COSO Enterprise Risk Management (ERM) Framework (2017): every control, and what you already have

48 controls 0 frameworks share controls with it Global (COSO; entities of every type and size) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

No measured overlap with another framework in the corpus.

Every control

Code	Control	Also in
`GOV-1`	Exercises Board Risk Oversight	0
`GOV-2`	Establishes Operating Structures	0
`GOV-3`	Defines Desired Culture	0
`GOV-4`	Demonstrates Commitment to Core Values	0
`GOV-5`	Attracts, Develops, and Retains Capable Individuals	0
`INFO-18`	Leverages Information and Technology	0
`INFO-19`	Communicates Risk Information	0
`INFO-20`	Reports on Risk, Culture, and Performance	0
`PERF-10`	Identifies Risk	0
`PERF-11`	Assesses Severity of Risk	0
`PERF-12`	Prioritizes Risks	0
`PERF-13`	Implements Risk Responses	0
`PERF-14`	Develops Portfolio View	0
`REV-15`	Assesses Substantial Change	0
`REV-16`	Reviews Risk and Performance	0
`REV-17`	Pursues Improvement in ERM	0
`STR-6`	Analyzes Business Context	0
`STR-7`	Defines Risk Appetite	0
`STR-8`	Evaluates Alternative Strategies	0
`STR-9`	Formulates Business Objectives	0
`APPLICATIONS`	COSO's applications of the framework: compliance risk management (2020) and ESG-related risk (2018)	0
`COMP-GC`	Governance and Culture (Principles 1 to 5)	0
`COMP-IC`	Information, Communication, and Reporting (Principles 18 to 20)	0
`COMP-PE`	Performance (Principles 10 to 14)	0
`COMP-RR`	Review and Revision (Principles 15 to 17)	0
`COMP-SO`	Strategy and Objective-Setting (Principles 6 to 9)	0
`FRAMEWORK`	COSO ERM 2017: what it is, its structure, and what is held	0
`P1`	Principle 1: Exercises Board Risk Oversight	0
`P10`	Principle 10: Identifies Risk	0
`P11`	Principle 11: Assesses Severity of Risk	0
`P12`	Principle 12: Prioritizes Risks	0
`P13`	Principle 13: Implements Risk Responses	0
`P14`	Principle 14: Develops Portfolio View	0
`P15`	Principle 15: Assesses Substantial Change	0
`P16`	Principle 16: Reviews Risk and Performance	0
`P17`	Principle 17: Pursues Improvement in Enterprise Risk Management	0
`P18`	Principle 18: Leverages Information and Technology	0
`P19`	Principle 19: Communicates Risk Information	0
`P2`	Principle 2: Establishes Operating Structures	0
`P20`	Principle 20: Reports on Risk, Culture, and Performance	0
`P3`	Principle 3: Defines Desired Culture	0
`P4`	Principle 4: Demonstrates Commitment to Core Values	0
`P5`	Principle 5: Attracts, Develops, and Retains Capable Individuals	0
`P6`	Principle 6: Analyzes Business Context	0
`P7`	Principle 7: Defines Risk Appetite	0
`P8`	Principle 8: Evaluates Alternative Strategies	0
`P9`	Principle 9: Formulates Business Objectives	0
`SUMMARY-FAQ`	The executive summary and COSO's September 2017 FAQ	0

Tell me when COSO Enterprise Risk Management (ERM) Framework (2017) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

KPI definitions
Targets register
Improvement log
Improvement register
Customer feedback
Action records

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Improvements not tracked named by 3 frameworks

What this page is

A control-level reference for COSO Enterprise Risk Management (ERM) Framework (2017), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition