Framework

COSO ERM 2017

COSO ERM – Integrating with Strategy and Performance (2017)

20 requirements · 15 connected unified controls

Open COSO ERM 2017 in the map

Version: 2017
Published: 2017-09
Amendments: none

Requirements and control mappings

“Full” and “Partial” describe the catalog mapping to a unified control. A partial mapping includes the remaining requirement. These mappings do not establish an organization’s implementation or certification.

Governance & Culture

Requirement	Unified control and mapping
E1Exercises Board Risk Oversight	UC-GOV-05 — Ensure board-level oversight of risk and internal controlFull
E2Establishes Operating Structures	UC-GOV-06 — Define security roles, responsibilities, and authoritiesFull
E3Defines Desired Culture	UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware cultureFull
E4Demonstrates Commitment to Core Values	UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware cultureFull
E5Attracts, Develops, and Retains Capable Individuals	UC-GOV-10 — Attract, develop, and retain competent personnelFull

Strategy & Objective-Setting

Requirement	Unified control and mapping
E6Analyzes Business Context	UC-GOV-02 — Understand organizational context and stakeholder expectationsFull
E7Defines Risk Appetite	UC-GOV-17 — Establish enterprise risk management strategy and appetiteFull
E8Evaluates Alternative Strategies	UC-GOV-12 — Align strategy and business objectives with mission and riskFull
E9Formulates Business Objectives	UC-GOV-12 — Align strategy and business objectives with mission and riskFull

Performance

Requirement	Unified control and mapping
E10Identifies Risk	UC-RISK-07 — Identify and analyze risks and opportunities to objectivesFull
E11Assesses Severity of Risk	UC-RISK-07 — Identify and analyze risks and opportunities to objectivesFull
E12Prioritizes Risks	UC-RISK-08 — Evaluate and prioritize risks against risk criteriaFull
E13Implements Risk Responses	UC-RISK-09 — Select, plan, and implement risk treatmentsFull
E14Develops Portfolio View	UC-RISK-10 — Maintain a risk register and report the portfolio viewFull

Review & Revision

Requirement	Unified control and mapping
E15Assesses Substantial Change	UC-RISK-11 — Assess changes that could significantly affect risk and controlFull
E16Reviews Risk and Performance	UC-RISK-13 — Monitor and review risk management performanceFull
E17Pursues Improvement in Enterprise Risk Management	UC-RISK-15 — Continually improve the risk management programFull

Information, Communication & Reporting

Requirement	Unified control and mapping
E18Leverages Information and Technology	UC-GOV-21 — Communicate and report risk and control informationFull
E19Communicates Risk Information	UC-GOV-21 — Communicate and report risk and control informationFull
E20Reports on Risk, Culture, and Performance	UC-GOV-21 — Communicate and report risk and control informationFull