COSO ERM Components and Principles

Why This Topic Matters

The COSO Enterprise Risk Management framework is the most widely referenced ERM model in the world, and it sits at the heart of the Risk Management Governance domain of the IIA Certification in Risk Management Assurance (CRMA). Internal auditors are expected to provide assurance over how well an organization identifies, assesses, responds to, and reports on risk. To do that credibly, you need a benchmark, and COSO ERM is the benchmark the exam assumes you know. Questions in this area test whether you can recognize the five components and twenty principles of the 2017 framework, Enterprise Risk Management - Integrating with Strategy and Performance, distinguish it from the older 2004 cube, and apply the principles to realistic scenarios about boards, management, risk appetite, and risk culture. Candidates who can only recite the component names tend to miss scenario questions; candidates who understand what each principle is trying to achieve tend to score well.

What COSO ERM Is

COSO (the Committee of Sponsoring Organizations of the Treadway Commission) published its original ERM Integrated Framework in 2004 and a substantially revised version in 2017. The 2017 framework defines enterprise risk management as the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value. Three ideas in that definition drive the whole framework:

1. Culture, capabilities, and practices - ERM is not a department or a checklist; it is how the organization behaves.
2. Integrated with strategy-setting and performance - risk is considered when strategy is chosen, not only after.
3. Creating, preserving, and realizing value - ERM exists to support value, not merely to prevent loss.

The 2017 framework replaced the familiar 2004 cube with a ribbon or helix graphic that weaves five components through the business lifecycle: mission, vision and core values; strategy development; business objective formulation; implementation and performance; and enhanced value. The message is that risk management runs through everything rather than sitting alongside it.

The Five Components and Twenty Principles

Memorize the structure as 5-4-5-3-3. Each component contains a set of principles, and each principle describes a practice that must be present and functioning for ERM to be effective.

Component 1: Governance and Culture (Principles 1-5)
Governance sets the tone and establishes oversight; culture concerns ethical values, desired behaviors, and understanding of risk.
- Principle 1: Exercises Board Risk Oversight - the board oversees strategy and carries out governance responsibilities to support management in achieving strategy and business objectives.
- Principle 2: Establishes Operating Structures - the organization establishes operating structures in pursuit of strategy and business objectives.
- Principle 3: Defines Desired Culture - the organization defines the desired behaviors that characterize its culture.
- Principle 4: Demonstrates Commitment to Core Values - the organization demonstrates a commitment to its core values.
- Principle 5: Attracts, Develops, and Retains Capable Individuals - the organization is committed to building human capital aligned with strategy and objectives.

Component 2: Strategy and Objective-Setting (Principles 6-9)
This component is where ERM, strategy, and objectives work together. Risk appetite is established and aligned with strategy, and business objectives put strategy into practice.
- Principle 6: Analyzes Business Context - the organization considers potential effects of business context (internal and external environment) on its risk profile.
- Principle 7: Defines Risk Appetite - the organization defines risk appetite in the context of creating, preserving, and realizing value.
- Principle 8: Evaluates Alternative Strategies - the organization evaluates alternative strategies and their potential impact on the risk profile.
- Principle 9: Formulates Business Objectives - the organization considers risk while establishing business objectives at various levels that align with and support strategy.

Component 3: Performance (Principles 10-14)
Risks that may affect achievement of strategy and objectives are identified, assessed, prioritized, and responded to, and results are reported to key stakeholders.
- Principle 10: Identifies Risk - the organization identifies risk that impacts the performance of strategy and business objectives.
- Principle 11: Assesses Severity of Risk - the organization assesses the severity of risk (likelihood, impact, velocity, persistence) often using inherent, target residual, and actual residual views.
- Principle 12: Prioritizes Risks - the organization prioritizes risks as a basis for selecting responses, considering adaptability, complexity, velocity, persistence, and recovery.
- Principle 13: Implements Risk Responses - the organization identifies and selects risk responses: accept, avoid, pursue, reduce, share.
- Principle 14: Develops Portfolio View - the organization develops and evaluates a portfolio view of risk across the entity.

Component 4: Review and Revision (Principles 15-17)
By reviewing performance, the organization can consider how well the ERM components are functioning over time and what revisions are needed.
- Principle 15: Assesses Substantial Change - the organization identifies and assesses changes that may substantially affect strategy and business objectives.
- Principle 16: Reviews Risk and Performance - the organization reviews entity performance results and considers risk.
- Principle 17: Pursues Improvement in Enterprise Risk Management - the organization pursues improvement of ERM.

Component 5: Information, Communication, and Reporting (Principles 18-20)
ERM requires a continual process of obtaining and sharing information from internal and external sources, flowing up, down, and across the organization.
- Principle 18: Leverages Information and Technology - the organization leverages information systems to support ERM.
- Principle 19: Communicates Risk Information - the organization uses communication channels to support ERM.
- Principle 20: Reports on Risk, Culture, and Performance - the organization reports on risk, culture, and performance at multiple levels and across the entity.

How the Framework Works in Practice

Think of the components as a flow rather than a list. Governance and culture create the environment in which risk can be discussed honestly. Within that environment, leadership analyzes context, sets risk appetite, chooses a strategy, and cascades objectives. Once strategy is in motion, the performance component identifies and assesses the risks to those objectives, selects responses, and aggregates everything into a portfolio view so the board can see the risk profile as a whole rather than as isolated items. Review and revision keeps the system honest by asking whether the risk profile has shifted and whether ERM itself is improving. Information, communication, and reporting is the connective tissue that lets each of the other components function.

Some practical concepts the exam expects you to understand within this flow:

- Risk appetite versus risk tolerance: appetite is the broad amount of risk the entity is willing to accept in pursuit of value; tolerance is the acceptable variation in performance around a specific objective. Appetite is set at the strategic level; tolerance operationalizes it.
- Risk profile: a composite view of the types, severity, and interdependencies of risks the entity faces.
- Portfolio view: the aggregate picture that allows management to see concentrations, correlations, and whether the whole is within appetite even if individual risks look acceptable.
- Inherent, target residual, and actual residual risk: inherent is risk absent any response; target residual is the level desired after planned responses; actual residual is what remains in reality. Gaps between target and actual signal the need for additional action.
- Pursue as a risk response: unique to the 2017 framework, this recognizes that an organization may deliberately take on more risk to achieve higher returns, reinforcing that ERM is about value creation.

2004 Cube versus 2017 Framework

Exam questions frequently test whether you know which version a concept belongs to.

The 2004 Integrated Framework used a cube with eight components: Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information and Communication, and Monitoring. It mapped these against four objective categories (strategic, operations, reporting, compliance) and against entity levels (entity, division, business unit, subsidiary). Risk responses were avoid, reduce, share, and accept.

The 2017 framework has five components and twenty principles, uses the ribbon graphic, elevates culture and strategy, adds pursue as a response, introduces the portfolio view and risk profile language explicitly, and removes control activities as a separate ERM component because controls are addressed in the COSO Internal Control framework. If a question mentions a cube, eight components, event identification, or control activities, it is pointing at 2004. If it mentions principles, culture, strategy integration, or value realization, it is pointing at 2017.

The Internal Auditor and CRMA Perspective

The CRMA is an assurance certification, so the exam will frame COSO ERM through the lens of what internal audit should evaluate and how. Key points:

- Internal audit provides independent assurance on the design and effectiveness of ERM, using COSO ERM as criteria.
- Internal audit should not own risk management, set risk appetite, or decide risk responses. Those are management and board responsibilities. Internal audit may facilitate workshops or advise, but with safeguards to protect independence.
- The board exercises risk oversight (Principle 1); management owns and executes ERM; internal audit evaluates and reports. This aligns with the Three Lines Model.
- When assessing maturity, auditors look for whether each principle is present (designed and in place) and functioning (operating as intended), and whether components operate together in an integrated manner.
- Weak culture (Principles 3 and 4) is often the root cause behind failures in later components; auditors should trace symptoms back to governance and culture.

Exam Tips: Answering Questions on COSO ERM Components and Principles

1. Lock in the structure 5-4-5-3-3. Governance and Culture has five principles, Strategy and Objective-Setting has four, Performance has five, Review and Revision has three, and Information, Communication, and Reporting has three. If a question asks how many principles support a component, this pattern answers it instantly.

2. Memorize the principle verbs. Each principle starts with an action word: Exercises, Establishes, Defines, Demonstrates, Attracts; Analyzes, Defines, Evaluates, Formulates; Identifies, Assesses, Prioritizes, Implements, Develops; Assesses, Reviews, Pursues; Leverages, Communicates, Reports. Questions often quote a principle and ask which component it belongs to. The verb plus its object usually gives it away.

3. Watch for the two Defines and the two Assesses. Defines Desired Culture is Governance and Culture; Defines Risk Appetite is Strategy and Objective-Setting. Assesses Severity of Risk is Performance; Assesses Substantial Change is Review and Revision. Distractors exploit these pairs.

4. Separate risk appetite from risk tolerance. If the scenario describes the overall amount of risk acceptable in pursuit of strategy, the answer is appetite. If it describes acceptable variation around a specific performance target, it is tolerance.

5. Know all five risk responses and that pursue is 2017-only. Accept, avoid, pursue, reduce, share. A question offering pursue as a response is signaling the 2017 framework; one offering only four responses may be testing 2004.

6. Date the framework from clues. Cube, eight components, event identification, control activities, and monitoring point to 2004. Principles, helix or ribbon, culture, portfolio view, and value creation point to 2017. The CRMA exam leans heavily on 2017 but may reference 2004 to test your ability to distinguish them.

7. Respect role boundaries. If an answer choice has internal audit setting risk appetite, deciding risk responses, or owning the risk register, it is almost always wrong. The board oversees, management owns, internal audit assures.

8. Read scenario questions for the root cause. When a case describes risk responses that are ignored, risks that are hidden, or reports that are inaccurate, ask whether the real failure is in culture, governance, or communication rather than in the performance component where the symptom appears. The best answer often sits one component upstream.

9. Prefer integrated and value-oriented answers. COSO 2017 repeatedly stresses integration with strategy and the creation, preservation, and realization of value. Answers that treat ERM as a compliance exercise or a standalone function are usually distractors.

10. Use the portfolio view as a discriminator. If a question describes aggregating risks across the entity, considering correlations, or assessing whether total risk is within appetite, the answer involves the portfolio view under Principle 14, not individual risk assessment under Principle 11.

11. Eliminate absolutes. Answer choices with words like always, never, eliminates, or guarantees are rarely correct in a framework that explicitly accepts uncertainty and treats residual risk as normal.

12. Practice mapping. Before the exam, take a blank page and write the five components, then list the twenty principles under them from memory, including their numbers. Repeat until the mapping is automatic. This single exercise converts most COSO ERM questions into quick recall items and frees your time for the longer scenario questions elsewhere in the exam.

Summary

COSO ERM 2017 describes risk management as culture, capabilities, and practices integrated with strategy and performance to create, preserve, and realize value. It is organized into five components - Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting - supported by twenty principles in a 5-4-5-3-3 pattern. For the CRMA exam, know the components, the principles and their numbers, the five risk responses including pursue, the distinction between appetite and tolerance, the differences from the 2004 cube, and the proper role of internal audit as an independent provider of assurance rather than an owner of risk. With that foundation, both recall and scenario questions on COSO ERM become manageable and predictable.