Risk Management Frameworks: ISO 31000 and COSO ERM

1. Why This Topic Matters for the CFE Exam

Fraud does not occur in a vacuum. It is one category of risk among many that an organization faces, and the ACFE expects Certified Fraud Examiners to understand how fraud risk management fits inside an organization's broader enterprise risk management (ERM) program. The Fraud Prevention and Deterrence section of the CFE Exam (and the corresponding section of the Fraud Examiners Manual) covers fraud risk assessment and fraud risk management, and it repeatedly references two globally recognized frameworks: ISO 31000 (published by the International Organization for Standardization) and COSO ERM (published by the Committee of Sponsoring Organizations of the Treadway Commission).

Why does a fraud examiner need to know this? Because:
• Organizations that already use ISO 31000 or COSO ERM will expect anti-fraud professionals to speak the same language (risk appetite, risk tolerance, risk treatment, inherent vs. residual risk).
• The COSO/ACFE Fraud Risk Management Guide was deliberately designed to align with COSO's frameworks, so understanding COSO is essential for understanding the ACFE's own guidance.
• A fraud risk assessment is simply a specialized application of the generic risk assessment process described in both frameworks.
• Exam questions frequently test whether you can distinguish the two frameworks, name their components, and apply their vocabulary to fraud scenarios.

In short, this topic is the bridge between 'general risk management' and 'fraud risk management,' and the exam tests that bridge.

2. What Is a Risk Management Framework?

A risk management framework is a structured set of principles, governance arrangements, and processes that helps an organization identify, analyze, evaluate, respond to, and monitor risks in a consistent, repeatable way. The goal is not to eliminate all risk (which is impossible and undesirable) but to manage risk so that the organization can achieve its objectives with an acceptable level of uncertainty.

Key vocabulary shared by both frameworks:
• Risk – ISO 31000 defines it as the effect of uncertainty on objectives. Note that this effect can be positive (opportunity) or negative (threat).
• Risk appetite – the broad amount and type of risk an organization is willing to accept in pursuit of its objectives (a COSO term, set by the board/senior management).
• Risk tolerance – the acceptable variation in performance relative to a specific objective; narrower and more operational than appetite.
• Inherent risk – the level of risk before any controls or responses are applied.
• Residual risk – the risk remaining after management's responses and controls.
• Likelihood and impact (consequence) – the two dimensions normally used to score or rank risks.
• Risk owner – the person or entity with accountability and authority to manage a particular risk.

3. ISO 31000 – Risk Management Guidelines

3.1 Background
ISO 31000 was first published in 2009 and revised in 2018 (ISO 31000:2018). It is a set of guidelines, not requirements, and it is not certifiable – an organization cannot be 'ISO 31000 certified' the way it can be certified to ISO 9001 or ISO 27001. It is intentionally generic: it applies to any organization, of any size, in any sector, and to any type of risk (strategic, financial, operational, fraud, safety, etc.). It is supported by related documents such as ISO Guide 73 (risk management vocabulary) and IEC 31010 (risk assessment techniques).

ISO 31000 is organized into three interlocking parts: Principles, Framework, and Process.

3.2 The Principles (the 'why')
The purpose of risk management, according to ISO 31000:2018, is the creation and protection of value. Eight principles describe effective risk management. Risk management should be:
1. Integrated – part of all organizational activities, not a separate silo.
2. Structured and comprehensive – contributing to consistent and comparable results.
3. Customized – tailored to the organization's external and internal context and objectives.
4. Inclusive – involving stakeholders appropriately so their knowledge and views are considered.
5. Dynamic – anticipating, detecting, and responding to change.
6. Based on the best available information – using historical and current data and expectations, while recognizing limitations.
7. Attentive to human and cultural factors – recognizing that behavior and culture significantly influence risk.
8. Continually improving – through learning and experience.

3.3 The Framework (the 'who and what structure')
The framework is the organizational infrastructure that supports risk management. At its center is Leadership and Commitment from top management and oversight bodies. Around that center are five cyclical components:
• Integration – embedding risk management into governance, strategy, and operations.
• Design – understanding the organization and its context, articulating commitment, assigning roles and accountabilities, allocating resources, and establishing communication.
• Implementation – putting the plan into action with appropriate timing and resources.
• Evaluation – periodically measuring the framework's performance against its purpose.
• Improvement – continually adapting and improving the framework.

3.4 The Process (the 'how')
The ISO 31000 risk management process is the part most relevant to performing a fraud risk assessment. Its elements are:
• Communication and consultation – ongoing, with internal and external stakeholders, throughout the process.
• Scope, context, and criteria – define what the exercise covers, understand the external and internal environment, and set the risk criteria (how much risk is acceptable and how risk will be measured).
• Risk assessment, which itself has three sub-steps:
  – Risk identification: finding, recognizing, and describing risks (what could happen, how, why, and with what consequences).
  – Risk analysis: understanding the nature of the risk, its sources, likelihood, consequences, existing controls, and their effectiveness; may be qualitative, semi-quantitative, or quantitative.
  – Risk evaluation: comparing the analysis results against the risk criteria to decide whether action is needed and what priority it gets.
• Risk treatment – selecting and implementing options to address risk. ISO 31000 lists treatment options including: avoiding the risk by not starting or continuing the activity; taking or increasing risk to pursue an opportunity; removing the risk source; changing the likelihood; changing the consequences; sharing the risk (e.g., contracts, insurance); and retaining the risk by informed decision.
• Monitoring and review – planned, ongoing checks of the process and its outcomes.
• Recording and reporting – documenting the process and communicating results to decision makers.

A useful memory device for the ISO process: Communicate – Scope – Identify – Analyze – Evaluate – Treat – Monitor – Record.

4. COSO Enterprise Risk Management (COSO ERM)

4.1 Background
COSO is a joint initiative of five U.S. professional organizations (the AICPA, AAA, FEI, IIA, and IMA). It is best known for its Internal Control – Integrated Framework (1992, updated 2013), which defines internal control through five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The CFE exam often tests the distinction between the Internal Control framework and the ERM framework, so keep them separate in your mind.

COSO released its first ERM framework in 2004 – Enterprise Risk Management – Integrated Framework – and a substantially revised version in 2017 – Enterprise Risk Management – Integrating with Strategy and Performance. The exam may reference either, so you should know both.

4.2 COSO ERM 2004 (the 'cube')
The 2004 framework defined ERM as a process, effected by an entity's board, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity and manage risk to be within its risk appetite, to provide reasonable assurance regarding achievement of objectives.

It was depicted as a three-dimensional cube:
• Four objective categories (top of cube): Strategic, Operations, Reporting, Compliance.
• Eight interrelated components (front face): Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information and Communication, Monitoring.
• Organizational levels (side): entity level, division, business unit, subsidiary.

Notice that the eight ERM components are the five internal control components plus three additions: Objective Setting, Event Identification, and Risk Response. This is a classic exam distinction.

4.3 COSO ERM 2017 (the 'helix' or 'ribbon')
The 2017 update moved away from the cube and emphasized that risk management is integral to strategy and performance, not a separate compliance function. It defines ERM as the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.

The 2017 framework consists of five components and 20 principles:

1. Governance and Culture (5 principles) – Exercises board risk oversight; establishes operating structures; defines desired culture; demonstrates commitment to core values; attracts, develops, and retains capable individuals.
2. Strategy and Objective-Setting (4 principles) – Analyzes business context; defines risk appetite; evaluates alternative strategies; formulates business objectives.
3. Performance (5 principles) – Identifies risk; assesses severity of risk; prioritizes risks; implements risk responses; develops portfolio view.
4. Review and Revision (3 principles) – Assesses substantial change; reviews risk and performance; pursues improvement in ERM.
5. Information, Communication, and Reporting (3 principles) – Leverages information systems; communicates risk information; reports on risk, culture, and performance.

A handy mnemonic for the five components: G-S-P-R-I ('Good Strategy Produces Real Insight').

4.4 Risk Responses in COSO ERM
COSO 2017 identifies five categories of risk response:
• Accept – take no action to change the severity of the risk (within appetite).
• Avoid – remove the risk by exiting the activity.
• Pursue – take on additional risk to achieve improved performance (new in 2017, reflecting the view that risk includes opportunity).
• Reduce – take action to lower severity (likelihood and/or impact) – this is where most anti-fraud controls sit.
• Share – transfer or share a portion of the risk (insurance, outsourcing, joint ventures, hedging).
The 2004 version listed four: avoid, reduce, share, accept. You may also see the generic 'four T's' – Tolerate, Treat, Transfer, Terminate – which map to accept, reduce, share, and avoid respectively.

4.5 Portfolio View and Severity
COSO 2017 stresses a portfolio view: risks should be understood in aggregate at the entity level, not only one at a time, because risks interact and correlate. It also uses the term severity to capture likelihood, impact, velocity (how fast a risk materializes), and persistence (how long its effects last).

5. How ISO 31000 and COSO ERM Compare

Both frameworks are compatible and many organizations use elements of both. Key comparison points that exam questions love:

• Origin: ISO 31000 – international standards body, global in orientation; COSO ERM – U.S. private-sector coalition, historically tied to financial reporting and internal control.
• Structure: ISO – Principles, Framework, Process; COSO 2017 – 5 components and 20 principles; COSO 2004 – 8 components, 4 objective categories (cube).
• Definition of risk: ISO – effect of uncertainty on objectives (explicitly positive or negative); COSO – possibility that events will occur and affect the achievement of strategy and business objectives (also recognizing opportunity, especially in 2017).
• Length and style: ISO 31000 is short (roughly 16 pages), principle-based, and generic; COSO ERM is longer, more detailed, with extensive implementation guidance and illustrative examples.
• Certification: neither framework is certifiable, but ISO 31000 explicitly says so.
• Risk appetite: central and explicitly defined concept in COSO; ISO uses 'risk criteria' and 'risk attitude' instead.
• Link to internal control: COSO ERM sits on top of COSO's Internal Control framework; ISO 31000 is control-agnostic and does not prescribe a control framework.
• Terminology for responding to risk: ISO – 'risk treatment'; COSO – 'risk response'.

6. Connecting the Frameworks to Fraud Risk Management

The COSO/ACFE Fraud Risk Management Guide (first issued 2016, updated 2023) translates these general frameworks into fraud-specific terms. It sets out five fraud risk management principles that align directly with the five COSO internal control components:
1. Fraud Risk Governance (Control Environment) – the organization establishes and communicates a fraud risk management program that demonstrates the expectations of the board and senior management and their commitment to high integrity and ethical values.
2. Fraud Risk Assessment (Risk Assessment) – the organization performs comprehensive fraud risk assessments to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing controls, and implement actions to mitigate residual fraud risk.
3. Fraud Control Activities (Control Activities) – the organization selects, develops, and deploys preventive and detective fraud control activities.
4. Fraud Investigation and Corrective Action (Information and Communication) – the organization establishes a communication process to obtain information about potential fraud and deploys a coordinated approach to investigation and corrective action.
5. Fraud Risk Management Monitoring Activities (Monitoring) – the organization selects, develops, and performs ongoing evaluations to ascertain whether each of the five principles is present and functioning.

When you perform a fraud risk assessment, you are essentially running the ISO 31000 risk assessment steps (identify, analyze, evaluate) and the COSO Performance component (identify, assess severity, prioritize, respond) with a fraud lens: brainstorming fraud schemes by category (asset misappropriation, corruption, financial statement fraud), rating inherent likelihood and significance, mapping existing anti-fraud controls, determining residual risk, and deciding on a response consistent with the organization's fraud risk appetite (which for many fraud types is near zero, but never literally zero because the cost of eliminating all fraud risk would exceed the benefit).

Important nuance tested on the exam: the Fraud Risk Management Guide positions fraud risk assessment as a component of, not a substitute for, the organization's enterprise risk assessment. The ACFE also emphasizes that fraud risk management is the responsibility of management and the board, with internal audit, the fraud examiner, and compliance functions playing supporting and assurance roles.

7. Implementing a Framework – Practical Steps a CFE Should Recognize

1. Obtain visible tone at the top and board oversight (ISO: Leadership and Commitment; COSO: Governance and Culture).
2. Define the organization's context, objectives, and risk appetite (ISO: Scope, context, criteria; COSO: Strategy and Objective-Setting).
3. Assemble a cross-functional team and identify risks, including fraud schemes, using brainstorming, interviews, surveys, data analytics, process mapping, and review of prior incidents.
4. Analyze and evaluate each risk for likelihood and impact (or severity), document existing controls, and derive residual risk, typically on a heat map or risk register.
5. Select and implement responses/treatments – for fraud, this normally means preventive controls (segregation of duties, authorization, background checks, code of conduct, hotlines) and detective controls (reconciliations, data analytics, surprise audits, whistleblower reporting).
6. Monitor and review – track key risk indicators, test controls, reassess at least annually and whenever significant change occurs (new systems, mergers, downsizing, regulatory change).
7. Record and report – maintain the risk register and report to the audit committee or board, closing the loop with continual improvement.

8. Common Misconceptions to Avoid

• ISO 31000 is not a certification standard and does not require specific controls.
• COSO ERM and COSO Internal Control are different frameworks; ERM is broader and includes strategy setting and risk response.
• Risk management does not aim for zero risk; it aims for risk within appetite/criteria.
• 'Risk assessment' in ISO is a three-part activity (identify, analyze, evaluate), whereas many people use the term loosely to mean the entire process.
• A fraud risk assessment is not a one-time project; both frameworks demand ongoing monitoring and periodic refresh.
• In COSO terminology, 'share' includes insurance and outsourcing – but transferring a risk does not transfer accountability for it.

9. Exam Tips: Answering Questions on Risk Management Frameworks: ISO 31000 and COSO ERM

Tip 1 – Identify which framework the question is about from its vocabulary. Words like 'risk treatment,' 'risk criteria,' 'principles-framework-process,' 'effect of uncertainty on objectives,' and 'leadership and commitment' point to ISO 31000. Words like 'risk appetite,' 'risk response,' 'components and principles,' 'portfolio view,' 'cube,' 'internal environment,' or 'Governance and Culture' point to COSO ERM.

Tip 2 – Memorize the counts. ISO 31000:2018 has 8 principles. COSO ERM 2017 has 5 components and 20 principles. COSO ERM 2004 has 8 components and 4 objective categories. COSO Internal Control has 5 components and 17 principles. The Fraud Risk Management Guide has 5 fraud risk management principles. Many multiple-choice distractors are simply wrong numbers.

Tip 3 – Know the three sub-steps of ISO risk assessment in order. Identification, then analysis, then evaluation. If a question asks what step compares analyzed risk against risk criteria, the answer is risk evaluation, not analysis.

Tip 4 – Know the additions that make ERM broader than internal control. If asked which component appears in COSO ERM 2004 but not in COSO Internal Control, the answers are Objective Setting, Event Identification, and Risk Response.

Tip 5 – Match risk response terminology correctly. Insurance = share/transfer. Discontinuing a product line = avoid/terminate. Adding a control = reduce/treat/mitigate. Deciding the risk is within appetite and doing nothing = accept/tolerate/retain. Taking on more risk for reward = pursue (COSO 2017) or 'taking or increasing risk to pursue an opportunity' (ISO).

Tip 6 – Watch for 'inherent' versus 'residual.' Questions often describe a scenario and ask which type of risk is being measured. Before controls = inherent; after controls = residual. The fraud risk assessment compares residual fraud risk to the fraud risk appetite.

Tip 7 – Remember who owns risk management. The correct answer about responsibility is almost always management (with board oversight), not internal audit, not external auditors, and not the fraud examiner. Internal audit provides independent assurance; it should not own the risks it assesses.

Tip 8 – Apply the 'best answer' discipline. CFE questions frequently have two plausible choices. Choose the one that is most consistent with the framework's own definitions. For example, if asked for ISO 31000's purpose, 'creation and protection of value' beats 'elimination of risk' or 'compliance with regulation.'

Tip 9 – True/false items often hinge on absolutes. Statements claiming that ISO 31000 'requires' something, that organizations 'can be certified' to it, that ERM 'eliminates' risk, or that a fraud risk assessment 'replaces' the enterprise risk assessment are false.

Tip 10 – Tie it back to fraud. When a question frames the framework in a fraud context, remember the Fraud Risk Management Guide's five principles and their mapping to the COSO components (Governance, Assessment, Control Activities, Investigation and Corrective Action, Monitoring). Fraud risk assessment is the second principle, and it should consider all three major fraud categories as well as the likelihood and significance of each scheme and the people and departments involved.

10. Quick Review Summary

• ISO 31000: international, generic, non-certifiable guidelines; risk = effect of uncertainty on objectives; 8 principles; framework centered on leadership and commitment with integration, design, implementation, evaluation, improvement; process = communication and consultation, scope/context/criteria, risk assessment (identify, analyze, evaluate), risk treatment, monitoring and review, recording and reporting.
• COSO ERM 2004: cube with 8 components and 4 objective categories (strategic, operations, reporting, compliance).
• COSO ERM 2017: Integrating with Strategy and Performance; 5 components (Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting) and 20 principles; risk responses = accept, avoid, pursue, reduce, share; emphasizes risk appetite and portfolio view.
• Fraud link: the COSO/ACFE Fraud Risk Management Guide's five principles embed fraud risk management within COSO's structure, and a fraud risk assessment is a specialized application of the generic ISO/COSO risk assessment steps.

Master the vocabulary, the counts, the sequence of steps, and the mapping between general risk management and fraud risk management, and you will handle any CFE exam question on these frameworks with confidence.