Tag: COSO

What is Enterprise Risk Management?

The Committee of Sponsoring Organizations of the Treadway Commission adopts this definition of Enterprise Risk Management:

Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

The definition reflects certain fundamental concepts. Enterprise risk management is:
• A process, ongoing and flowing through an entity
• Effected by people at every level of an organization • Applied in strategy setting
• Applied across the enterprise, at every level and unit, and includes taking an entity level portfolio view of risk
• Designed to identify potential events that, if they occur, will affect the entity and to manage risk within its risk appetite
• Able to provide reasonable assurance to an entity’s management and board of directors
• Geared to ac

You can find that definition in the Enterprise Risk Management – Integrated Framework Executive Summary (.pdf) by Committee of Sponsoring Organizations of the Treadway Commission

Standard & Poor’s To Begin Evaluating Enterprise Risk Analysis

On May 7, 2008, Standard and Poor’s Announced that they address enterprise risk management at part of their ratings: Standard & Poor’s To Apply Enterprise Risk Analysis To Corporate Ratings. (.pdf)

Ultimately, we will enhance transparency by providing investors and issuers our views of a management team’s ability to understand, articulate, and successfully manage risk. The benefits of the ERM enhancement will be to make the process of forming our rating opinions more forward looking, achieve finer differentiation among ratings, and facilitate construction of “what if” forecast scenarios.

S &P will look toward a company’s adoption of the COSO standards or the AS/NZS 4360 standards. But S&P will not make them a prerequisite for enterprise risk management nor sufficient evidence of sufficient risk manangement.