COSO ERM Framework – One Year After the Update

The COSO ERM framework update

COSO released a significant update of its well-known ERM-framework in late 2017. An executive summary is accessible on their website.  The ERM community, especially the “COSO-istas” most eagerly awaited the update. Additionally, the wider stakeholder community was excited to see how the new framework will benefit businesses.  I’m a fan of COSO because their approach is forward looking and tries to integrate strategy and performance with Enterprise Risk Management.

So far so good.

who is the target?

Once I started reading the executive summary, a few questions came to my mind. First, who is the target audience? Second, how many ERM-sceptics can this update convince? And lastly, where are the increased, practical benefits of this version versus its predecessors? I’ve shared some of my supportive and critical views about the new framework in a few blogposts.

gnōthi seauton

Lo and behold, pwc, one of the key contributors to the revision, published a blog reflecting on the “so what” question one year after the update. I really like the open and candid views in that blogpost. Hurdles, miss-conceptions, prejudices, resistance to change… not surprisingly, it’s all there. My advice: “NEVER EVER GIVE UP”.  Having said that, it is no surprise to me that “take up” of the new framework probably isn’t where the authors envisaged it.

and now?

Talking to practitioners and clients across Asia, I noticed that the new framework needs significantly more marketing. It appears not to be known (almost) at all. Out of the many people I spoke to, only ONE (yes 1) appears to have read the new framework.

I have a few suggestions

  1. The effort to summarise the entire approach into a picture is a great endeavour. However, this double-triple helix (*) needs to be simplified and made more tangible. Only then, business leaders will buy into it. In plain simple English: the current depiction is too complicated.

    COSO ERM framework update
    the COSO ERM double triple helix
  2. Nothing beats tangible, $$$-denominated examples. Concepts and frameworks are great, but ultimately businesses will only buy into it, once they see tangible top and bottom line benefits. Preferably, these benefits are palpable within the coming quarter or two.  Dear reader: I “hear” you screaming that ERM is a long-term strategic undertaking,,,, but after all,,,,, sales and results drive a business.
  3. I’m also cognisant that a special compendium with “real life” cases has been released. However, why do we need to buy and read even another document to convince us that the first document (the framework) is a good thing? Somehow counter-intuitive..
megrow

Whenever I speak or write about ERM, I make a point to emphasise the tangible benefits of good ERM for the business. The benefits come in various shapes and forms:

  1. better understanding of new risks can be transformed into new business
  2. better ERM contributes to positive credit rating evaluation, which will lower capital costs and open doors to new business as well
  3. properly managed Cyber exposures protect the downside and can lead to new business opportunities, too
  4. good ERM will lower compliance cost

    Keen to know more? Contact Megrow via the “buttons” at the bottom of the site and stay tuned for new blogs on www.megrow.asia


    (*) the picture is used with permission from COSO as stated on their website.