COSO Enterprise Risk Management (ERM) Framework (2017)

International (COSO)

v2017

5 domains

20 controls

COSO Enterprise Risk Management framework (2017 edition, Integrating with Strategy and Performance), structured as five interrelated components (Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting) and 20 principles. Copyrighted by COSO/AICPA; full control text requires a licensed copy.

Unverified

COSO Enterprise Risk Management (ERM) Framework (2017) is a compliance framework from International (COSO) with 5 domains and 20 controls. The largest domains are Governance and Culture (5 controls), Performance (5 controls), Strategy and Objective-Setting (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Governance and Culture

5 controls

Controls in the Governance and Culture domain of COSO Enterprise Risk Management (ERM) Framework (2017) — 5 controls
Code	Title	Description
GOV-1	Exercises Board Risk Oversight	The board provides oversight of strategy and carries out governance responsibilities to support management in achieving...
GOV-2	Establishes Operating Structures	The organization establishes operating structures in pursuit of strategy and business objectives.
GOV-3	Defines Desired Culture	The organization defines desired behaviors that characterize its culture.
GOV-4	Demonstrates Commitment to Core Values	The organization demonstrates a commitment to core values across all levels.
GOV-5	Attracts, Develops, and Retains Capable Individuals	The organization is committed to building human capital aligned to strategy and business objectives.

Information, Communication, and Reporting

3 controls

Controls in the Information, Communication, and Reporting domain of COSO Enterprise Risk Management (ERM) Framework (2017) — 3 controls
Code	Title	Description
INFO-18	Leverages Information and Technology	The organization leverages information and technology to support enterprise risk management.
INFO-19	Communicates Risk Information	The organization uses communication channels to support enterprise risk management.
INFO-20	Reports on Risk, Culture, and Performance	The organization reports on risk, culture, and performance at multiple levels and across the entity.

Performance

5 controls

Controls in the Performance domain of COSO Enterprise Risk Management (ERM) Framework (2017) — 5 controls
Code	Title	Description
PERF-10	Identifies Risk	The organization identifies risk that impacts the performance of strategy and business objectives.
PERF-11	Assesses Severity of Risk	The organization assesses the severity of risk.
PERF-12	Prioritizes Risks	The organization prioritizes risks as a basis for selecting responses.
PERF-13	Implements Risk Responses	The organization identifies and selects risk responses.
PERF-14	Develops Portfolio View	The organization develops and evaluates a portfolio view of risk.

Review and Revision

3 controls

Controls in the Review and Revision domain of COSO Enterprise Risk Management (ERM) Framework (2017) — 3 controls
Code	Title	Description
REV-15	Assesses Substantial Change	The organization identifies and assesses changes that may substantially affect strategy and business objectives.
REV-16	Reviews Risk and Performance	The organization reviews entity performance and considers risk.
REV-17	Pursues Improvement in ERM	The organization pursues improvement of enterprise risk management.

Strategy and Objective-Setting

4 controls

Controls in the Strategy and Objective-Setting domain of COSO Enterprise Risk Management (ERM) Framework (2017) — 4 controls
Code	Title	Description
STR-6	Analyzes Business Context	The organization considers potential effects of business context on risk profile.
STR-7	Defines Risk Appetite	The organization defines risk appetite in the context of creating, preserving, and realizing value.
STR-8	Evaluates Alternative Strategies	The organization evaluates alternative strategies and the potential impact on risk profile.
STR-9	Formulates Business Objectives	The organization considers risk while establishing business objectives at various levels that align and support strategy...

What is COSO Enterprise Risk Management (ERM) Framework (2017) and who does it apply to?

COSO Enterprise Risk Management (ERM) Framework (2017) is a compliance framework from International (COSO) with 5 domains and 20 controls. COSO Enterprise Risk Management framework (2017 edition, Integrating with Strategy and Performance), structured as five interrelated components (Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting) and 20 principles. Copyrighted by COSO/AICPA; full control text requires a licensed copy. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does COSO Enterprise Risk Management (ERM) Framework (2017) actually require?

COSO Enterprise Risk Management (ERM) Framework (2017) has 20 controls organised across 5 domains. The largest domains are Governance and Culture (5 controls), Performance (5 controls), Strategy and Objective-Setting (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of COSO Enterprise Risk Management (ERM) Framework (2017) do I already cover?

COSO Enterprise Risk Management (ERM) Framework (2017) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement COSO Enterprise Risk Management (ERM) Framework (2017)?

Start your COSO Enterprise Risk Management (ERM) Framework (2017) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about COSO Enterprise Risk Management (ERM) Framework (2017) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required