals.
• COSO combines its framework, principles, and process, wheras ISO 31000 directly details risk management tasks.
• COSO details the organization's risk appetite. ISO 31000 uses risk criteria to describe acceptable risk amounts and types.
• COSO centers on risk reduction and avoidance, whereas ISO 31000 focuses more on using risk management to generate business value.