COSO Enterprise Risk Management (ERM) Framework — 2017
- ClassificationCategoryRisk ManagementDomainRisk ManagementFramework FamilyCOSO
- Regulatory ContextTypeFrameworkLegal InstrumentFrameworkSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherCommittee of Sponsoring Organizations of the Treadway Commission (COSO)
- VersioningVersionEnterprise Risk Management: Integrating with Strategy and Performance (2017), five components and 20 principlesEffective DateJune 2017Issue DateJune 2017
- AdoptionAdoption ModelRisk ManagementImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
COSO publishes a free executive summary. The full Framework is a paid publication (eBook or softcover) from COSO, and COSO's copyright notice bars reproduction without its written permission. The framework text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- COSO ERM (2017) sets five components and 20 principles for building risk management into strategy-setting and performance.
- COSO published it in 2017 as an update to its 2004 Enterprise Risk Management: Integrated Framework.
- It is voluntary guidance for boards and management in entities of any size, not a law.
- COSO's Internal Control: Integrated Framework (2013) is a separate publication, and neither framework supersedes the other.
- SmartSuite Enterprise Risk Management holds the risk appetite, risk register, responses, and reporting the 20 principles call for.
Overview
COSO's Enterprise Risk Management: Integrating with Strategy and Performance (2017) is a framework of five components and 20 principles for building risk management into strategy-setting and performance. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published it in 2017 as an update to its 2004 Enterprise Risk Management: Integrated Framework. It is guidance that organizations adopt voluntarily, not a law.
COSO is a private-sector initiative sponsored and funded by the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Management Accountants and The Institute of Internal Auditors. The Framework is written for boards and management in entities of any size, from small businesses and social enterprises to government agencies and large public companies.
Organizations implement it by treating enterprise risk management as the culture, capabilities and practices applied with strategy-setting, not as a separate department or a risk list. In practice they set a risk appetite, assess and prioritize risks to objectives, choose responses, review performance and report on risk, culture and performance. COSO's Internal Control: Integrated Framework (2013) is a separate publication, and neither framework supersedes the other.
Why does it matter?
The Framework moves risk management from a stand-alone exercise to part of choosing and carrying out strategy. COSO's point is that the largest causes of lost value are a strategy that does not support the mission, vision and core values, and the consequences of the strategy chosen, as well as risks to the strategy itself (executive summary, pages 4 and 5).
Key benefits include:
- Risk considered when strategy is chosen
Strategy selection weighs three things: risk to the chosen strategy, the possibility that the strategy does not align with mission, vision and core values, and the implications of the strategy chosen (executive summary, pages 4 and 5).
- Risk appetite tied to decisions
The organization defines risk appetite in the context of creating, preserving and realizing value, and aligns it with strategy and business objectives (principle 7).
- An entity-wide view
Management develops and evaluates a portfolio view of risk, because a risk can start in one part of the entity and affect another (principle 14).
- Less variability in performance
Understanding the risks that affect performance targets lets management act early, whether performance runs behind or ahead of expectations (executive summary, page 4).
- Reporting that boards can use
The organization reports on risk, culture and performance at multiple levels and across the entity, which supports board oversight and stakeholder transparency (principle 20).
How does it work?
The publication has two parts. The first gives a perspective on current and evolving concepts and applications of enterprise risk management. The second, the Framework, is a set of principles organized into five interrelated components. Adhering to the principles can give management and the board a reasonable expectation that the organization understands and strives to manage the risks associated with its strategy and business objectives.
COSO describes how the components follow the strategy cycle: mission, vision and core values, then strategy development, business objective formulation, implementation and performance, and enhanced value. Risk management runs through each stage. COSO states plainly that it is not a function or department, not just a list of risks, not only internal control, and not a checklist.
The Framework applies at all levels of the organization and across all functions. It is supported by COSO's Compendium of Examples, case studies that show how entities scaled and adapted the principles, and by guidance documents such as Compliance Risk Management: Applying the COSO ERM Framework (authored by SCCE and HCCA), listed on coso.org.
Key Elements
- Governance and Culture (principles 1 to 5)
Board risk oversight, operating structures, the desired culture, commitment to core values, and attracting, developing and retaining capable individuals. Governance sets the tone and establishes oversight responsibilities; culture covers ethical values, desired behaviors and understanding of risk.
- Strategy and Objective-Setting (principles 6 to 9)
Analyzing business context, defining risk appetite, evaluating alternative strategies and formulating business objectives. Risk appetite is established and aligned with strategy, and objectives put the strategy into practice.
- Performance (principles 10 to 14)
Identifying risk, assessing its severity, prioritizing risks, implementing risk responses and developing a portfolio view. Risks are prioritized by severity in the context of risk appetite, and results are reported to key risk stakeholders.
- Review and Revision (principles 15 to 17)
Assessing substantial change, reviewing risk and performance, and pursuing improvement in enterprise risk management. The organization considers how well the components function over time and what revisions are needed.
- Information, Communication and Reporting (principles 18 to 20)
Using information and technology systems to support enterprise risk management, communicating risk information through communication channels, and reporting on risk, culture and performance. Information flows up, down and across the organization.
What does it cover?
The Framework applies to organizations of any size, type or sector that have a mission, a strategy and objectives and need to make decisions that consider risk, including for-profit, not-for-profit and government bodies. It addresses strategy-setting, governance, communicating with stakeholders and measuring performance, and its principles apply at all levels. It is not a regulation and no authority enforces it.
What are its objectives?
The Framework gives management and boards a common set of definitions, components and principles for enterprise risk management.
Connect enterprise risk management with strategy-setting and with carrying out strategy.
Align performance and risk so targets are set with an understanding of how risk affects them.
Meet expectations for governance and oversight by the board.
Apply a common but tailored approach across geographies and business units.
Expand reporting to give stakeholders greater transparency.
Use information, technology and data analytics to support decisions about risk.
Framework in Context
The 2017 publication updates COSO's 2004 Enterprise Risk Management: Integrated Framework. COSO's Internal Control: Integrated Framework (2013) is the companion publication on internal control; the two are distinct, neither supersedes the other, and internal control is one part of what enterprise risk management covers. For SOX section 404 assessments of internal control over financial reporting, PCAOB standards describe COSO's Internal Control publication as a suitable and available framework for management's annual assessment. As of October 14, 2026 coso.org presents the 2017 publication as its current ERM framework.
Common Framework Mappings
Organizations map COSO ERM to risk, control and security frameworks to link risk appetite, assessment and reporting with controls and resilience programs.
Mapped frameworks include:
COBIT 2019
COSO IC 2013
Open FAIR
ISO 22301
ISO 31000:2018
ISO 27001:2022
NIST CSF 2.0
NIST 800-37 Rev.2
How SmartSuite Supports COSO ERM
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Enterprise Risk Management records to hold the risk appetite, risk register, responses and reporting that the 20 principles call for, with Internal Audit Management to review how the components are functioning.
Governance and Culture Records
Record board oversight, operating structures, the desired culture and core-value commitments as the evidence for principles 1 to 5.
Risk Appetite and Strategy Link
Hold the risk appetite statement, the alternative strategies evaluated and the business objectives each risk affects (principles 7 to 9).
Risk Register and Severity
Log identified risks with severity, priority and owner, linked to the objective they could affect (principles 10 to 12).
Responses and Portfolio View
Track the risk response chosen for each risk and view exposure by objective, unit and category as a portfolio (principles 13 and 14).
Change and Performance Reviews
Schedule reviews of performance and risk, and log substantial changes and improvement actions (principles 15 to 17).
Risk, Culture and Performance Reporting
Build dashboards of risk, culture and performance for management, the board and other stakeholders (principles 18 to 20).
Related frameworks
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
COSO Internal Control (2013) defines five components and 17 principles of internal control. Public companies commonly use it as the ICFR framework for SOX section 404.
ISO 22301:2019 specifies requirements for a business continuity management system to protect against, prepare for, respond to and recover from disruptions.
ISO 31000:2018 gives guidelines on managing risk through eight principles, a framework and a process for any organization. It is not certifiable. ISO published it on February 14, 2018.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
Frequently Asked Questions For COSO Enterprise Risk Management (ERM) Framework
Enterprise Risk Management: Integrating with Strategy and Performance (2017) is COSO's framework for managing risk together with strategy and performance. It sets out five interrelated components supported by 20 principles, and it updates COSO's 2004 Enterprise Risk Management: Integrated Framework. COSO describes enterprise risk management as the culture, capabilities and practices applied with strategy-setting, not a department.
No. COSO is a private-sector initiative, and the Framework is guidance that organizations choose to adopt. No regulator enforces it. Organizations use it to give boards and management a common approach to risk and to show how risk is considered in strategy and performance.
The components are Governance and Culture (principles 1 to 5), Strategy and Objective-Setting (6 to 9), Performance (10 to 14), Review and Revision (15 to 17) and Information, Communication, and Reporting (18 to 20). The principles run from exercising board risk oversight (1) to reporting on risk, culture and performance (20), and include defining risk appetite (7) and developing a portfolio view (14).
The two publications are distinct, and neither supersedes the other. Internal control is one part of what enterprise risk management covers. For assessments of internal control over financial reporting under SOX section 404, the control framework used is COSO's Internal Control: Integrated Framework (2013), which PCAOB standards describe as a suitable and available framework for management's annual assessment.
COSO publishes a free executive summary dated June 2017 on coso.org. The full Framework is sold by COSO as an eBook or softcover. COSO's copyright notice states that no part may be reproduced, redistributed, transmitted or displayed without COSO's written permission, so SmartSuite links to the publication rather than reproducing it.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.