The Coso's ERM Framework Model

Introduction

Traditionally, risk management mainly focused on the pure risks within an organisation, including health and safety, fire, floods, earthquakes and fraud. In addition, various departments with an organisation managed their risks separately, with no oversight or communication of how the risks in some departments may affect the other risks within the organisation, including strategic risks. As indicated by Chapman (2006), within both private and public organisations, risk management has traditionally been segmented and carried out in “silos”. Moreover, as the focus was on pure risks, risk management was mainly based on the transferring of the operational and hazard risks, through insurance (Dickinson, 2001).

Since the 1990s,

However, an organisation’s ERM process should not be a tick box or static exercise but should be continuously monitored and aligned with the organisation’s strategy and objectives, taking also into consideration the risk appetite of its stakeholders (Fraser and Simkins, 2010) and also the external business environment.

A widely-accepted ERM framework is the COSO’s enterprise risk management cube model, which is being used by a number of organisations. The cube diagram illustrates the link between four objectives categories (strategic, operations, reporting and compliance), eight components (internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring) and the organisation’s units. According to the COSO (2004) report, the cube model portrays the ability of organisations to focus on the whole risk management, or by objectives category, component or organisation’s unit. The diagram also depicts that the eight components are interrelated and that it is a multidirectional process rather than a sequential

In fact, enterprise risk is the ultimate responsibility of the board of directors, while also being accountable to shareholders and other stakeholders (Dickinson, 2001). In order to manage strategic risks effectively, the Board and senior management should understand the risk appetite of the other stakeholders. The board should also make sure that risk management and the organisation’s strategic objectives are aligned with the goal of maximizing shareholders’ wealth, through optimising risk and reward (Fraser and Simkins, 2010) However this also entails senior management to promote a risk-aware culture (Hopkin, 2014), aligned with the overall corporate strategy and objectives and embedded within the risk management activities (Fraser and Simkins, 2010, IRM, 2012). Therefore the way people work, their values, attitudes and behaviour are key to the successful implementation of a risk management process. However this also means that companies will need to be open and flexible to change. Hopkin (2014) describes that a successful risk culture would comprise of LILAC, which was originally suggested by the UK Health and Safety Executive. LILAC demonstrates that leadership, involvement, learning, accountability and communication are five necessary components which should be embedded within an organization