Enterprise Risk Management Frameworks and Governance
Frameworks
COSO's 2017 ERM framework rests on five components - Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting - elaborated through 20 principles. Older material used the 2004 eight-component cube; questions often test whether you know which edition a component belongs to. ISO 31000:2018 organises risk management as principles, a framework (leadership and commitment, integration, design, implementation, evaluation, improvement) and a process (scope and context, identification, analysis, evaluation, treatment, monitoring and review, recording and reporting).
Governance
The IIA Three Lines Model separates: first line - operational management that owns and manages risk; second line - risk and compliance functions providing expertise, oversight and challenge; third line - internal audit giving independent assurance to the board. The board approves risk appetite and strategy; the CRO should have stature, independence and a direct reporting line to the board risk committee.
Traps
- Assuming internal audit or the risk function "owns" risk - ownership sits in the business.
- Confusing second-line challenge with third-line assurance.
- Treating the framework as a compliance checklist rather than an integrated decision tool.
- Assuming the CRO must sit on the board, or that the board should run the framework.
Rule of thumb: if an activity makes a decision that creates or accepts risk, it is first line; if it designs the framework others follow and challenges them, it is second line; if it independently opines on both, it is third line.