WRITTEN ASSIGNMENT: ENTERPRISE RISK MANAGEMENT (ERM)

By

Sneha Sathyanarayana
Matriculation ID: 42202134
Date: 31.12.2022

Berlin, Germany
Course: Business Ethics and Corporate Governance
Course Code: DLMBAEBECG01
Course Tutor: Zeljko Sevic
M.A. International Management – 120 ECTS, English

Version: 31122022-SnehaSathyanarayana-DLMBAEBECG01-ThirdAttempt

TABLE OF CONTENTS

Abstract 4
Page 1 of 21
 1. Introduction to ERM 5
1.1. Conceptualization of ERM 5
1.2. Importance of ERM 6
1.2.1. ERM from governance perspective 6
1.2.2. ERM’s value for Business Ethics 7

2. Risk Management framework (RMF) 9

2.1. COSO Model 12
2.2. COSO impact 16
2.3. COSO relevance to meet technology demands 17

Conclusion 18

References 19

Appendices A: List of Figures 21

LIST OF FIGURES:

Figure 1 Five elements of ERM process Page 10

Page 2 of 21
Figure 2 COSO Cube and Three lines of Defense Model Page 12

Figure 3 COSO Executive Summary framework Page 15

ABBREVATIONS:

ERM Enterprise Risk Management

IRM Integrated risk management
BCM Business Continuity Management
RMF Risk Management Framework
CRO Chief Risk officer
COSO Committee of Sponsoring Organization
ISO International Organization for Standardization
SOX Sarbanes–Oxley Act
CEO Chief Executive Officer

Purpose

This document is a written assignment, submitted for evaluation as part of the M.A. International
management – 120 ECTS study programme at the International University of Applied Sciences
Page 3 of 21
(IUBH), in Berlin, Germany, under the course “Business Ethics and Corporate Governance” –
DLMBAEBECG01.

Course guides from tutors Zeljko Sevic, IUBH and Hema Doreswamy, Upgrad inspired this docu-
ment.

Abstract

It is inevitable that all companies will face risk, but rewards are less likely without risk. It is also true
that too much risk can lead to the failure of a business. The goal of risk management is to find the
right balance between taking risks and reducing them at the same time.

Organizations that manage risks effectively can add value to their operations. A company's ability
to withstand market crashes is heavily dependent on risk management, especially for enterprises
relying on huge financial investments.

An organization's capital base and earnings should be protected through an effective risk manage-
ment framework without compromising growth. Further, companies that manage risk well are more
likely to attract investors. As a result, the firm is typically able to access capital easier, lower bor -
rowing costs, and perform better in the long term. These are the prime corporate governance
goals.

This academic paper emphasizes the following:

I. Conceptualization of Enterprise Risk Management (ERM) and its value to corporate gov-
ernance and business ethics. An overview of various enterprise risks and response
strategies.
II. Detailed explanation of COSO, one of the enterprise risk management frameworks (RMF),
its impact and relevance to global risk management needs.
III. A futuristic vision of technology driven ERM and its adaptation.

The citations include all online sources of information.

1. Introduction to ERM
Page 4 of 21
I lead by inferring from Mark Beasley’s statement, “Leaders of organizations must manage risks in
order for the entity to stay in business.”; (Beasley, ERM Professional Insights, 2020) Enterprise risk
management referred to as ERM, is a framework aiming to manage the risks facing an organiza-
tion. Organizational risk encompasses a wide range of factors. Employee safety and data security
are among the concerns it can address, as are compliance with statutory regulations and prevent-
ing fraud. In addition to internal risks, such as equipment malfunctions, there can also be external
risks, such as natural disasters. Each entity determines what constitutes risk differently and per-
form some form of risk assessment for sustainability.

1.1. Conceptualization of Enterprise Risk Management

The concept of managing risk typically involves minimizing damage to the value the organization
creates for itself, employees, shareholders, customers, and the community. Organizations use
ERM frameworks to manage anticipated risks so that they can achieve their corporate governance
objectives successfully.

Traditional vs Modern ERM

By using systematic risk mapping, enterprise risk management enhances decision-making and in-
creases the probability of reaching tactical and analytical goals. Silos or stove-pipe risk manage-
ment is a traditional approach to risk management in which each silo leader manages risks within
his or her silo. (Beasley, ERM Professional Insights, 2020) In modern risk management, the goal is
to increase the chances that an organization will reach its objectives rather than just generating a
list of potential problems. It is about fostering a culture of risk awareness in the workplace, so em-
ployees can make informed decisions. Providing businesses with constant, coordinated, and
aligned risk management solutions is the mission of ERM.

ERM to achieve Business Continuity

Maintaining business continuity requires proper risk management. Business continuity manage-
ment (BCM) and enterprise risk management (ERM) are closely related. BCM involves identifying
potential threats and planning ahead for them in the event that they become real. This is so that
customers, suppliers, and employees can expect service as expected. (Alexander, 2017)

Therefore, the key highlights of ERM are:

I. Ensure the safety of the enterprise from potential harm.

II. Improve business performance by creating opportunities.

IRM vs ERM

Page 5 of 21
Integrated risk management (IRM) considers all kinds of risks a business face in order to manage
risks holistically. Risks range from financial to operational to reputational. Businesses can improve
their ability to manage risks by taking a holistic view of the issue. A technical control or feature is
implemented across a system or organization through an IRM process. IT infrastructure monitor-
ing, data controls, and perimeter protection are among them.

Similarly, to IRM, enterprise risk management also focuses on all the different kinds of risks that a
business faces as part of its overall strategy. Furthermore, ERM takes into account the interrela-
tionships among the risks. A more comprehensive and effective approach to managing risks can
be developed by understanding the correlation between different types of risks.

Types of Enterprise risks:

Compliance Risk, Legal Risk, Strategic Risk, Operational Risk, Security Risk, Financial Risk, Eth-
ical Risk. In almost every case, ERM can help formulate plans to deal with business risks. Various
types of business risks can threaten a company's survival, and these risks can be further categor-
ized as Reputational - A failure that damages investor, regulator, customer, partner, employee, and
community confidence. Sustainability Risk - A company's potential impact on the environment or
human well-being. (LaConte, 2017)

1.2. Importance of ERM

1.2.1. ERM from a governance perspective

ERM has been a topic of much debate for corporations since it was introduced. Effective risk man-
agement depends on sound corporate governance. The importance of corporate governance in in-
creasing economic efficiency is widely accepted. This in turn keeps a healthy balance between a
company's management, board, and shareholders. Managing risks is divided into organizational
responsibilities, which are outlined in corporate governance. In order to achieve its objectives, any
entity that implements corporate governance must control its risks. This is because the environ-
ment and the firm in which it operates can be unpredictable about threats and opportunities. Man-
aging risk and allocating duties within corporate governance is justified at each level and within a
reasonable framework. Besides improving a firm's internal and external compliance, it increases its
understanding of business risks, belief in strategic goals, and operational efficiency. Risk detection
and control are essential to achieving an organization's strategic goals. Taking calculated risks and
benefiting from them can also be empowered by ERM when it is fully implemented. (SOBEL, Align-
ing Corporate Governance with Enterprise Risk Management, 2004, pp. 30-34)

ERM principles in relation to corporate governance (CG) principles

Page 6 of 21
ERM has the distinct advantage of tying in well with the evolution of corporate governance prin-
ciples. The principles of ERM are compatible with the tenets of government accountability and
transparency, so government boards can easily consider implementing it. (HM Government, 2020)

Accountability It is the organization's responsibility to ensure that ERM's success is

sustainable. Accountability for delivering quality work to clients drives
ERM's success now and into the future.

Commitment ERM leadership will lead by example to ensure that all ERM employ-
ees understand that management supports the principles of ERM
and its commitment to excellence.

Ethics Ensure that ERM's operations are conducted with uncompromising

honesty and integrity, and maintain the highest ethical and legal
standards in its operations.

Transparency In order for ERM's corporate governance to be effective, information

must be communicated timely and accurately, particularly to the com-
pany's upper management. Concerns brought to the board's atten-
tion will be addressed with appropriate consideration of individual
rights. (ERM, n.d.)

The integration of corporate governance (CG) with enterprise risk management (ERM) will con-
tinue to be a challenge for organizations. ERM and governance practices require ongoing adapta-
tion by directors, senior management, risk owners, internal auditors, and external auditors. Before
implementing ERM, many businesses consider the factors: shareholder value, risk mitigation, elim-
inating solos, and consolidating processes. (Horvath, What is Enterprise Risk Management (ERM),
2022) Communication, roles, and structure of ERM and governance all overlap, and each has an
impact on the other. It is critical for all stakeholders to work together to align their organization's
governance with its ERM procedures. (SOBEL, Aligning Corporate Governance with Enterprise
Risk Management, 2004)

1.2.2. ERM’S value for Business Ethics

Ethics-based risk governance is the basis of effective ERM. As a result, it has evolved into a
concept that helps firms protect their investors' value while also increasing profits. A thorough in-
ternal audit should be conducted as part of the integration of risk management and compliance. In
order to be most effective, the CRO should report directly to the board. (SOBEL, Aligning Corpor-
ate Governance with Enterprise Risk Management, 2004) A proactive ethical culture should under-

Page 7 of 21
pin a corporate governance code. It should be adaptable to any situation, no matter how challen-
ging or difficult.

Globally, audits are one of the most common hurdles in implementing ethical risk governance,
committee duties, risk committees, CEO sponsorship, and SOX. (McNutt, 2008) Ethics are an in-
tegral part of successful business operations. Customer service, reputation management, and at-
tracting the most qualified employees and partners are their responsibilities. It is imperative to have
high ethics in order to set the tone at the top and establish a positive company culture, all of which
are essential to establishing an effective ERM. It is crucial for organizations to clearly define their
roles and responsibilities when it comes to ethics, compliance, or enterprise risk management. The
relationship between ethics and ERM is explained as follows by the ERM Initiative faculty.

The Business: There is no doubt that this is the first line of defense. Risk must be assumed and
managed effectively in accordance with the board's and senior management's risk appetites and
tolerance levels.

Key support functions: Risk management and compliance are examples of the second line of de-
fense. Organizations rely on them to set up compliance, ethics, and risk management programs.

Internal Audit: As the third line of defense, Internal Audit is responsible for verifying and assessing
the effectiveness of the organization's controls.

Senior management: In order to develop an effective enterprise-wide risk management strategy,

the fourth line of defense must promote a culture of ethical behavior, compliance, and effective
leadership.

The board: In order to maintain ethical standards, the board of directors oversees management's
performance. (Faculty, 2011)

ERM best practices

From the discussion so far, it is possible to deduce ERM best practices organisations must adapt
in its governance framework.

 Obtain the board's and top management's support.

 Involve managers and employees in the process.
 Build ERM incrementally by starting with a few key risks.
 Utilize existing knowledge, skills, and resources to manage internal audits and comply with
regulations.
 Embrace ERM as an integral part of the organization's culture.

Page 8 of 21
  Ensure that organizations take a holistic, portfolio-based approach to risk management
rather than in silos.
 The ERM process, not the project, should be viewed as the focus of the ERM initiative.
 ERM should be strategic and forward-looking and not encumbered by details and history.
 ERM shouldn't be left to a few key staff - it should be everyone's responsibility.
 Risks can have an impact on other parts of the business, so don't ignore them.
 Focus on identifying the key risks and developing mitigation plans, rather than obsessing
over categorizing risks.
 Complacency is the biggest enemy of effective risk management - there will always be un-
known unknowns and systematic risk management is not complete without knowing these
unknowns.

While ERM has made a significant contribution to risk management, it still has limitations.

ERM is reactive instead of proactive: Organisations may have to deal with future risks more seri-
ously than they previously had to deal with using traditional risk management. ERM remains react-
ive because there is no evidence that it can predict future risks and their consequences.

ERM doesn’t calculate mitigation costs: There are two ways in which management addresses each
identified risk. Consequences are weighed against the likelihood and severity of risk, which define
risk. Risk mitigation costs are now assigned to risk, so decision-makers need to recognize them so
they can appropriately address them. A lack of capability to calculate mitigation costs in the ERM
frameworks will lead management to ignore the results. (McKenzie, 2018)

ERM practices were standardized to overcome these limitations. A business's ongoing activities
should incorporate risk management into its strategic management. Among the most widely refer-
enced frameworks are the COSO – ERM Integrated Framework of the Committee of Sponsoring
Organizations of the Treadway Commission; and the IRM and Airmic – A structured approach to
ERM and ISO 31000 guidance. This academic journal studies COSO- ERM Integrated Framework
in depth.

2. Risk Management Frameworks (RMF)

The Risk Management Framework assists in formulating best practices and procedures for risk
management in the company. Its purpose is to identify and analyse potential risks by accessing all
layers of the organization, understanding the goals of each project, and monitoring all operating
systems. To create effective risk management and mitigation strategies, businesses use a risk
management framework to provide key security information. (Horvath, An Overview of Risk Man -
agement Framework (RMF), 2022)

Page 9 of 21
RMFs are cost-saving strategies since they make predictions and analyse future outcomes based
on the data collected from past projects. It is critical to have these insights since they can assist in
avoiding risks and putting in place risk mitigation procedures in advance.

Risk architectures and risk management infrastructures are necessary, as well as protocols, train-
ing, monitoring, and reporting. A company's attitude towards risk and its level of risk tolerance can
be expressed in these terms. It is imperative to consider these elements as part of governance re-
sponsibilities.

In order to create an effective RMF, it is essential for leadership commitment to build an effective
Risk committee involving the board members. Unit contributions must be divided and implemented
by leaders according to different corporate objectives. In each department or project, they must
then identify the processes that are used to achieve business goals. The managers involved in
these processes need to be made aware of these goals. When the goals have been established,
the contributing ERM processes need to be linked to them. (Horvath, An Overview of Risk Man -
agement Framework (RMF), 2022)

Understanding the ERM Process

The ERM process consists of five elements in a multi-level loop.

Identify Risk Assess Risk Plan Response Strategy

Accept
Potential Impact Likelihood

Self- Share
Assessment

Internal Audit Mitigate/

Reduce

Implement Avoid
Monitor Performance Mitigation
strategy

Figure 1. Five elements of ERM process

Source: Modified (CGMA, 2013)

Page 10 of 21
 I. Identify Risk: Based on the values of the company, the ERM process will identify relevant
risks that have the potential to hinder each key driver's success. We have already dis-
cussed the various kinds of risks an organisation may encounter in the previous section.
II. Assess Risk: During the risk assessment phase, cross-departmental views must be taken
into consideration to analyse the risks. The ERM framework describes the steps of assess-
ing risk by determining its likelihood (i.e., occurrence percentage change) and impact. It in-
cludes both direct risks (such as an office that is rendered unusable after a natural disaster)
as well as residual risks (such as employees not feeling safe returning to work). In recent
times, this can relate to the global pandemic (COVID-19).
III. Plan Response strategy: A risk response strategy will be considered after upper manage-
ment has discussed and acknowledged the potential risks. In response to risk, a company
can avoid the risk, reduce(mitigate) the risk, share the risk, or accept the risk.
IV. Implement Mitigation Strategy: Based on the approved response strategy, risk mitigation
process is implemented. Mitigation strategy can be preventive or detective. Through pre-
ventive strategies, a certain event is prevented from occurring. An appropriate follow-up
step may be taken based on detective strategies.
V. Monitor Performance: The policies and practices of a company can be reviewed by an in-
ternal committee or by an external auditor. Reviewing what is actually done against the
policies may be part of this process. Informing management of unprotected risks, for in-
stance, may also require getting feedback and analysing company data. (Hayes, 2022)

Although it is voluntary for organizations to build its own risk management framework, new busi-
nesses face a challenge in creating a robust framework due to lack of knowledge and resources.
The US Business Formation Statistics show that the number of business applications has steadily
increased over the past decade. Based on seasonal variation, the number of business applications
increased by 4.8% from the first quarter of 2020 to 883,174 in the second quarter. (United States
Census Bureau, 2020) As per Forbes, only 10 per cent of start-ups succeed each year, showing
how to overcome the odds of failure. (Patel, 2015)

Most business owners irrespective of organization size often find it challenging to implement mul-
tiple enterprise risk management (ERM) systems in their organization. Thus, to aid to such busi-
ness challenges and ease the ERM implementation process world-wide, governments along with
global audit firms has developed standard enterprise risk management frameworks like the COSO,
ISO, NIST and many others, and set benchmarks to help organizations meet compliance require-
ments. As part of this assignment, COSO model is described in detail.

Page 11 of 21
 2.1. COSO Risk Management Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) was founded
in 1985 with the aim of aiding the National Commission on Fraudulent Financial Reporting. It was
structured to develop frameworks and guidance on internal control, fraud prevention, and risk man-
agement. COSO was founded by five professional associations, which include the American Insti-
tute of Certified Public Accountants (AICPA), American Accounting Organization (AAA), Institute of
Management Accountants (IMA), Institute of Internal Auditors (IIA), and Financial Executives Inter-
national (FEI). (COSO, 2013)

COSO Model

The COSO Internal Control – Integrated Framework (the Framework) outlines the components,
principles, and factors necessary for an organization to effectively manage its risks through the im-
plementation of internal control. (Eubanks, 2015)

The components were represented through a cube called “COSO Cube” depicted in Figure 2, until
the most recent update to the COSO Framework occurred in 2017, in which an executive summary
framework has been developed with five components as depicted in Figure 3. The COSO frame-
work, implemented as three lines of defence is discussed in detail.

Figure 2. COSO Cube and Three lines of Defense Model. Source (Eubanks, 2015)

Page 12 of 21
 As depicted in the cube, the enterprise risk management framework developed by COSO seeks to
accomplish:

Three main objectives:

I. Operations: utilizing its resources effectively and efficiently;

II. Reporting: accuracy and reliability;
III. Compliance: adherence to the laws and regulations in effect.

Five Control Components:

I. Control Environment: Standardized processes, structures, and procedures constitute the

control environment used to carry out internal controls. Internal control, including expected
standards of conduct, is emphasized at the top by the board of directors and senior man-
agement. Organizational expectations are reinforced by management at all levels. Integrity
and ethical values of the organization are part of the control environment; the parameters
that enable the board of directors to carry out its governance oversight responsibilities; the
organizational structure and allocation of authority and responsibility; the process of attract-
ing, developing, and retaining competent people; and the rigor around performance meas-
ures, incentives, and rewards for driving accountability. Control environments result in per-
vasive impacts on internal control systems.
II. Risk Assessment: Risks affect every entity, both externally and internally. An objective can
be adversely affected by an event if it appears likely. Risk is associated with the probability
of such an event occurring. Identifying and assessing risks is a dynamic and iterative pro -
cess. Based on established risk tolerances, the risks associated with achieving these ob-
jectives are evaluated across the organization. Consequently, risk management is determ-
ined by risk assessment. Setting objectives based on different levels of the organization is a
prerequisite to risk assessment. Objectives are specified in terms of operations, reporting,
and compliance with sufficient clarity for management to identify and analyse risks. In addi-
tion, management evaluates whether the objectives are suitable for the organization. Man-
agement must also consider impacts of possible changes within its own business model
and in the external environment that might compromise internal controls.
III. Control Activities: By establishing policies and procedures, control activities assist manage-
ment to achieve its objectives by mitigating risks. Various levels of control are performed
within the business process, in the technology environment, and at all levels of the entity. It
may involve manual or automated activities, such as authorizations and approvals, verifica-
tions, reconciliations, and business performance reviews. Control activities are typically se-
lected and developed with the separation of duties in mind. Management chooses and de-
velops alternative control activities when segregation of duties is not practical.

Page 13 of 21
 IV. Information and Communication: Information is provided, shared, and obtained iteratively
through communication. Internal communication involves the dissemination of information
within an organization, from the top down. As a result, management can send a clear mes-
sage to personnel regarding the importance of controlling responsibilities. Communication
with external parties serves two purposes: it allows inbound information from external
parties to be shared, and it provides information to external parties in response to their
needs and expectations.
V. Monitoring Activities: Several methods are used to determine whether each of the five com-
ponents of internal control, including controls affecting the principles within each compon-
ent, has been implemented and is functioning properly, such as continuous evaluations,
separate evaluations, or a combination of both. The entity provides timely information by in-
tegrating continuous evaluations into its business processes. Periodic evaluations may dif-
fer in scope and frequency based on risk assessment, the effectiveness of ongoing evalu-
ations, and other management considerations. A range of criteria are used to evaluate find-
ings, including those established by regulators, standard setting bodies, and management
and the board of directors. (Uwadiae, 2014)

Three lines of defense

As outlined in the publication “Leveraging COSO across the three lines of defense”, the roles and
responsibilities of an organization to control risk is explained below.

The first line of defense lies with business and process owners whose activities create and/or man-
age the risks that can facilitate or prevent an organization’s objectives from being achieved. This
includes taking the right risks. The first line is responsible for the risk, and the design and execution
of the organization’s controls to respond to those risks.

To ensure that risk and control are effectively managed, the second line brings expertise, process
excellence, and management monitoring alongside the first line. While separate from the first line
of defense, second line of defense functions are still overseen and controlled by senior manage-
ment. In essence, the second line is responsible for managing and/or overseeing many aspects of
risk management.

Assuring the board and senior management that the first and second lines are performing in ac-
cordance with their expectations is the third line's role. Third-line defenses are generally prohibited
from performing management functions in order to protect their objectivity and independence. Ad-
ditionally, the third line has a primary reporting line to the board. In this sense, the third line is not a
management function, but rather an assurance function, which separates it from the second line of
defense.

Page 14 of 21
The Three Lines of Defense model clarifies the difference and relationship between the organiza-
tion’s assurance and other monitoring activities; activities which can be misunderstood if not clearly
defined. (Eubanks, 2015)

Figure 3. COSO Executive Summary framework. Source (COSO, 2017)

Five characteristics of COSO Executive Summary Framework:

I. Governance and Culture: The role of governance is to establish the tone, provide oversight,
and safeguard the enterprise from risk. The culture of an organization can be described in
terms of its ethical values, its desirable behaviours, and its understanding of risk.
II. Strategy and Objective-Setting: In strategic planning, strategy and objectives work hand in
hand. Business objectives and strategy align with risk appetite
III. Performance: Strategy and objectives must be assessed for risks that could impact their
achievement. Severity is used to prioritize risks. Assesses and responds to risks Key risk
stakeholders are notified of risks.
IV. Review and Revision: Check how enterprise risk management components are performing
over time and with the implementation of major changes, and determine what revisions are
necessary.
V. Information, Communication and Reporting: Information from both internal and external
sources must be shared for enterprise risk management. The organization receives inform-
ation from external sources that flows up and down, as well as across departments.
(COSO, 2017)

A set of 20 principles supports the five components of the updated Framework. (COSO, 2017)

Governance and monitoring are all covered by the following set of principles:

I. Exercises Board Risk Oversight

II. Establishes Operating Structures
III. Defines Desired Culture
Page 15 of 21
 IV. Demonstrates Commitment to Core Values
V. Attracts, Develops, and Retains Capable Individuals

Strategy and Objective-Setting covers the following set of principles:

I. Analyses Business Context

II. Defines Risk Appetite
III. Evaluates Alternative Strategies
IV. Formulates Business Objectives

Performance covers the following set of principles:

I. Identifies Risk
II. Assesses Severity of Risk
III. Prioritizes Risks
IV. Implements Risk Responses
V. Develops Portfolio View

Review and Revision covers the following set of principles:

I. Assesses Substantial Change

II. Reviews Risk and Performance
III. Pursues Improvement in Enterprise Risk Management

Information, Communication and Reporting covers the following set of principles:

I. Leverages Information and Technology

II. Communicates Risk Information
III. Reports on Risk, Culture, and Performance

2.2. COSO’s Impact

Advantages of COSO framework

Strengthen Corporate Governance: COSO helps ensure compliance with policies, goals, and regu-
lations. COSO monitors security, risk, and compliance programs within firms. According to COSO's
board, the revised framework allows enterprises to improve internal controls, thereby reducing
risks and supporting smart decision-making. Using the 2013 framework, organizations can improve
their internal controls and overall efficiency.

Error Reduction: A more pressing problem for organizations is performance variability. When per-
formance exceeds expectations or is ahead of schedule, this can be just as concerning as when
Page 16 of 21
performance is behind schedule or less than expected. In order to avoid disruption and maximize
opportunities, organizations use enterprise risk management to predict risks that may impact per-
formance. (COSO, 2017)

Saves significant amount of money: COSO incorporates the latest risk management technologies
and utilizes analytics to support decision making. A strategic plan avoids unpleasant surprises and
maximizes the chances of future success for the organization. Organizations that effectively adopt
the COSO framework will simplify operations, build more efficient internal controls, and effectively
manage ethics and compliance expenses. (Half, 2015)

COSO drawbacks

Even with well-designed internal control systems, COSO admits that internal auditors may not al-
ways uncover risks associated with human error, poor judgment, or management override of in-
ternal controls. (Reciprocity, 2021) COSO might fail to clearly draw the line between data pro-
cessing for business operations and data processing for financial reporting. (Leitch, 2005) The
COSO framework is complex and multi-layered, making implementation challenging. Frameworks
should be easy to understand and contain practical advice on how risk management should be in-
tegrated into decision-making processes. COSO framework lacks emphasis on implementation.
(Cobb, 2021)

2.3. Technology needs and COSO's relevance

Blockchains are becoming more mainstream, so focusing on how they intersect with internal con-
trols is appropriate. An organization can take advantage of the unique capabilities of blockchain by
carefully implementing and integrating it. COSO Framework 2013 provides an effective and effi-
cient approach that can be leveraged to design and implement controls to address the unique risks
associated with blockchain. This framework for evaluating and controlling blockchain-related risks
in financial reporting provides perspective on how to evaluate, design, and implement controls for
addressing these risks. It is intended to help inform decisions regarding oversight, risks, and in-
ternal control over financial reporting (ICFR). (Steele, 2020)

Cloud technology enables simple, but secure workflows that unify and coordinate activities across
lines of business, locations, and functions. Many organizations still rely on spreadsheets, websites,
and email for their risk management processes. The process of risk management is still largely
based on spreadsheets, websites, and e-mails in many organizations. Organizations that lack se-
cure risk governance processes have difficulty identifying and planning for risks, creating opportun-
ities for data breaches. In contrast, transitioning to a digital platform, such as cloud risk manage-
ment, significantly increases ERM effectiveness and allows the entire organization to easily parti-
cipate, which is essential for success. (Oracle)
Page 17 of 21
A growing remote workforce and an explosion of data have led to an increase in cyber threats.
When it comes to safeguarding their digital assets, organizations face increased expectations from
financial regulators. “For most companies, a proactive risk management strategy that continuously
monitors user access and activity should be the next step in their cybersecurity journey.” (Oracle)

Conclusion

An enterprise risk management (ERM) process is an enterprise-wide framework for identifying, as-
sessing, and mitigating risks to assets. In order to manage risks, organizations must plan, organ-
ize, lead, and control activities. There are many types of risks that can be mitigated by ERM
strategies, including operational risks, financial risks, security risks, compliance risks, and legal
risks. Using Enterprise Risk Management, managers can mandate which parts of the business en-
gage in particular activities or disengage from them. When division heads make risk management
decisions, it can result in siloed evaluations without factoring in other divisions. Organizations can
leverage by following ERM best practice guide defined by the COSO framework for enterprise risk
management. ERM Framework is aimed at integrating ERM with performance management in an
organization, defining roles and responsibilities within an organization, standardizing risk reporting
and escalation processes, setting a standard approach to managing risks, determining the scope
and application of risk management within an organization.

Specifically, this study investigated corporate governance systems and the extent to which ERM is
implemented. It is hypothesized that corporate governance and ERM have a large and beneficial
relationship. In my opinion, COSO ERM is realistic enough to be adopted, despite the drawbacks.
With a comprehensive risk governance framework, companies will be able to meet their compli-
ance obligations. From the study's context, it is evident that technology impacts an organization's
performance directly. By managing risk, organizations can either foresee potential problems or
seize opportunities to generate them. A further benefit of utilizing the COSO framework is that it in-
creases an organization's likelihood of achieving its mission. This is done by accurately identifying
opportunities and threats, and streamlining operations to analyse risk better.

Economic, sociological, psychological, industrial engineering, computer science, statistics, and

data analytics are emerging fields that can contribute significantly to our understanding of ERM. It
may also yield novel insights about how businesses can deal with the volume of complex hazards
that they face if studies of business and non-business fields are combined. When chasing value,
organizations continually seek ways to proactively manage the risks that may arise while pursuing
that value. An evaluation of academic research can be used to determine whether ERM proced-
ures are effective. There are many open-ended research questions related to ERM. A huge oppor-
tunity awaits to perform advanced research in the field of ERM.

Page 18 of 21
References:

Alexander, A. G. (2017, 07 14). Enterprise risk management and business continuity. Retrieved
from continuitycentral.com: https://www.continuitycentral.com/index.php/news/business-continuity-
news/2158-enterprise-risk-management-and-business-continuity

Beasley, M. (2020). ERM Professional Insights. Enterprise Risk Management Initiative, 2. Re-
trieved from https://dev1.erm.ncsu.edu/az/erm/i/chan/library/What_is_ERM_July_2019.pdf?
_gl=1*zj75w*_ga*MTkwMDQwMjk3LjE2NzIxNTEzNjA.*_ga_52ZBXKJW18*MTY3MjE1MTM2MC4x
LjEuMTY3MjE1MTcxMC4wLjAuMA..

Beasley, M. (2020). ERM Professional Insights. Enterprise Risk Management Initiative, 2-4. Re-
trieved from https://dev1.erm.ncsu.edu/az/erm/i/chan/library/What_is_ERM_July_2019.pdf?
_gl=1*zj75w*_ga*MTkwMDQwMjk3LjE2NzIxNTEzNjA.*_ga_52ZBXKJW18*MTY3MjE1MTM2MC4x
LjEuMTY3MjE1MTcxMC4wLjAuMA..

CGMA. (2013, 06 11). Enterprise Risk Management (ERM). Retrieved from CGMA:
https://www.cgma.org/resources/tools/essential-tools/enterpise-risk-management.html

Cobb, M. (2021, 10 12). ISO 31000 vs. COSO: Comparing risk management standards. Retrieved
from Techtarget: https://www.techtarget.com/searchcio/feature/ISO-31000-vs-COSO-Comparing-
risk-management-standards

COSO. (2013, 06 06). COSO Issues Article Discussing Transition to the 2013 Internal Control In-
tegrated -Framework for Sarbanes-Oxley Section 404 compliance. Retrieved from COSO News
Release: https://www.coso.org/Shared%20Documents/COSO-Press-Release-McNally-Article-May-
2013.pdf

COSO. (2017, 06). Enterprise Risk Management Integrating with Strategy and Performance Exec-
utive Summary. Retrieved from COSO: https://www.coso.org/Shared%20Documents/2017-COSO-
ERM-Integrating-with-Strategy-and-Performance-Executive-Summary.pdf

ERM. (n.d.). ERM’s Global Code of Business Conduct and Ethics. Retrieved from ERM:
https://www.erm.com/about/company/business-conduct-ethics/erms-global-code/

Eubanks, D. J. (2015, 07). Leveraging COSO across the three lines of Defence. Retrieved from
COSO: https://www.coso.org/Shared%20Documents/COSO-2015-3LOD.pdf

Faculty, E. I. (2011, 10 17). Compliance, Ethics and Enterprise Risk Management. Retrieved from
NC State: https://erm.ncsu.edu/library/article/compliance-ethics-erm/main-nav

Half, R. (2015, 03 25). The Benefits of Adopting the COSO 2013 Framework — Even If You Aren't
Required to. Retrieved from Robert half talent solutions:

Page 19 of 21
https://www.roberthalf.com/blog/management-tips/the-benefits-of-adopting-the-coso-2013-
framework-even-if-you-arent-required-to

Hayes, A. (2022, 09 07). Enterprise Risk Management (ERM): What Is It and How It Works. Re-
trieved from Investopedia: https://www.investopedia.com/terms/e/enterprise-risk-
management.asp#toc-what-types-of-risks-does-enterprise-risk-management-address

HM Government. (2020). The Orange Book Management of Risk – Principles and Concepts. Re-
trieved from gov.uk: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/
attachment_data/file/866117/6.6266_HMT_Orange_Book_Update_v6_WEB.PDF

Horvath, I. (2022, 08 02). An Overview of Risk Management Framework (RMF). Retrieved from In-
vensis global learning services: https://www.invensislearning.com/blog/risk-management-
frameworks/

Horvath, I. (2022, 09 05). What is Enterprise Risk Management (ERM). Retrieved from Invensis
Learning: https://www.invensislearning.com/blog/enterprise-risk-management-erm/

LaConte, G. (2017, 07 31). Overview of the 5 Types of Strategic Risk. Retrieved from LaConte
Consulting: https://laconteconsulting.com/2017/07/31/overview-of-the-5-types-of-strategic-risk/

Leitch, M. (2005, 04). Why the COSO Frameworks Need Improvement. Retrieved from IRMI:
https://www.irmi.com/articles/expert-commentary/why-the-coso-frameworks-need-improvement

McKenzie, S. (2018, 01 16). Five Weaknesses of Enterprise Risk Management. Retrieved from
SILO.TIPS: https://silo.tips/download/five-weaknesses-of-enterprise-risk-management

McNutt, E. D. (2008, 01). Ethics of Enterprise Risk Management as a key component of Corporate
Governance. Patrick McNutt econissues, 7-8. Retrieved from Patrick McNutt econissues:
http://www.patrickmcnutt.com/wp-content/uploads/Ethics_of_enterprice_risk_management.pdf

Oracle. (n.d.). What is enterprise risk management (ERM)? Retrieved from Oracle:
https://www.oracle.com/in/erp/risk-management/what-is-enterprise-risk-management/

Patel, N. (2015, 1 16). 90% Of Startups Fail: Here's What You Need To Know About The 10%. Re-
trieved from Forbes: https://www.forbes.com/sites/neilpatel/2015/01/16/90-of-startups-will-fail-
heres-what-you-need-to-know-about-the-10/?sh=6b2f75136679

Reciprocity. (2021, 01 08). Limitations of the COSO framework. Retrieved from reciprocity:
https://reciprocity.com/limitations-of-the-coso-framework/

SOBEL, P. J. (2004). Aligning Corporate Governance with Enterprise Risk Management. Managing
Account Quarterly, 5, 30-34. Retrieved from
https://www.imanet.org/-/media/705b70be611b49629089164f412dc92e.ashx

Page 20 of 21
SOBEL, P. J. (2004). Aligning Corporate Governance with Enterprise Risk Management. Manage-
ment Accounting Quarterly, 5, 36. Retrieved from
https://www.imanet.org/-/media/705b70be611b49629089164f412dc92e.ashx

SOBEL, P. J. (2004, 10). Aligning Corporate Governance with Enterprise Risk Management. Man-
agement Accounting Quartely, 32-33. Retrieved from
https://www.imanet.org/-/media/705b70be611b49629089164f412dc92e.ashx

Steele, J. B. (2020, 07). Blockchain and Internal control. Retrieved from COSO:
https://www.coso.org/Shared%20Documents/Blockchain-and-Internal-Control-The-COSO-
Perspective-Guidance.pdf

United States Census Bureau. (2020, 07 15). Business Formation Statistics. Retrieved from United
States Census Bureau: https://www.census.gov/econ/bfs/pdf/historic/bfs_2020q2.pdf

Uwadiae, O. (2014). COSO An approach to Internal control framework. Retrieved from Deloitte:
https://www2.deloitte.com/content/dam/Deloitte/ng/Documents/audit/Financial%20Reporting/ng-
coso-an-approach-to-internal-control-framework.pdf

Appendices A: List of Figures

Figure 1. Five elements of ERM process. Reference: Modified based on CGMA. (2013, 06 11). En-
terprise Risk Management (ERM). Retrieved from CGMA:
https://www.cgma.org/resources/tools/essential-tools/enterpise-risk-management.html

Figure 2. COSO Cube and Three lines of Defense Model. Reference: Eubanks, D. J. (2015, 07).
Leveraging COSO across the three lines of Defence. Retrieved from COSO:
https://www.coso.org/Shared%20Documents/COSO-2015-3LOD.pdf

Figure 3. COSO Executive Summary framework. Reference: COSO. (2017, 06). Enterprise Risk
Management Integrating with Strategy and Performance Executive Summary. Retrieved from
COSO: https://www.coso.org/Shared%20Documents/2017-COSO-ERM-Integrating-with-Strategy-
and-Performance-Executive-Summary.pdf

Page 21 of 21