In 2004, COSO issued Enterprise Risk Management—Integrated Framework (ERM Framework), which establishes a framework for enterprise risk management and provides guidance to business and other entities to help them develop and apply their enterprise risk management activities. It identifies and describes eight interrelated components necessary for effective enterprise risk management.

The ERM Framework defines enterprise risk management as a process, effected by an entity's board of directors, management, and other personnel, applied both in strategy-setting and across the entity, designed to identify potential events that may affect the entity, to manage risk, and to provide reasonable assurance that the objectives of an entity will be achieved. Organizations that have implemented the ERM Framework will likely see minimal impact on their enterprise risk management efforts resulting from the issuance of this Internal Control—Integrated Framework: Framework and Appendices.

This appendix outlines the relationship between the Internal Control—Integrated Framework and the ERM Framework.

A Broader Concept

Enterprise risk management is broader than internal control, elaborating on internal control and focusing more directly on risk. Internal control is an integral part of enterprise risk management, while enterprise risk management is part of the overall governance process. This relationship is depicted in the illustration below.

 

The publication Enterprise Risk Management—Integrated Framework remains in place for entities and others looking broadly at enterprise risk management.