What are the ISO 31000 and COSO enterprise risk management frameworks?

ISO 31000 in brief

ISO 31000 describes risk as the effect of uncertainty on objectives, and risk management as coordinated activities to direct and control an organisation with regard to risk. Its process runs from establishing the context, through risk identification, analysis and evaluation, to treatment, with communication, monitoring and review wrapped around every step. It is deliberately generic so that a bank, a hospital and a mine can all apply it.

COSO ERM in brief

COSO's framework, Enterprise Risk Management: Integrating with Strategy and Performance, organises risk management into components covering governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting. It is the framework auditors and boards in many jurisdictions are most familiar with, and it pairs with COSO's internal-control framework, which is why control libraries are often mapped to it.

The risk register

The register is a structured list of the risks the organisation has identified, each with an owner, a category from an agreed taxonomy, a description of causes and consequences, scores for likelihood and impact, the controls that mitigate it and the treatment plan. It is the single artefact a supervisor or board will ask to see, and its quality reflects the programme behind it. Spreadsheets work at small scale; the problems start when several teams maintain separate copies.

Risk appetite and tolerance

Risk appetite is the amount and type of risk the organisation is willing to accept in pursuit of its objectives, set by the board. Tolerance is the acceptable variation around it for a particular risk. A register without an appetite statement cannot tell anyone whether a red score is a problem; the appetite is what turns a score into a decision.

Inherent and residual risk

Inherent risk is the level of risk before any controls are considered. Residual risk is what remains after the controls in place are taken into account. The gap between the two is the value the controls are supposed to deliver, which is why control testing through RCSA matters: if a control does not actually work, the residual score is fiction.

• Score inherent risk first, without reference to controls.
• Link the controls that mitigate the risk and rate their design and operating effectiveness.
• Derive the residual score and compare it with appetite.
• Treat any residual risk outside appetite.

Treatment

Treatment options are the familiar four: avoid the activity, reduce the risk with additional controls, share it through insurance or contract, or accept it within appetite. Each treatment should have an owner, a cost, a due date and a way to know it has worked. Tracking treatment cost in the local currency turns the register into a budgeting tool as well as a compliance record.

Monitoring and reporting

Both frameworks end with monitoring and reporting. Key risk indicators give early warning that a risk is moving; the RCSA and KRI guide covers them. Board reporting usually takes the form of a heat map and a narrative on the top risks, produced from the register rather than assembled separately.

How ERMAML handles this

ERMAML, the Ontech Risk & Compliance Suite, provides a risk register anchored to ISO 31000 and COSO with a configurable taxonomy and scoring scales, inherent and residual scoring linked to a control library mapped to ISO 27001, NIST CSF and COSO, treatment plans with cost tracked in kwacha, and heat maps and board packs generated from the live register. See enterprise risk management.