Environmental, Social and Governance (ESG) - Principles and Practice · Risk Management

Enterprise Risk Management Frameworks: COSO ERM and ISO 31000

Updated 11 October 2026 · Fact-checked

Enterprise risk management (ERM) is a company-wide, structured way to identify, assess, respond to and monitor risks that affect its objectives. A framework gives the structure. COSO ERM (2017) links risk to strategy and performance through five components. ISO 31000 gives principles, a framework and a process. In exams, name, explain and apply them to the facts.

Understand Enterprise Risk Management Frameworks

Enterprise risk management (ERM) treats risk as a whole-company matter. Instead of each department handling its own risks separately, ERM looks at all risks together, across strategy, operations, finance, compliance and reputation. The aim is to help the company meet its objectives and protect and create value.

A framework is a ready structure for doing this. It tells the board and management what to set up, who does what, and how to keep it running. Without a framework, risk work becomes ad hoc and stops after one exercise.

Two frameworks matter most for your exam. COSO ERM is the framework of the Committee of Sponsoring Organizations of the Treadway Commission. Its 2017 version is titled 'Enterprise Risk Management: Integrating with Strategy and Performance'. It has five interrelated components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting. It also lists 20 principles spread across these components.

ISO 31000 is an international standard on risk management (the current edition is ISO 31000:2018). It is a guideline, not a certification standard. It has three elements: principles (eight in the 2018 edition; the 2009 edition had eleven), a framework, and a process. Use the 2018 version. Its principles say risk management should be integrated, structured and comprehensive, customised, inclusive, dynamic, based on best available information, mindful of human and cultural factors, and continually improving. Its main aim is to create and protect value.

The ISO 31000 process runs through: communication and consultation; scope, context and criteria; risk assessment (identification, analysis, evaluation); risk treatment; monitoring and review; recording and reporting. The framework part covers leadership and commitment, integration, design, implementation, evaluation and improvement.

The key difference: COSO ERM is built around the link between risk, strategy and performance and is widely used for internal control and governance. ISO 31000 is a generic, principles-based guide that suits any organisation and any type of risk. Neither is mandatory in India by itself; a company chooses or adapts one to its size and needs.

Key rules to remember

COSO ERM (2017) components: Governance and Culture + Strategy and Objective-Setting + Performance + Review and Revision + Information, Communication and Reporting; Five components, 20 principles. The components are interrelated, not a strict one-way sequence. Learn the order as given.
ISO 31000:2018 principles: Integrated; Structured and comprehensive; Customised; Inclusive; Dynamic; Best available information; Human and cultural factors; Continual improvement; Eight principles. The central purpose is the creation and protection of value.
ISO 31000 risk management process: Communication and consultation + Scope, context, criteria → Risk assessment (identify, analyse, evaluate) → Risk treatment → Monitoring and review → Recording and reporting; Communication and consultation, and monitoring and review, run alongside all other steps.
ISO 31000 three elements: Principles + Framework + Process; Principles guide, the framework embeds risk management in the organisation, the process applies it to decisions.
Core difference: COSO ERM = risk linked to strategy and performance; ISO 31000 = generic principles-based guideline; Use this one-line contrast to open any 'distinguish' answer.

How to solve Enterprise Risk Management Frameworks questions

Use this method for any question on ERM or its frameworks, whether it asks you to explain, distinguish or apply.

1Read the verb. 'Explain' needs components or principles with meaning. 'Distinguish' needs a point-wise comparison. 'Advise' needs application to facts.
2Open with a one-line definition of ERM: a company-wide, structured approach to managing risks against objectives.
3Name the framework correctly, with its issuer and version (COSO ERM 2017; ISO 31000:2018).
4List the components, principles or process steps in the correct order, with one line of explanation each.
5If facts are given, link each point to the facts. Quote the company's situation, such as a new market, a cyber incident or a supply chain failure.
6For comparison questions, use at least five heads: origin, focus, structure, approach, use. Keep both sides in each head.
7Close with a conclusion: which framework suits the company and who is responsible (board, risk committee, management, company secretary).
8Check your answer for any mix-up between COSO and ISO terms before moving on.

Quickest way: Two-framework memory grid

When to use it: Use when you have about ten minutes for a 10-mark question and need a safe structure fast.

Write ERM definition in one sentence.
Draw a two-column grid in your head: COSO ERM and ISO 31000.
Under COSO, write the five components in order, with the 20 principles mentioned.
Under ISO, write principles, framework and process, then the process steps.
Add one line of contrast: strategy-and-performance focus versus generic guideline.
Finish with one practical point on board oversight and the risk committee.

Common mistakes in Enterprise Risk Management Frameworks

Mixing up the COSO ERM 2004 'cube' components (such as internal environment and objective setting) with the 2017 five components.
Older books and notes still show the eight-component 2004 model.
Fix: Use the 2017 five components only. Mention 2004 only if the question asks about evolution.
Calling ISO 31000 a certifiable standard or a legal requirement.
Many ISO standards are certifiable, so students assume this one is too.
Fix: Write that ISO 31000 provides guidelines. It is not meant for certification and is not mandatory by itself.
Listing ISO 31000 principles from memory with the wrong count.
The 2009 edition had eleven principles and the 2018 edition has eight.
Fix: State the edition and use the eight principles of 2018, with value creation and protection as the purpose.
Treating the ISO process as a one-time, straight line.
Diagrams show arrows moving forward.
Fix: State that the process is iterative and that communication, consultation, monitoring and review continue throughout.
Writing a theory answer with no link to the case facts.
Students learn definitions but not application, though questions often test application to given facts.
Fix: After each point, add a sentence tying it to the company in the question.
Confusing risk assessment with risk treatment.
Both appear in the process and sound similar.
Fix: Assessment = identify, analyse, evaluate. Treatment = decide and act: avoid, reduce, share or accept.

Worked examples

Example 1

Bharat Auto Components Ltd has grown by entering export markets, but its risk reviews are done separately by each plant and are never reported to the board. The board asks you, as company secretary, to explain how adopting COSO ERM would help. (10 marks)

Show the solution

Provision: COSO ERM (2017) is a framework that integrates risk management with strategy and performance across the whole enterprise.
Analysis, Governance and Culture: the board would set oversight, define roles and the desired risk culture. This fixes the gap of risks not reaching the board.
Analysis, Strategy and Objective-Setting: export expansion would be assessed against the company's risk appetite before approval.
Analysis, Performance: risks at all plants would be identified, assessed, prioritised and responded to in one portfolio view, not plant by plant.
Analysis, Review and Revision: management would periodically review how the risk practices and performance change with growth.
Analysis, Information, Communication and Reporting: regular reporting from plants to management and the board would be set up.
Conclusion: adopting the framework turns scattered plant-level reviews into a single enterprise view, with the board accountable for oversight.

Answer: COSO ERM would give Bharat Auto a company-wide structure: board oversight and culture, risk-aware strategy for exports, a consolidated portfolio of risks, periodic review, and regular reporting to the board through its five components.

Example 2

Distinguish between COSO ERM and ISO 31000. (6 marks)

Show the solution

Issuer: COSO ERM is issued by the Committee of Sponsoring Organizations of the Treadway Commission. ISO 31000 is issued by the International Organization for Standardization.
Focus: COSO ERM stresses integrating risk with strategy and performance. ISO 31000 stresses creating and protecting value through generic risk management.
Structure: COSO ERM has five components and 20 principles. ISO 31000:2018 has eight principles, a framework and a process.
Process: COSO places risk in the Performance component (identify, assess, prioritise, respond). ISO 31000 has a separate, iterative process: communication and consultation; scope, context and criteria; risk assessment; risk treatment; monitoring and review; and recording and reporting.
Nature: both are voluntary guidance. ISO 31000 is a guideline and not meant for certification.
Use: COSO ERM is widely used for governance and internal control linkage. ISO 31000 suits any organisation and any kind of risk.

Answer: COSO ERM is a five-component, 20-principle framework linking risk to strategy and performance. ISO 31000:2018 is a generic guideline with eight principles, a framework and an iterative process. Both are voluntary, and a company may adopt either or combine them.

Exam tips

Learn the five COSO ERM 2017 components in order and be ready to attach one line to each.
Always state the ISO 31000 edition. Use the eight principles of 2018.
For 'distinguish' questions, give at least five points in a two-column layout of heads, and state the key contrast first.
In case-based questions, name the company's actual risk and map it to a component or process step.
Finish with the board's and company secretary's role; this links the topic to the governance chapters.

Practice questions from Risk Management

Enterprise Risk Management Frameworks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Enterprise Risk Management Frameworks: frequently asked questions

What are the components of COSO ERM?

The 2017 COSO ERM framework has five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication and Reporting. They are supported by 20 principles. Together they link risk management to strategy and performance.

What are the principles of ISO 31000?

ISO 31000:2018 lists eight principles. Risk management should be integrated, structured and comprehensive, customised, inclusive, dynamic, based on best available information, considerate of human and cultural factors, and continually improved. Its purpose is to create and protect value.

What is the main difference between COSO ERM and ISO 31000?

COSO ERM is organised around five components and links risk to strategy and performance. ISO 31000 is a generic guideline built on principles, a framework and a process. Both are voluntary, and companies may adopt either one.

Is ERM mandatory for Indian companies?

No specific framework is mandatory. However, risk management duties arise under company and listing law, and these are covered in the related topics on risk governance and regulatory requirements. Check those topics for the exact provisions.