Key Facts
- Regulator
- Committee of Sponsoring Organizations of the Treadway Commission (COSO)
- Latest version
- Enterprise Risk Management—Integrating with Strategy and Performance (2017), which updated the 2004 Enterprise Risk Management—Integrated Framework
- Official text
- www.coso.org ↗
What is the COSO ERM framework?
COSO ERM is the enterprise risk management framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The COSO ERM framework gives boards and managers a set of principles for managing risk as part of strategy and performance. Organisations of any size and kind can use it.
COSO is a private sector initiative, jointly sponsored and funded by five professional bodies.
The current version is Enterprise Risk Management—Integrating with Strategy and Performance, published in June 2017. It updated the 2004 Enterprise Risk Management—Integrated Framework. COSO's ERM guidance page announces no revision. Its 2026 title, From Guidance to Action: Exploring Practical ERM, is guidance, not a new edition.
Why it matters
The board asks how risk fits the strategy. The register is long, and none of its entries mentions an objective.
A risk register that never meets the strategy is a list, not risk management.
That gap is what the 2017 update addresses. COSO says it stresses risk both when strategy is set and when it is carried out. The COSO ERM principles put board oversight, objectives, delivery and reporting in one structure, not four separate exercises.
Most firms meet it through the board. A board or audit committee wants a known structure behind what it says about risk and internal control.
Who it applies to
Size and sector do not rule a firm in or out. COSO's test is simple: if a firm has a mission, a strategy and objectives, and must weigh risk in its decisions, enterprise risk management applies.
COSO's own pages do not require anyone to adopt it. The UK Financial Reporting Council (FRC) leaves the choice of framework to boards. Treat COSO ERM as voluntary guidance unless a contract, an investor or a regulator names it.
COSO's Internal Control—Integrated Framework is a separate publication. COSO says neither supersedes the other, and the internal control framework is still fit for designing and assessing internal control. Check which of the two a customer or auditor means.
ISO 27001 is the closest framework most readers already hold. It manages risk to information inside an information security management system (ISMS). COSO ERM ties risk to strategy and performance across the whole firm. A firm with a certified ISMS can feed the output of its clause 6.1 risk process into an enterprise process built on COSO ERM.
The UK position
A UK firm mostly meets COSO ERM through governance, not law. Provision 29 of the UK Corporate Governance Code 2024 is that route. It asks the board to monitor its risk management and internal control framework and review how well it works at least once a year. From financial years starting on or after 1 January 2026, the board must also declare how effective its material internal controls are. The Code covers companies listed in the commercial companies or closed-ended investment funds categories, on a comply-or-explain basis.
The FRC does not prescribe a framework. It says the board may wish to use an established standard or framework. COSO ERM is one a listed company could use to design and evidence its approach.
We found no UK law or regulator that names COSO ERM. A private firm usually meets it through an investor, a parent group or an auditor.
Key requirements
The 2017 framework is a set of principles, not a certification scheme. Its principles are organised into five interrelated components:
- Governance and Culture. The board sets the tone and oversees risk. Culture covers ethical values, desired behaviours and how well people understand risk.
- Strategy and Objective-Setting. Risk is weighed while strategy is set. A risk appetite is agreed and aligned with strategy, and business objectives put the strategy into practice.
- Performance. Risks to strategy and business objectives are identified, assessed and ranked by severity against risk appetite. The firm then chooses responses, takes a portfolio view and reports the results.
- Review and Revision. The firm reviews performance to see how well the components work, over time and after big changes. It then decides what to revise.
- Information, Communication and Reporting. Risk information is gathered from inside and outside the firm and shared up, down and across it.
These five COSO ERM components are the structure a board paper, an internal audit plan or a risk policy can follow.
A framework you cannot map to a board paper stays on the shelf.
The twenty COSO ERM principles
Twenty principles sit under the five components. COSO describes each one at the end of its executive summary.
- Governance and Culture (1 to 5): Exercises Board Risk Oversight; Establishes Operating Structures; Defines Desired Culture; Demonstrates Commitment to Core Values; Attracts, Develops, and Retains Capable Individuals.
- Strategy and Objective-Setting (6 to 9): Analyzes Business Context; Defines Risk Appetite; Evaluates Alternative Strategies; Formulates Business Objectives.
- Performance (10 to 14): Identifies Risk; Assesses Severity of Risk; Prioritizes Risks; Implements Risk Responses; Develops Portfolio View.
- Review and Revision (15 to 17): Assesses Substantial Change; Reviews Risk and Performance; Pursues Improvement in Enterprise Risk Management.
- Information, Communication and Reporting (18 to 20): Leverages Information and Technology; Communicates Risk Information; Reports on Risk, Culture, and Performance.
Frequently asked questions
COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission. Its five sponsors are the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Management Accountants and The Institute of Internal Auditors. COSO publishes the COSO ERM framework and guidance on internal control and fraud deterrence.
COSO's ERM Certificate is for people, not organisations. COSO launched the programme in 2018, and the AICPA, The Institute of Internal Auditors, Financial Executives International and the Institute of Management Accountants offer it. It is aimed at risk professionals, ERM consultants and board members, and candidates pass an online exam on the 2017 COSO ERM framework.
The COSO ERM framework has twenty principles, not 17, so a list of 17 is not the ERM framework. If a source quotes 17, check whether it means COSO's Internal Control—Integrated Framework, a separate publication first issued in 1992 and refreshed in 2013. COSO says neither framework supersedes the other.
COSO ERM 2017, Integrating with Strategy and Performance, updated the 2004 Integrated Framework. COSO says the update gives more weight to risk when setting and carrying out strategy, links risk more closely to performance targets, expands reporting for stakeholders and allows for data, analytics and new technology. It sets out five components and twenty principles.
No UK rule we checked requires COSO ERM. Under the UK Corporate Governance Code, a listed company that departs from a provision must say so, explain why and give a timeframe for complying. A company that uses COSO ERM for its Provision 29 review can point to an established framework when it reports.