COSO Enterprise Risk Management Framework for the CPA Exam

COSO Enterprise Risk Management Framework for the CPA Exam

The COSO Enterprise Risk Management (ERM) framework, updated in 2017 under the title "Enterprise Risk Management - Integrating with Strategy and Performance," is a key topic on the CPA exam's BAR section. While related to the COSO Internal Control framework, the ERM framework takes a broader perspective, focusing on how organizations manage risk across the entire enterprise in pursuit of their strategic objectives.

ERM vs. Internal Control: Understanding the Difference

The most important distinction for CPA candidates to understand is that enterprise risk management is broader than internal control. While the internal control framework focuses on the reliability of financial reporting, compliance with laws and regulations, and effectiveness and efficiency of operations, the ERM framework encompasses these objectives plus strategic objectives. ERM considers how risk affects an organization's ability to execute its strategy and achieve its mission and vision.

Think of it this way: internal control asks "Are we doing things right?" while ERM asks "Are we doing the right things, and are we prepared for what could go wrong along the way?"

The Five Components of the 2017 ERM Framework

The 2017 update reorganized the ERM framework into five components with twenty supporting principles:

1. Governance and Culture

Governance and culture together form the foundation of enterprise risk management. Governance sets the organization's tone, reinforcing the importance of and establishing oversight responsibilities for enterprise risk management. Culture pertains to ethical values, desired behaviors, and understanding of risk in the entity. The five principles under this component are:

• Exercises board risk oversight
• Establishes operating structures
• Defines desired culture
• Demonstrates commitment to core values
• Attracts, develops, and retains capable individuals

2. Strategy and Objective-Setting

Enterprise risk management is integrated into the organization's strategic planning process. This component addresses how risk appetite is established, how business objectives are aligned with and support the organization's mission and strategic vision, and how business objectives serve as a basis for identifying, assessing, and responding to risk. The three principles are:

• Analyzes business context
• Defines risk appetite
• Evaluates alternative strategies

Risk appetite is a particularly important concept for the CPA exam. It represents the amount and type of risk an organization is willing to accept in pursuit of its objectives. Risk appetite is set at the board level and guides management in making decisions about risk tolerance at the operational level.

3. Performance

This component focuses on identifying and assessing risks that may affect the achievement of strategy and business objectives. Risks are prioritized by severity in the context of risk appetite, and the organization selects risk responses. The five principles include:

• Identifies risk
• Assesses severity of risk
• Prioritizes risks
• Implements risk responses
• Develops portfolio view

Risk responses fall into four categories that are frequently tested: avoidance (eliminating the risk entirely), reduction (taking actions to reduce the likelihood or impact), sharing (transferring risk through insurance or outsourcing), and acceptance (acknowledging the risk and taking no specific action).

4. Review and Revision

By reviewing entity performance, an organization can consider how well the enterprise risk management components are functioning over time and in light of substantial changes, and what revisions are needed. The three principles are:

• Assesses substantial change
• Reviews risk and performance
• Pursues improvement in enterprise risk management

5. Information, Communication, and Reporting

Enterprise risk management requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down, and across the organization. The four principles include:

• Leverages information and technology
• Communicates risk information
• Reports on risk, culture, and performance
• The organization leverages its information systems to support ERM

Key ERM Concepts for the Exam

Several concepts within the ERM framework receive particular attention on the CPA exam:

• Risk appetite vs. risk tolerance: Risk appetite is the broad-based amount of risk an entity is willing to accept (set at the board level), while risk tolerance is the acceptable variation in performance related to achieving specific objectives (operational level).
• Inherent risk vs. residual risk: Inherent risk is the risk that exists before any risk response is applied. Residual risk is the risk that remains after management's response.
• Portfolio view of risk: ERM encourages management to take a portfolio view, considering how individual risks interrelate and how the aggregate level of risk compares to the overall risk appetite.
• Risk culture: The shared beliefs, attitudes, and behaviors related to risk that influence the entity's decisions.

Exam Strategy

When studying the ERM framework for the CPA exam, focus on understanding the logical flow from governance through strategy, performance, and review. Practice distinguishing between ERM concepts and internal control concepts, as the exam may test your ability to identify which framework is more appropriate for a given scenario. Remember that ERM is about value creation and preservation, not just risk mitigation.