Introduction
COSO ERM organizes enterprise risk management around five connected components. Each component describes an aspect of how an organization integrates risk with strategy and performance; together, their principles provide a structured way to examine whether risk management is embedded in how the organization is governed and managed.
The components are not five departments, nor are they a one-time sequence that ends after risks have been identified. They offer a framework for asking different but related questions: Who oversees risk? How does risk inform strategy and objectives? What risks could affect performance? How does the organization respond and learn? What information is communicated and reported? This tutorial is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
The Five Components and Their Principles
The framework has 20 principles: five in Governance and Culture, four in Strategy and Objective-Setting, five in Performance, three in Review and Revision, and three in Information, Communication, and Reporting. The names below identify the principles; the explanations indicate the kind of organizational activity each concerns.
| Component | Associated principles |
|---|---|
| Governance and Culture | Exercises board risk oversight; establishes operating structures; defines desired culture; demonstrates commitment to core values; attracts, develops, and retains capable individuals. |
| Strategy and Objective-Setting | Analyzes business context; defines risk appetite; evaluates alternative strategies; formulates business objectives. |
| Performance | Identifies risk; assesses severity of risk; prioritizes risks; implements risk responses; develops portfolio view. |
| Review and Revision | Assesses substantial change; reviews risk and performance; pursues improvement in enterprise risk management. |
| Information, Communication, and Reporting | Leverages information and technology; communicates risk information; reports on risk, culture, and performance. |
Governance and Culture concerns the organization’s oversight, structure, expected behaviors, values, and people. Board oversight is not the same as management’s day-to-day responsibility: the board provides oversight, while operating structures establish roles and accountability for carrying out work. Desired culture and demonstrated core values shape how people make decisions, raise concerns, and respond to risk. Capable individuals are needed to carry out those responsibilities.
Strategy and Objective-Setting connects the organization’s context and choices to risk. Understanding the business context helps identify circumstances that may affect strategic choices. Risk appetite expresses the types and amount of risk the organization is willing to accept in pursuit of value; it is not itself a risk estimate or a response to a particular event. Evaluating alternative strategies considers risk as part of choosing a direction. Objectives then translate a chosen direction into outcomes the organization intends to achieve.
Performance concerns identifying, assessing, prioritizing, and responding to risks, then considering their combined effect. Risk identification asks what could affect objectives. Severity assessment evaluates the significance of each risk, using measures suited to the situation. Prioritization helps determine which risks warrant attention first. Risk responses are actions selected in light of those assessments. A portfolio view considers risks together rather than assuming that each can be managed independently.
Review and Revision addresses whether the organization’s understanding and management of risk remain suitable as circumstances change. It includes assessing substantial changes, reviewing risk and performance, and pursuing improvement in ERM. It is not limited to an annual review: important changes may warrant reassessment before the next scheduled cycle.
Information, Communication, and Reporting supports decision-making across the other components. Relevant information and technology help the organization identify and assess risk; communication conveys risk information to appropriate people; reporting brings together information about risk, culture, and performance. Reporting is not merely a final publication step. Poor information flows can weaken oversight and responses throughout the framework.
How the Components Fit Together
A practical way to apply the framework is to begin with the decision or activity in the scenario, then ask what role it plays. For example, choosing risk appetite is part of strategy and objective-setting, while assessing a particular risk’s severity belongs to performance. Escalating the assessment to decision-makers concerns communication; changing the organization’s approach after a significant shift in circumstances concerns review and revision.
The framework has a discernible logic, but it should not be read as a rigid pipeline. Governance and culture shape how the organization sets strategy and handles performance. Information supports every component. Review can lead to changes in strategy, objectives, risk responses, or the information needed. A single activity can therefore touch more than one component, even when one is the clearest primary match.
Identify who oversees risk, how responsibilities are arranged, and what culture and conduct the organization expects.
Consider business context, risk appetite, alternative strategies, and the objectives that follow from the chosen direction.
Identify and assess risks, prioritize them, select responses, and consider their combined effect.
Use relevant information and reporting to support decisions, assess changes and results, and improve ERM where needed.
Worked Example: A Hypothetical Insurer Considers a New Cyber Product
A hypothetical regional insurer is considering offering a cyber endorsement to small businesses. Management has identified potential claim volatility, discussed how much cyber risk the insurer is willing to accept, and prepared a report for its board. Map the main activities to COSO ERM’s components and identify a common classification error.
Step 1: Identify oversight and structure. The board’s oversight of risk is the Governance and Culture principle exercises board risk oversight. Assigning responsibility for product approval and monitoring to management functions is an example of establishes operating structures. These are related but distinct: oversight does not mean the board performs all operational work.
Step 2: Locate the strategic choices. Considering demand, capabilities, and external conditions is analyzes business context. Agreeing on the amount and types of cyber risk the insurer is prepared to accept is defines risk appetite. Comparing the endorsement with other product strategies is evaluates alternative strategies. Setting a target for the product is formulates business objectives.
Step 3: Map the risk work. Listing possible claim and operational risks is identifies risk. Evaluating how serious the risks could be is assesses severity of risk. Deciding which risks need attention first is prioritizes risks. Choosing controls, limits, or other actions is implements risk responses. Considering the new risks alongside existing exposures is develops portfolio view.
Step 4: Classify the board report. Preparing and delivering risk information to the board is principally reports on risk, culture, and performance, under Information, Communication, and Reporting. The board’s use of that report to oversee risk is a Governance and Culture activity. One event can involve both components because reporting supplies information for oversight.
Common mistake avoided: Calling the risk appetite discussion a Performance activity simply because it mentions risk. The key is the activity’s purpose: setting the organization’s willingness to accept risk is Strategy and Objective-Setting; assessing and responding to particular risks is Performance.
A Quantitative Illustration Within Performance
COSO ERM does not prescribe a single risk-severity formula. In a simple model, however, expected loss can illustrate one possible input to severity assessment. Suppose a hypothetical event has probability \(p\) of occurring over a defined period and, if it occurs, causes a fixed loss \(c\). Let \(I\) equal 1 if the event occurs and 0 otherwise, so \(L=cI\). Since \(E[I]=p\), the expected loss is:
This result assumes one event with a fixed loss amount when it occurs, no loss otherwise, and a specified period over which \(p\) applies. It does not mean expected loss alone captures severity, tail outcomes, uncertainty, or the organization’s risk appetite. Those considerations require appropriate additional analysis.
Worked Example: Using a Simple Expected-Loss Estimate
A hypothetical insurer estimates that a specific technology outage has a 2% probability of occurring in the next year. If it occurs, the loss is assumed to be exactly $5,000,000. Under the fixed-loss model above, calculate expected loss and explain where the calculation fits in COSO ERM.
Step 1: State the assumptions. The period is one year, the event probability is \(p=0.02\), and the loss conditional on the event is \(c=\$5{,}000{,}000\). If the event does not occur, loss from this event is zero.
Step 2: Apply the model.
Step 3: Interpret and check. The expected loss is $100,000 for the year under the stated assumptions. It is 2% of the possible $5,000,000 loss, as expected when the event occurs with probability 0.02 and otherwise causes no loss.
Step 4: Map the work. Estimating this quantity may support assesses severity of risk within Performance. Comparing it with other exposures may support prioritization or a portfolio view. The formula is an illustrative assessment tool, not a COSO-required metric or a complete description of the risk.
Common mistake avoided: Treating $100,000 as the loss if the outage occurs. It is the probability-weighted expected loss; the conditional loss in this model remains $5,000,000.
Worked Example: Responding to a Material Change
A hypothetical insurer has set objectives for a new regional property product. Midway through the year, a regulatory change alters permitted policy terms, and the insurer’s claims experience is also worse than expected. A committee reviews results, management updates its assessment, and the insurer modifies its product controls. Map the activities and distinguish review from performance.
Step 1: Identify the trigger. The regulatory change is a substantial change in the operating context. Assessing its implications maps to assesses substantial change, under Review and Revision.
Step 2: Separate review from current risk management. Examining actual results against expectations and considering what the results mean for risk is reviews risk and performance. Updating the assessment of the product’s risks and selecting or changing controls are Performance activities: assessing severity and implementing risk responses.
Step 3: Consider improvement. If the insurer changes its review process so that regulatory changes are escalated earlier, that is an example of pursues improvement in enterprise risk management.
Step 4: Include information flows. Communicating the changed assessment to responsible managers and reporting relevant findings to oversight bodies are Information, Communication, and Reporting activities.
Check: The regulatory change does not itself make every subsequent action part of Review and Revision. The trigger and evaluation belong there; the updated assessment and selected controls also involve Performance.
Common Classification Traps
- Confusing appetite with assessment. Risk appetite expresses willingness to accept risk in pursuit of value; severity assessment evaluates a particular risk.
- Combining assessment and prioritization. Assessing severity evaluates a risk. Prioritizing compares risks or otherwise determines where attention is most needed.
- Treating reporting as the whole information component. The component also includes using information and technology and communicating risk information.
- Calling every change a response. A response is an action addressing risk. Reviewing whether changing circumstances make the existing approach unsuitable is also a Review and Revision concern.
- Assuming each activity belongs to exactly one component. Select the best primary match for the activity asked about, while recognizing that components can support one another.
Check Your Understanding
For each problem, identify the most relevant component or principle. Where asked, show the calculation before checking the final answer.
- A hypothetical insurer’s board reviews the organization’s risk profile, while management assigns responsibility for monitoring individual exposures to business units. Identify the relevant Governance and Culture principles. (Answer: The board exercises board risk oversight; management’s assignment of responsibilities illustrates establishes operating structures.)
- A hypothetical insurer compares two market-entry strategies, decides how much risk it is willing to accept, and sets a target for premium growth. Map each activity to a principle. (Answer: Comparing strategies is evaluates alternative strategies; deciding willingness to accept risk is defines risk appetite; setting the target is formulates business objectives.)
- A hypothetical risk team lists possible vendor disruptions, estimates their seriousness, ranks them for attention, and selects backup arrangements. Give the primary Performance principle for each activity. (Answer: Identifies risk; assesses severity of risk; prioritizes risks; implements risk responses.)
- A hypothetical insurer estimates a 5% probability of a fixed $2,000,000 loss from a defined event over the next year. Under the simple fixed-loss model, calculate expected loss and state the relevant Performance principle. (Answer: \(0.05\times \$2{,}000{,}000=\$100{,}000\); assesses severity of risk.)
- A hypothetical insurer experiences a major change in claims rules, reviews its results, changes its risk process to escalate rule changes sooner, and reports the findings to its board. Identify the Review and Revision principles and the reporting principle. (Answer: Assesses substantial change; reviews risk and performance; pursues improvement in enterprise risk management; reports on risk, culture, and performance.)