Seeing risk sliced up by department is the traditional model of management. Finance handles finance, quality handles quality, compliance handles compliance. ERM — enterprise risk management — does the opposite: it looks across the whole company, integrated with strategy. The world's two great frameworks for this are COSO ERM and ISO 31000. This piece sorts out the structure of the two frameworks, when to use each, and where materials review sits within them.
01Summing Up Isolated Controls Misses Something
Traditional risk management was self-contained within each department. Foreign-exchange risk to the finance department, product incidents to the quality division, advertising deviations to the review function. Each guards its own post. At first glance, this looks reasonable.
The problem arises when risks chain across departmental boundaries. Summing isolated risks cannot capture the correlation between risks, or the domino in which a single tear spreads into another domain. The path by which one materials deviation chains into regulatory response, press coverage, loss of trust, and a rising cost of capital (taken up in Vol. 9) is invisible if you look only at the review function. So management puts in place a framework that ties the whole company together along a single line — "objective → risk → response." This is the starting point of ERM.
02The Two Great Frameworks — COSO ERM and ISO 31000
Two frameworks are widely referenced for ERM. COSO ERM 2017, set out by the U.S. COSO, and ISO 31000:2018, from the International Organization for Standardization. Their aims are close, but their origins and emphases differ.
COSO ERM 2017 is a framework that integrates risk management into strategy and performance, built from 5 components and 20 principles: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication, and reporting. "Governance and culture" sits at the foundation — if it gives way, the components above it stop working. ISO 31000, by contrast, is a general-purpose framework not bound to any particular industry or organization, organized in three layers: principles, framework (leadership and commitment), and process (risk identification, analysis, evaluation, and treatment).
5 components, 20 principles, integrated with strategy
On a foundation of "governance and culture," it binds together strategy, performance, review, and communication. It can be implemented as an extension of internal control, and is easy to discuss in connection with governance.
Three layers: principles, framework, process
An industry-agnostic, general-purpose frame. It runs risk as a process of identification, analysis, evaluation, and treatment, and places leadership's commitment at the center of the framework.
Objective → risk → response, unified across the company
Both treat risk across the organization, working back from the organization's objective rather than summing local optima. The names and granularity differ, but the idea of keeping it consistent enterprise-wide is shared.
03Which to Use — Governance-Leaning COSO, General-Purpose ISO
The two are not in opposition. COSO is continuous with internal control, which makes it easy to place in the context of board oversight and governance. When the conversation extends to compensation, evaluation, and control activities, COSO's five components mesh with the language of management. This lies on the same governance continuum as the mechanism by which outside directors supervise execution from an independent position (The Board's View, Vol. 4).
By contrast, ISO 31000, as a general-purpose frame, is suited to building the procedures of on-the-ground risk assessment. Because its process is explicit, it is easy to translate into the work of individual review and evaluation. Many companies use the two in layers — COSO at the governance level, ISO at the operating level. The choice is not which is correct, but which layer you happen to be talking about right now. Framed that way, the relationship between the two frameworks does not become confusing.
04Materials Review Is One Process Within ERM's Control Activities
So where does materials review sit within this framework? In COSO ERM terms, review is one of the control activities; in ISO 31000 terms, it corresponds to the risk-treatment process. The act of inspecting materials before they go out and stopping deviations has a clear place as part of enterprise-wide risk management.
Once you grasp this placement, the way you explain review changes. Frame review as "an isolated censorship that rejects the field's work," and all you create is conflict with sales. Frame it within the enterprise framework — "this is one process among ERM's control activities" — and review is understood as a function that serves the objectives of management. If you know the difference — COSO leaning toward internal control, ISO toward a general-purpose frame — you can tell whether the other party is talking about governance or about operations, and hold the dialogue on the same ground. Sharing the name of the framework is also a way for the reviewer to hold the same language as management.
- Unlike isolated risk management, ERM looks across the whole company, integrated with strategy. Summing local optima misses the correlations and the dominoes.
- COSO ERM 2017 has 5 components and 20 principles. "Governance and culture" is the foundation, and it is easy to discuss as continuous with internal control.
- ISO 31000:2018 has three layers — principles, framework, process. An industry-agnostic, general-purpose frame, easy to translate into on-the-ground procedures.
- Materials review is one process within ERM's control activities. Not isolated censorship, but a function with a place inside enterprise-wide risk treatment.
- COSO. Enterprise Risk Management — Integrating with Strategy and Performance (COSO ERM 2017). Sets out the 5 components and 20 principles that integrate risk management with strategy and performance.
- ISO. ISO 31000:2018, Risk Management — Guidelines. An international standard that systematizes risk management in three layers: principles, framework, and process.