COSO Enterprise Risk Management (ERM) Framework (2017)
Enterprise Risk Management, Integrating with Strategy and Performance (COSO, June 2017) is the Committee of Sponsoring Organizations of the Treadway Commission's enterprise risk management framework, replacing the 2004 framework's cube with five components carried by twenty principles: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication and Reporting, positioned within strategy-setting and performance rather than as a separate function. It is principles-based and not certifiable, designed to be used with COSO's Internal Control, Integrated Framework, and applied by COSO to compliance risk (2020) and ESG-related risk (2018). The graph models the twenty principles from Volume I of the framework.
COSO Enterprise Risk Management (ERM) Framework (2017) is a compliance framework from Global (COSO; entities of every type and size) with 5 domains and 20 controls. The largest domains are Governance and Culture – COSO Enterprise Risk Management (ERM) Framework (2017) (5 controls), Performance – COSO Enterprise Risk Management (ERM) Framework (2017) (5 controls), Strategy and Objective-Setting – COSO Enterprise Risk Management (ERM) Framework (2017) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Governance and Culture – COSO Enterprise Risk Management (ERM) Framework (2017)
| Code | Title |
|---|---|
| coso-enterprise-risk-management-erm-framework-2017::P1 | Principle 1: Exercises Board Risk Oversight |
| coso-enterprise-risk-management-erm-framework-2017::P2 | Principle 2: Establishes Operating Structures |
| coso-enterprise-risk-management-erm-framework-2017::P3 | Principle 3: Defines Desired Culture |
| coso-enterprise-risk-management-erm-framework-2017::P4 | Principle 4: Demonstrates Commitment to Core Values |
| coso-enterprise-risk-management-erm-framework-2017::P5 | Principle 5: Attracts, Develops, and Retains Capable Individuals |
Information, Communication, and Reporting – COSO Enterprise Risk Management (ERM) Framework (2017)
| Code | Title |
|---|---|
| coso-enterprise-risk-management-erm-framework-2017::P18 | Principle 18: Leverages Information and Technology |
| coso-enterprise-risk-management-erm-framework-2017::P19 | Principle 19: Communicates Risk Information |
| coso-enterprise-risk-management-erm-framework-2017::P20 | Principle 20: Reports on Risk, Culture, and Performance |
Performance – COSO Enterprise Risk Management (ERM) Framework (2017)
| Code | Title |
|---|---|
| coso-enterprise-risk-management-erm-framework-2017::P10 | Principle 10: Identifies Risk |
| coso-enterprise-risk-management-erm-framework-2017::P11 | Principle 11: Assesses Severity of Risk |
| coso-enterprise-risk-management-erm-framework-2017::P12 | Principle 12: Prioritizes Risks |
| coso-enterprise-risk-management-erm-framework-2017::P13 | Principle 13: Implements Risk Responses |
| coso-enterprise-risk-management-erm-framework-2017::P14 | Principle 14: Develops Portfolio View |
Review and Revision – COSO Enterprise Risk Management (ERM) Framework (2017)
| Code | Title |
|---|---|
| coso-enterprise-risk-management-erm-framework-2017::P15 | Principle 15: Assesses Substantial Change |
| coso-enterprise-risk-management-erm-framework-2017::P16 | Principle 16: Reviews Risk and Performance |
| coso-enterprise-risk-management-erm-framework-2017::P17 | Principle 17: Pursues Improvement in Enterprise Risk Management |
Strategy and Objective-Setting – COSO Enterprise Risk Management (ERM) Framework (2017)
| Code | Title |
|---|---|
| coso-enterprise-risk-management-erm-framework-2017::P6 | Principle 6: Analyzes Business Context |
| coso-enterprise-risk-management-erm-framework-2017::P7 | Principle 7: Defines Risk Appetite |
| coso-enterprise-risk-management-erm-framework-2017::P8 | Principle 8: Evaluates Alternative Strategies |
| coso-enterprise-risk-management-erm-framework-2017::P9 | Principle 9: Formulates Business Objectives |
What is COSO Enterprise Risk Management (ERM) Framework (2017) and who does it apply to?
COSO Enterprise Risk Management (ERM) Framework (2017) is a compliance framework from Global (COSO; entities of every type and size) with 5 domains and 20 controls. Enterprise Risk Management, Integrating with Strategy and Performance (COSO, June 2017) is the Committee of Sponsoring Organizations of the Treadway Commission's enterprise risk management framework, replacing the 2004 framework's cube with five components carried by twenty principles: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication and Reporting, positioned within strategy-setting and performance rather than as a separate function. It is principles-based and not certifiable, designed to be used with COSO's Internal Control, Integrated Framework, and applied by COSO to compliance risk (2020) and ESG-related risk (2018). The graph models the twenty principles from Volume I of the framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does COSO Enterprise Risk Management (ERM) Framework (2017) actually require?
COSO Enterprise Risk Management (ERM) Framework (2017) has 20 controls organised across 5 domains. The largest domains are Governance and Culture – COSO Enterprise Risk Management (ERM) Framework (2017) (5 controls), Performance – COSO Enterprise Risk Management (ERM) Framework (2017) (5 controls), Strategy and Objective-Setting – COSO Enterprise Risk Management (ERM) Framework (2017) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of COSO Enterprise Risk Management (ERM) Framework (2017) do I already cover?
COSO Enterprise Risk Management (ERM) Framework (2017) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement COSO Enterprise Risk Management (ERM) Framework (2017)?
Start your COSO Enterprise Risk Management (ERM) Framework (2017) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about COSO Enterprise Risk Management (ERM) Framework (2017) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required