Risk management frameworks (COSO ERM, ISO 31000)

Welcome to Your Journey into Risk Management Frameworks!

Hi there! Welcome to this essential chapter of your CIMA P3 studies. We are diving into Section A: Enterprise Risk, specifically focusing on the "blueprints" of risk management: Frameworks.

If you have ever felt overwhelmed by the idea of managing every single thing that could go wrong in a massive company, don't worry! That is exactly why frameworks like COSO ERM and ISO 31000 exist. Think of a framework as a pre-built shelving unit. Instead of throwing all your risks into a messy pile on the floor, these frameworks give you specific "shelves" to organize, measure, and handle those risks effectively. Let's get started!

1. What is a Risk Management Framework?

Before we look at the specific models, let's understand the concept. A framework is a set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, and continually improving risk management throughout the organization.

The "Gym Membership" Analogy:
Imagine you want to get fit. You could just run around randomly, but you’ll get better results if you follow a framework: a specific workout plan, a set schedule, and a way to track your progress. In business, COSO and ISO are those professional "workout plans" for keeping the company safe and healthy.

2. ISO 31000:2018 – The International Standard

ISO 31000 is a globally recognized set of guidelines. It is designed to be flexible, meaning it can be used by any organization, no matter its size or industry.

ISO 31000 is structured into three main pillars:

A. Principles (The "Why")

These are the core truths that make risk management effective. The most important principle is that risk management creates and protects value. It’s not just about stopping bad things; it’s about helping the company succeed.

B. Framework (The "How")

This is about how risk management is integrated into the company. It follows a cycle: Design -> Implementation -> Evaluation -> Improvement. Crucially, it must have Leadership and Commitment at the very center.

C. Process (The "Doing")

This is the actual step-by-step activity of managing risk. The process includes:
1. Scope, Context, and Criteria: Defining what we are looking at and what "success" looks like.
2. Risk Assessment: This involves Identification (what can happen?), Analysis (how big is it?), and Evaluation (is it acceptable?).
3. Risk Treatment: Deciding what to do about the risk (e.g., avoid, reduce, share, or accept).
4. Monitoring and Review: Keeping an eye on things to see if anything changes.
5. Communication and Consultation: Talking to stakeholders throughout the whole process.

Quick Review: ISO 31000 is often seen as more "process-oriented" and is famous for its circular "wheel" diagram showing how risk management should be continuous.

3. COSO ERM (2017) – The Strategic Approach

COSO (Committee of Sponsoring Organizations) released an updated Enterprise Risk Management (ERM) framework in 2017. This framework focuses heavily on the relationship between strategy, performance, and risk.

COSO defines ERM as: "The culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value."

Memory Aid: The "GOPRO" Mnemonic

To remember the five components of the COSO ERM framework, just think of a GOPRO camera:

1. Governance and Culture: The "tone at the top." Does the board take risk seriously? Is the company culture honest and transparent?
2. Objective-Setting and Strategy: Risk management isn't a separate department; it must be part of the business plan.
3. Performance: Identifying and assessing risks that may impact the achievement of strategy.
4. Review and Revision: Looking back at how the ERM performed. Did it work? Do we need to change our approach?
5. Ongoing Information, Communication, and Reporting: Sharing the right risk info at all levels of the company.

Did you know?
The 2017 COSO update moved away from a "check-the-box" compliance mentality and shifted toward making risk management part of every strategic decision a CEO makes!

4. Key Differences and Which One to Use?

Students often ask, "Which one is better?" Neither! They are just different tools for the same job.

• ISO 31000 is often preferred by operations managers because it provides a very clear, step-by-step process for treating risks.
• COSO ERM is often preferred by Accountants and Board Directors (especially in the US) because it links risk directly to internal controls and corporate strategy.

Common Mistake to Avoid:
Don't think of these as "laws." They are voluntary frameworks. A company won't go to jail for not following ISO 31000, but they might fail because they didn't have a structured way to handle risks!

5. Risk Assessment Math

While frameworks are conceptual, you still need to understand how we "measure" the risks we find within them. The basic formula used during the Performance (COSO) or Risk Analysis (ISO) stage is:

\( Risk Exposure = Likelihood \times Impact \)

Example: If there is a 10% chance of a fire (Likelihood) and the fire would cost \$1,000,000 (Impact), the risk exposure is \$100,000.

Chapter Summary - Key Takeaways

1. Structure is King: Frameworks provide a consistent language and structure for risk management across the whole company.
2. ISO 31000: Focuses on the Principles, Framework, and Process. It is a continuous loop of improvement.
3. COSO ERM (2017): Focuses on Strategy and Performance. Remember GOPRO (Governance, Objective-setting, Performance, Review, Ongoing info).
4. Value Creation: Modern risk management is not just about avoiding "bad" things; it is about managing uncertainty to create value for shareholders.

Don't worry if the names and components feel a bit repetitive! The more you read through the GOPRO mnemonic and the ISO process steps, the more natural they will feel. You've got this!