Scribd Logo
Upload

Welcome to Scribd!

  • 90 views

    COSO ERM Framework Update: 2016 General Audit Management Conference

    Uploaded by

    Ahmad Malik
    The COSO ERM Framework is being updated to remain relevant in an evolving business environment. The update will enhance the framework's content and tools to help organizations better manage risk and opportunities. Key areas of focus for the update include risk governance, integration of ERM with strategy and decision making, emphasis on value creation, and clarifying definitions. The update process involves an advisory council and will maintain core concepts like linking risk to strategy and objectives while improving areas like risk information and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    COSO ERM Framework Update: 2016 General Audit Management Conference

    Uploaded by

    Ahmad Malik
    90 views36 pages
    The COSO ERM Framework is being updated to remain relevant in an evolving business environment. The update will enhance the framework's content and tools to help organizations better manage risk and opportunities. Key areas of focus for the update include risk governance, integration of ERM with strategy and decision making, emphasis on value creation, and clarifying definitions. The update process involves an advisory council and will maintain core concepts like linking risk to strategy and objectives while improving areas like risk information and monitoring.

    Original Description:

    Xyz

    Original Title

    ERM

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The COSO ERM Framework is being updated to remain relevant in an evolving business environment. The update will enhance the framework's content and tools to help organizations better manage risk and opportunities. Key areas of focus for the update include risk governance, integration of ERM with strategy and decision making, emphasis on value creation, and clarifying definitions. The update process involves an advisory council and will maintain core concepts like linking risk to strategy and objectives while improving areas like risk information and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    90 views36 pages

    COSO ERM Framework Update: 2016 General Audit Management Conference

    Uploaded by

    Ahmad Malik
    The COSO ERM Framework is being updated to remain relevant in an evolving business environment. The update will enhance the framework's content and tools to help organizations better manage risk and opportunities. Key areas of focus for the update include risk governance, integration of ERM with strategy and decision making, emphasis on value creation, and clarifying definitions. The update process involves an advisory council and will maintain core concepts like linking risk to strategy and objectives while improving areas like risk information and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 36

    COSO ERM Framework Update

    2016 General Audit Management Conference

    Speakers:
    • Robert Hirth, Chair, COSO
    • Frank Martens, Director, PwC
    Mission

    COSO’s Mission is “To provide thought leadership


    through the development of comprehensive frameworks
    and guidance on enterprise risk management, internal
    control and fraud deterrence designed to improve
    organizational performance and governance and to
    reduce the extent of fraud in organizations.”
    COSO’s Fundamental Principle

    Good risk management and internal control are


    necessary for long term success of all organizations
    Our Next Challenge and Opportunity
    Updating the Enterprise Risk
    Management- Integrated Framework…
    • NEW YORK, October 21, 2014 - The Committee of Sponsoring
    Organizations of the Treadway Commission (COSO) today
    announced a project to review and update the 2004 Enterprise Risk
    Management–Integrated Framework (Framework).
    • The Framework, originally published in 2004, is a widely accepted
    framework used by management to enhance an organization’s ability
    to manage uncertainty and to consider how much risk to accept as it
    strives to increase stakeholder value.
    • This initiative is intended to enhance the Framework’s content and
    relevance in an increasingly complex business environment so that
    organizations worldwide can attain better value from their enterprise
    risk management programs. The initiative also will develop tools to
    assist management in reporting risk information and in reviewing and
    assessing the application of enterprise risk management.
    Why Update the Framework Now?

    • Concepts and practices have evolved


    • Lessons learned
    • Bar raised with respect to enterprise risk management
    • Business and operating environments more complex,
    technologically driven, and global in scale
    • Stakeholders more engaged, seeking greater
    transparency and accountability
    • Risk discussions increasingly prominent at the board
    level
    Global Interest and Application Has
    Increased Significantly!
    SEC Proxy Requirement…

    Provide Information About Board Leadership Structure and the


    Board's Role in Risk Oversight:
    • The SEC approved rules relating to board leadership structure and
    the board's role in risk oversight. The rules require disclosure about:
    ̶ A company's board leadership structure, including whether the
    company has combined or separated the chief executive officer
    and chairman position, and why the company believes its
    structure is the most appropriate for the company at the time of
    the filing
    ̶ In certain circumstances, whether and why a company has a
    lead independent director and the specific role of such director
    ̶ The extent of the board's role in the risk oversight of the
    company
    Project Governance
    Advisory Council and
    Observers:
    COSO Board
    • Consists of over 25
    professionals
    • Provides input, expertise,
    feedback, insight, and
    PwC Project ideas throughout the
    Team update.
    • Obtains and synthesizes
    feedback from their
    respective constituency,
    Advisory Council Observers
    organization, industry
    Advisory Council and Observers

    Advisory Council Members Official Observers


    • CRO’s • FDIC
    • ERM University Professors • GAO
    • Chief Audit Executives • IFAC
    • Accounting Firm Risk Practice • ISACA
    Partners • OIG
    • Board Members
    • RIMS
    • Public Sector representatives • China Ministry of Finance
    • Company Executives
    Updating the Framework is Undertaken
    Using our Five-phase Approach

    4. Public
    2. 3. Design
    1. Assess Exposure 5. Finalize
    Envision and Build
    Process
    Foundational Concepts of ERM

    • Every entity exists to provide value for its stakeholders


    • All entities face uncertainty
    • The challenge for management is to determine how
    much risk to accept as it strives to grow stakeholder
    value
    • ERM enables management to effectively manage risk
    and opportunity
    Topics Included in the 2004 COSO ERM
    Framework…
    • Aligning Risk Appetite and Strategy
    • Enhancing Risk Response Decisions
    • Reducing Operational Surprises and Losses
    • Identifying and Managing Multiple and
    Cross-enterprise Risks
    • Seizing Opportunities
    • Improving Deployment of Capital
    ERM is Defined as….

    “A process effected by an entity’s board of directors,


    management and other personnel, applied in a strategic
    setting and across the enterprise, designed to identify
    potential events that may affect the entity, and manage
    risk to be within its risk appetite, to provide reasonable
    assurance regarding the achievement of entity
    objectives.”
    Key Goals

    • Usefulness
    • Clarity
    • Value Proposition
    • Relevance
    • Suitability
    • Effectiveness
    Key Questions Helping to Inform the
    Update of the Framework…
    1. What is your ideal view of ERM?
    2. What are three strengths of the 2004 Framework?
    3. What are three significant areas for update and
    revision?
    4. What should the Framework do to stay relevant for
    the next 10 years?
    5. What would improve user acceptance?
    1. What is your ideal view of ERM?

    What we have heard so far…


    • Baked in, embedded, not a bolt-on
    • Accelerates growth and success
    • Improves decision making and performance
    • Discipline, not a process
    • Ability to take on more risk
    • Continuous, identifiable, structured
    2. What are Three Strengths of the 2004
    Framework?
    • Linking Risk to Strategy setting
    • Linkage to objectives
    • Discussion of risk responses
    • Linkage to internal control
    • Evaluation/Attestation criteria concept
    • Discussion of Board governance and oversight
    • Due process
    Link to Strategy…

    • 85% of respondents chose strategy


    as their board’s top focus area.
    • 44% chose risk oversight as the leading issue.
    • More than half (52%) said their boards discuss strategy
    at every board meeting.
    • “These two topics, strategy and risk oversight, go
    hand-in-hand as boards remain vigilant and focused on
    monitoring strategy and related metrics and
    alternatives, while also overseeing and mitigating risks
    to the strategy and the business itself,”
    Source: Deloitte Corporate Governance Center
    3. What are Three Significant Areas for
    Update and Revision?
    • Update principles
    • Revise definitions of Risk, ERM and other key terms
    • Improve its usefulness
    • Consider introducing maturity models
    • Review format, structure, length, complexity
    • Emphasize the opportunity side of risk
    4. What Should the Framework Do to
    Stay Relevant for the Next 10 years?
    • Include maturity models
    • Highlight sustainability
    • Focus on governance
    • Review Principles
    • Stay a Framework
    • Add update materials, papers
    5. What Would Improve User
    Acceptance?
    • Increased CEO and Board engagement and buy-in
    • Inclusion of case studies and examples of success
    • Clearer value proposition
    • Greater and more effective promotion
    • Alignment to relevant regulatory requirements
    Document Structure

    • We anticipate that the updated Framework will include


    components and principles
    ̶ The 2004 Framework contained over 100 key principles in an
    appendix. The updated Framework will significantly reduce
    this number
    • The Project Team is also reviewing
    ̶ Components
    ̶ Categories of objectives
    ̶ The business model
    What’s Likely to Stay the Same…

    • Link to strategy and objectives


    • Involving many people - board, management and
    others
    • Ability to cascade down to subsidiary, division, function,
    etc.
    • Risk identification, assessment, prioritization and
    response
    • Link to internal control
    • An ability to assess effectiveness
    • Monitoring to ensure effectiveness and value of efforts
    • A definitive body of knowledge and thought leadership
    What May Gather Greater Focus…

    • Risk Governance and Culture concepts


    • Emphasis on integration into strategy setting and
    decision-making
    • Integration with Performance Management
    • Revised definitions and vocabulary
    • More focus on using and leveraging information
    • More emphasis on value creation, preservation,
    realization and erosion
    • Mission, Vision and Values discussion
    And Maybe- A New Graphic!
    Could These Be Logical Components?

    • Risk Governance and Culture


    • Strategy and Objective Setting
    • Risk Identification, Assessment, and Response
    • Risk Information and Communication
    • Monitoring
    Something to Ponder…

    Is risk identification, assessment and response done


    after strategy is formulated or is it an integral part of the
    strategic planning process?
    Bridging Between ERM and Internal
    Control Frameworks
    Incrementalism…

    How would you like to meet more of your objectives


    more of the time?
    COSO Can Help ALL Organizations!
    A Suitable Model Everywhere…
    Some Key Take-aways

    • Everyone is doing some form of ERM – can you do it


    better?
    • Analyze, understand and communicate your strategy
    better
    • Keep moving - it’s a journey
    • It happens all the time- and is part of all decision-
    making
    • You need a tone at the top
    • Information can be leveraged
    • Stay attuned to what’s on the Horizon (emerging risks,
    change)
    How to Engage with COSO and the
    Project Team
    • Reach out to an Advisory Council member
    • Participate in surveys
    • Attend / organize a roundtable
    • Participate in the public exposure process
    • Connect directly via email with the PwC Project Team at:
    [email protected]

    You might also like