Comparing COSO ERM and ISO 31000

Why This Topic Matters for the CRMA Exam

The Certification in Risk Management Assurance (CRMA) tests your ability to evaluate how well an organization governs and manages risk. Two globally recognized frameworks dominate that conversation: COSO Enterprise Risk Management (COSO ERM) and ISO 31000. Almost every organization that has a formal risk management program has anchored it to one of these, blended the two, or built a custom model heavily borrowed from them.

Internal auditors must understand both because:

1. IIA Standards require it. The Global Internal Audit Standards (and the legacy IPPF Standard 2120, Risk Management) require internal audit to evaluate the effectiveness of risk management processes and contribute to their improvement. You cannot evaluate a process without a benchmark, and COSO ERM and ISO 31000 are the two most common benchmarks.
2. Boards and audit committees ask about them. Directors frequently ask whether the risk program is aligned to a recognized framework. A CRMA holder is expected to answer intelligently.
3. Assurance mapping and maturity assessments depend on them. When internal audit performs an ERM maturity review, the criteria almost always come from one of these frameworks.
4. The exam loves comparison questions. The CRMA frequently presents a scenario and asks which framework is described, which concept belongs to which framework, or how the two differ in structure, emphasis, or terminology.

In short, this is a foundational knowledge area. Getting it right earns reliable points; getting it wrong usually means you have confused two frameworks that sound similar but are built differently.

What Is COSO ERM?

Origin: COSO stands for the Committee of Sponsoring Organizations of the Treadway Commission, a private-sector initiative formed in the United States by five accounting and finance professional bodies (including The IIA, the AICPA, the IMA, FEI, and the AAA). COSO is best known for its Internal Control Integrated Framework (1992, updated 2013).

Key publications:
- 2004: Enterprise Risk Management, Integrated Framework. This was the famous cube, showing 8 components (internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, monitoring) across 4 categories of objectives (strategic, operations, reporting, compliance) and across all levels of the entity.
- 2017: Enterprise Risk Management, Integrating with Strategy and Performance. This is the current version. It replaced the cube with a helix (ribbon) graphic that weaves risk management through the organization's mission, vision, strategy, business objectives, and enhanced performance. It has 5 components and 20 principles.

The five components of COSO ERM 2017:
1. Governance and Culture (5 principles): board risk oversight, operating structures, desired culture, commitment to core values, attracting and retaining capable individuals.
2. Strategy and Objective-Setting (4 principles): analyzing business context, defining risk appetite, evaluating alternative strategies, formulating business objectives.
3. Performance (5 principles): identifying risk, assessing severity, prioritizing risk, implementing risk responses, developing a portfolio view.
4. Review and Revision (3 principles): assessing substantial change, reviewing risk and performance, pursuing improvement in ERM.
5. Information, Communication, and Reporting (3 principles): leveraging information systems, communicating risk information, reporting on risk, culture, and performance.

COSO's definition of risk (2017): the possibility that events will occur and affect the achievement of strategy and business objectives.

Defining characteristics: COSO ERM is strategy-centric and performance-centric. It is heavily concerned with risk appetite, risk tolerance, the portfolio view of risk, and the role of the board. It integrates naturally with COSO's Internal Control framework and is widely used by companies subject to U.S. securities regulation and Sarbanes-Oxley. It is detailed and lengthy, with supporting application guidance and illustrative examples.

What Is ISO 31000?

Origin: Published by the International Organization for Standardization, a global federation of national standards bodies. ISO 31000 was first issued in 2009 and revised in 2018. Its full title is Risk management, Guidelines. The word Guidelines is important: ISO 31000 is not a certifiable standard. An organization cannot be certified as ISO 31000 compliant the way it can be certified to ISO 9001 or ISO 27001.

Companion documents: ISO Guide 73 (risk management vocabulary) and IEC 31010 (risk assessment techniques). The exam may test that ISO 31010 is the techniques document, not the framework itself.

ISO's definition of risk: the effect of uncertainty on objectives. A note clarifies that an effect is a deviation from the expected, and may be positive, negative, or both. This is the single most quoted phrase from ISO 31000 and frequently appears in exam questions.

Three-part structure of ISO 31000:2018:

1. Principles (8 principles, with value creation and protection as the purpose at the center): integrated; structured and comprehensive; customized; inclusive; dynamic; best available information; human and cultural factors; continual improvement.

2. Framework (with leadership and commitment at the center): integration, design, implementation, evaluation, and improvement. This follows a plan-do-check-act logic and is about embedding risk management into governance and the organization's activities.

3. Process: communication and consultation; establishing scope, context, and criteria; risk assessment (which is made up of risk identification, risk analysis, and risk evaluation); risk treatment; monitoring and review; and recording and reporting.

Defining characteristics: ISO 31000 is generic, concise (roughly 16 pages), and process-oriented. It is written to apply to any organization of any size, sector, or country, and to any type of risk. It uses the term risk criteria rather than risk appetite as its primary mechanism for deciding how much risk is acceptable, although the 2018 revision does reference the amount and type of risk an organization may take. It emphasizes human and cultural factors and the iterative, dynamic nature of risk management.

How the Two Frameworks Compare

Similarities (both frameworks):
- Are principles-based, not rule-based checklists.
- Link risk explicitly to the achievement of objectives.
- Apply enterprise-wide, across all levels and all risk types.
- Stress the importance of governance, leadership, and culture.
- Treat communication and reporting as integral, not an afterthought.
- Require ongoing monitoring, review, and continual improvement.
- Recognize that risk can include opportunity as well as threat.
- Are voluntary and non-certifiable.
- Can be used as criteria by internal audit when assessing risk management effectiveness.

Key differences:

Issuing body and origin: COSO is a U.S. private-sector body rooted in accounting, auditing, and financial reporting. ISO is an international standards organization with participation from national standards bodies worldwide.

Structure: COSO ERM is organized into components and principles (5 components, 20 principles). ISO 31000 is organized into principles, framework, and process (8 principles, a framework cycle, and a defined process).

Emphasis: COSO emphasizes strategy, performance, board oversight, risk appetite, and the integration of ERM with strategy-setting. ISO emphasizes a repeatable process, customization to context, and leadership commitment, with less direct focus on strategy formulation.

Terminology: COSO: risk appetite, risk tolerance, portfolio view, risk response, severity. ISO: risk criteria, risk treatment, risk assessment (identification, analysis, evaluation), risk owner, level of risk.

Length and detail: COSO ERM is a substantial document with extensive explanation, examples, and supporting guidance. ISO 31000 is deliberately brief and high level.

Relationship to internal control: COSO ERM is designed to sit alongside and build on COSO's Internal Control framework; control activities and reporting objectives are deeply embedded in its heritage. ISO 31000 is not an internal control framework and does not define control activities in the same way, although controls appear as part of risk treatment.

Visual models: COSO 2004 used the cube; COSO 2017 uses the helix ribbon woven through strategy and performance. ISO 31000 uses three interlinked diagrams: a principles wheel, a framework cycle, and a process flow.

Audience and adoption: COSO ERM is widely used in North America, in regulated and publicly listed companies, and in organizations already using COSO for internal control. ISO 31000 is widely adopted internationally, in the public sector, and in organizations already using other ISO management system standards.

How Internal Audit Uses the Frameworks in Practice

Internal audit does not have to choose one framework; it must understand which one (if any) the organization uses and evaluate the risk program against it. Typical uses include:
- ERM maturity assessments using the components and principles (COSO) or the principles, framework, and process (ISO) as criteria.
- Assurance over risk management processes, as required by IIA Standards, including whether risk responses or treatments are effective and whether risk reporting to the board is complete and reliable.
- Advisory work such as facilitating risk identification workshops or coaching management on risk appetite, keeping within the boundaries of the IIA position paper on internal audit's role in ERM (core assurance roles, legitimate consulting roles with safeguards, and roles internal audit should not undertake such as setting risk appetite or owning risks).
- Mapping COSO components to ISO process steps when the organization uses a hybrid model. For example, COSO's Performance component broadly corresponds to ISO's risk assessment and risk treatment steps; COSO's Governance and Culture component corresponds to ISO's leadership and commitment and its framework element on integration; COSO's Review and Revision aligns to ISO's monitoring and review plus evaluation and improvement.

Exam Tips: Answering Questions on Comparing COSO ERM and ISO 31000

Tip 1: Spot the signal words. Train yourself to associate vocabulary with the correct framework:
- Components, principles, risk appetite, portfolio view, strategy and performance, helix, cube, board oversight, risk response point to COSO ERM.
- Effect of uncertainty on objectives, principles-framework-process, risk criteria, risk treatment, risk analysis and evaluation, leadership and commitment, value creation and protection, customized, guidelines point to ISO 31000.

Tip 2: Know the numbers. COSO ERM 2017 has 5 components and 20 principles. COSO ERM 2004 had 8 components. COSO Internal Control 2013 has 5 components and 17 principles. ISO 31000:2018 has 8 principles. Exam questions sometimes mix these up deliberately; do not confuse COSO Internal Control principles with COSO ERM principles.

Tip 3: Remember that neither is certifiable. If an answer choice claims an organization can be certified against ISO 31000 or COSO ERM, it is wrong. ISO 31000 is explicitly a guideline document.

Tip 4: Watch for the definition of risk. If the question quotes the effect of uncertainty on objectives, the answer is ISO. If it refers to the possibility that events will occur and affect the achievement of strategy and business objectives, the answer is COSO 2017.

Tip 5: Do not rank them as better or worse. The CRMA takes the view that both are credible and that the best framework is the one that fits the organization's size, complexity, regulatory environment, and existing management systems. If a question asks what internal audit should do when management uses a framework different from the one the auditor prefers, the correct response is to evaluate the risk process against the framework management has adopted and against generally accepted good practice, not to insist on a different framework.

Tip 6: Understand the mapping logic. Questions may describe an activity (for example, management evaluates whether each identified risk falls within acceptable limits using predefined thresholds) and ask which element it represents. Under ISO this is risk evaluation against risk criteria; under COSO it is assessing severity and prioritizing risk within risk appetite and tolerance. Be able to translate between the two.

Tip 7: Know what ISO 31000 is not. ISO 31010 is the risk assessment techniques document; ISO Guide 73 is the vocabulary. ISO 31000 itself does not prescribe specific techniques such as bow-tie analysis or Monte Carlo simulation.

Tip 8: Connect to internal audit's role. Many comparison questions end with an internal audit angle. Remember that internal audit's core role is to provide assurance on risk management processes, on the evaluation of key risks, and on risk reporting. Internal audit should not set risk appetite, make risk response decisions, or take accountability for risk management. Whichever framework appears in the scenario, these boundaries do not change.

Tip 9: Use the historical timeline. COSO IC 1992, COSO ERM 2004, ISO 31000 2009, COSO IC 2013, COSO ERM 2017, ISO 31000 2018. Questions referencing the cube or eight components are describing the old COSO ERM, and the best answer may note that this version has been superseded.

Tip 10: Read for emphasis, not just facts. When a question asks which framework places greater emphasis on strategy-setting and performance, the answer is COSO. When it asks which is more generic, concise, and applicable to any organization regardless of sector or jurisdiction, the answer is ISO 31000. When it asks which was developed by a body with roots in accounting and internal control, the answer is COSO.

Quick Revision Summary

COSO ERM 2017: U.S.-origin; integrates risk with strategy and performance; 5 components and 20 principles; helix graphic; risk appetite and portfolio view; closely tied to COSO Internal Control; detailed and lengthy; voluntary.

ISO 31000:2018: International; risk is the effect of uncertainty on objectives; principles (8), framework (leadership and commitment), and process (communication and consultation, scope-context-criteria, risk assessment, risk treatment, monitoring and review, recording and reporting); risk criteria; generic and concise; guidelines, not certifiable.

Both: principles-based, objectives-focused, enterprise-wide, emphasize culture and governance, require monitoring and continual improvement, and serve as legitimate criteria for internal audit assurance over risk management.

Master these distinctions and you will handle the CRMA's framework comparison questions with confidence, whether they are phrased as direct recall, scenario identification, or application to internal audit's role.