ERM Standards, Frameworks and Regulatory Context

Introduction

Enterprise risk management (ERM) is the coordinated discipline through which an organization identifies, assesses, responds to, monitors and reports risks that could affect its objectives. It is broader than insurance, internal control or compliance. ERM connects strategy, governance, capital, performance and assurance.

A graduate-level understanding of ERM requires more than memorizing framework components. Managers must determine which framework is appropriate, understand the assumptions embedded in each model, reconcile voluntary standards with legally binding regulation, and judge whether risk information genuinely improves decisions. This chapter compares the principal general-purpose frameworks—COSO ERM and ISO 31000—and then examines sector-specific expectations in banking, insurance and corporate governance.

Frameworks do not eliminate risk. They provide a common language, decision architecture and evidence base for managing uncertainty. Their effectiveness depends on organizational incentives, board competence, information quality, independence of assurance and the willingness of management to confront unfavorable information.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and structure of COSO ERM and ISO 31000.
2. Compare the assumptions, strengths and limitations of major ERM frameworks.
3. Interpret the relationship between principles-based standards and binding regulation.
4. Explain important Basel banking principles, solvency requirements and governance obligations.
5. Design an integrated ERM approach for a regulated organization.
6. Critically evaluate whether risk governance operates in substance rather than merely in form.

1. ERM Standards, Frameworks and Rules

The terms standard, framework, regulation and guidance are related but not interchangeable.

A framework normally answers: What should be governed? Who is responsible? Which processes should be performed? How should information flow? Regulation additionally answers: What must be done, by whom, by when and with what consequences for non-compliance?

A company may therefore use ISO 31000 as its enterprise-wide organizing framework, COSO Internal Control—Integrated Framework for control design, and sector regulations for capital, liquidity, reporting and governance. These instruments can be complementary, but they may also create duplication, inconsistent definitions and excessive documentation.

2. COSO Enterprise Risk Management

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published Enterprise Risk Management—Integrating with Strategy and Performance in 2017. Its central proposition is that risk management should be integrated with strategy formulation and performance management, rather than treated as a separate compliance activity.

COSO organizes ERM around five interrelated components and twenty principles:

1. Governance and culture: The board exercises risk oversight; the organization establishes operating structures, desired culture, commitment to competence and accountability.
2. Strategy and objective-setting: Risk, strategy and objectives are considered together. The organization assesses the business context, defines risk appetite, evaluates alternative strategies and formulates objectives.
3. Performance: Risks are identified, assessed for severity, prioritized, responded to and viewed across the portfolio. The organization identifies significant changes and reviews risk and performance.
4. Review and revision: ERM capabilities are evaluated and substantive changes are identified and managed.
5. Information, communication and reporting: Relevant risk information is obtained, communicated internally and reported to appropriate stakeholders.

COSO also presents ERM through six forms of value: the relationship between mission, vision and core values; strategy and business objectives; risk in relation to performance; portfolio view; risk appetite; and the organization’s overall risk profile. The familiar COSO “cube” should not be interpreted as a mechanical sequence. Its components interact, and the framework is intended to be adapted to organizational circumstances.

Risk appetite and performance

Risk appetite is the types and amount of risk an organization is willing to accept in pursuit of its objectives. It is distinct from risk capacity, which is the maximum risk the organization can absorb without breaching legal, financial or operational constraints. Tolerance usually describes acceptable variation around a specific objective or limit.

For example, a bank may have an appetite for measured credit risk but a very low appetite for unauthorized trading. A useful appetite statement should specify boundaries, ownership, metrics, escalation triggers and consequences. Vague statements such as “we have a moderate appetite for risk” are not operationally useful.

COSO encourages a portfolio view. A risk that appears immaterial in isolation may become material through correlation, concentration or contagion. Conversely, a risk may be acceptable because it diversifies other exposures. This does not require a single numerical model, but it does require integrated analysis.

3. ISO 31000

ISO 31000:2018, Risk management—Guidelines, presents risk management as coordinated activities to direct and control an organization with regard to risk. It defines risk as the effect of uncertainty on objectives. An effect may be positive, negative or both; risk is therefore not limited to threats.

ISO 31000 is built around three related elements:

• Principles, which describe characteristics of effective risk management;
• Framework, which embeds risk management in leadership, integration, design, implementation, evaluation and improvement; and
• Process, which describes communication and consultation, scope/context/criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting.

The ISO principles emphasize integration, a structured and comprehensive approach, customization, inclusiveness, dynamism, use of the best available information, consideration of human and cultural factors, and continual improvement.

Risk assessment in ISO 31000 consists of identification, analysis and evaluation. Identification asks what might happen, why and with what consequences. Analysis examines likelihood, consequences, controls and uncertainty. Evaluation compares the analyzed risk with risk criteria to determine whether further action is required.

ISO 31000 does not prescribe a universal risk matrix, capital formula or organizational chart. This flexibility is a strength for multinational and non-financial organizations, but it can also produce weak implementation. A matrix with arbitrary colors is not a risk management system unless its scales, evidence, thresholds, owners and decision consequences are defined.

4. Comparing COSO ERM and ISO 31000

The frameworks are not competing legal regimes. An organization can use ISO terminology and process while using COSO’s strategy, appetite, performance and reporting concepts. The crucial task is to establish a single internal taxonomy and map external requirements to it.

Related frameworks

The COSO Internal Control—Integrated Framework focuses on reasonable assurance regarding operations, reporting and compliance objectives. It is narrower than COSO ERM. ERM includes risk in strategy and performance; internal control is one important response mechanism.

The Three Lines Model, associated with the Institute of Internal Auditors, clarifies accountability. The governing body provides oversight; management and operational functions own and manage risk; risk, compliance and similar functions provide expertise, monitoring and challenge; internal audit provides independent assurance. The model is about roles, not three rigid organizational departments.

COBIT supports governance and management of enterprise information and technology. NIST cybersecurity frameworks support cybersecurity risk identification and treatment. IFC Performance Standards and environmental, social and governance guidance may be relevant to sustainability and project finance. Sector frameworks should be mapped rather than allowed to create disconnected risk silos.

5. Regulatory Context and the Principle of Proportionality

Regulatory expectations differ by jurisdiction and sector, but common themes are visible:

• the board remains accountable for oversight;
• risk management must be independent enough to challenge revenue-producing units;
• material risks must be identified across the organization;
• capital, liquidity and solvency must be adequate for the risk profile;
• stress testing must consider severe but plausible conditions;
• information must be timely, accurate and aggregated;
• outsourcing and third-party risks must be controlled; and
• breaches must be escalated and remediated.

The principle of proportionality means that governance, systems and reporting should reflect an institution’s size, complexity, risk profile and systemic importance. Proportionality does not mean that smaller firms may ignore governance. It means that a smaller institution may use simpler but demonstrably effective processes.

Regulatory compliance is a floor, not the complete definition of sound ERM. A firm can satisfy a formal requirement while still suffering from poor culture, unrealistic assumptions or ineffective challenge.

6. Banking: Basel Principles and Capital Expectations

The Basel Committee on Banking Supervision develops internationally agreed supervisory standards. The Basel Framework includes minimum capital requirements, supervisory review and market discipline, commonly described as three pillars.

Pillar 1: minimum capital requirements

Banks calculate risk-weighted assets (RWA) for credit, market and operational risk using approaches permitted by the applicable regulatory regime. A simplified capital ratio is:

Eligible regulatory capital must satisfy regulatory definitions; it is not simply the accounting book value of equity. RWA are not the same as total assets because exposures receive different risk weights or are modeled under approved approaches. The ratio is dimensionless because both numerator and denominator are monetary amounts. The calculation applies only when capital and RWA are measured under the same regulatory scope, currency convention and reporting date.

The Basel framework distinguishes common equity tier 1 (CET1), additional tier 1 and tier 2 capital. Basel standards also include a capital conservation buffer, a leverage ratio that limits excessive balance-sheet leverage, liquidity standards such as the liquidity coverage ratio and net stable funding ratio, and expectations concerning large exposures and systemically important institutions. Exact minimums, buffers and implementation dates depend on the jurisdiction and institution.

Pillar 2: supervisory review

Pillar 2 requires banks and supervisors to assess whether capital and risk management are appropriate for the bank’s full risk profile. The institution’s internal capital adequacy assessment process (ICAAP) should consider risks not fully captured in Pillar 1, including concentration, interest-rate risk in the banking book, strategic risk, reputational risk, pension risk and model risk. Supervisors conduct a supervisory review and evaluation process and may require additional capital or remediation.

Pillar 3: market discipline

Pillar 3 promotes transparency through disclosures that allow market participants to assess a bank’s risk exposures, capital position, risk management and relevant assumptions. Disclosure is not a substitute for supervision, but poor disclosure can conceal concentrations and weaken accountability.

Stress testing and liquidity

Stress testing examines whether capital, liquidity and earnings remain adequate under adverse conditions. Scenarios should be severe but plausible and should consider feedback effects, management actions and correlated risks. A stress test is not a forecast; it is a structured exploration of vulnerability.

A liquidity coverage ratio is conceptually expressed as:

The formula is applicable only under the regulatory definitions of high-quality liquid assets and net cash outflows, including prescribed haircuts, inflow caps and scenario assumptions. It should not be interpreted as a general measure of profitability or long-term solvency.

7. Insurance: Solvency and Enterprise Risk

Insurance regulation is concerned with the ability to meet policyholder obligations over time. Solvency systems generally combine valuation rules, eligible own funds, a risk-based capital requirement, governance, supervisory review and public disclosure.

Under the European Union’s Solvency II regime, the solvency capital requirement (SCR) is calibrated to protect policyholders against a severe loss over a one-year horizon, commonly described as a 99.5% value-at-risk confidence level. The precise calculation may use a standard formula or an approved internal model. The minimum capital requirement (MCR) is a lower threshold associated with a level of capital below which ultimate supervisory intervention becomes more immediate.

A simplified solvency ratio is:

Both quantities must be calculated using the applicable regulatory valuation and eligibility rules. The ratio is not equivalent to an accounting equity ratio. Insurance ERM must address underwriting, reserving, market, credit, liquidity, operational, catastrophe, reinsurance, conduct and group risks. The own risk and solvency assessment (ORSA) is a key forward-looking process through which an insurer assesses its risks, capital needs and ability to remain within requirements under stressed conditions.

8. Corporate Governance Obligations

Corporate governance determines who has authority, responsibility and accountability for risk. Although legal duties differ across jurisdictions, sound governance commonly requires the board to:

• approve strategy and risk appetite;
• oversee material risks and internal control;
• ensure adequate expertise and independence;
• challenge management assumptions;
• monitor culture, incentives and conflicts of interest;
• oversee financial reporting and external assurance; and
• ensure that significant deficiencies are corrected.

A board risk committee can improve focus, but delegating review to a committee does not remove the board’s collective responsibility. The chief risk officer should have sufficient stature, access to the board or risk committee, resources and independence from business-line incentives. The audit committee generally focuses on financial reporting, audit and control assurance; the risk committee focuses more broadly on risk appetite, profile and risk governance. Responsibilities must be coordinated.

Executive compensation is a risk-governance issue. Bonuses based solely on short-term revenue may encourage excessive risk-taking. Better designs incorporate risk-adjusted performance, deferral, malus and clawback mechanisms where legally permissible.

9. Integrating Frameworks in Practice

A practical integration method has six stages:

1. Establish a common taxonomy. Define risk categories, events, causes, consequences, controls, metrics and owners.
2. Map obligations. Link laws, regulations, supervisory guidance, standards and contractual requirements to accountable processes.
3. Set governance and appetite. Specify decision rights, escalation thresholds, limits and reporting routes.
4. Assess risk consistently. Combine qualitative judgment with quantitative analysis, scenario testing and control evaluation.
5. Aggregate and report. Present risk by legal entity, business line, geography, product and enterprise portfolio.
6. Assure and improve. Use monitoring, regulatory review, internal audit, independent validation and lessons from incidents.

Technology can support data lineage, automated controls, dashboards and scenario analysis. Artificial intelligence may assist in anomaly detection, adverse-news monitoring and document review, but it introduces model, data, explainability, privacy, cybersecurity and third-party risks. AI outputs should be treated as evidence for professional judgment, not as an unreviewed replacement for accountable decision-making.

10. Illustrative Case: Meridian Bank’s Fragmented ERM

Background

Meridian Bank is a fictional mid-sized commercial bank operating in three countries. It uses COSO terminology at group level, an ISO-based operational-risk process in its subsidiaries, and regulatory capital reporting managed by finance. The board receives separate reports on credit risk, cyber risk, liquidity and conduct.

Problem

The bank’s total capital ratio appears comfortably above its regulatory minimum. However, a stress exercise reveals that a rapid increase in interest rates would reduce the value of securities, increase deposit withdrawals and weaken borrowers’ debt-service capacity. The credit, market and liquidity reports use different business hierarchies, so the board cannot see the combined exposure. A technology subsidiary also relies on a cloud provider without a tested exit plan.

Analysis

The formal frameworks are present, but integration is weak. Capital compliance has been treated as equivalent to enterprise resilience. Risk appetite statements do not contain measurable thresholds. The three lines have overlapping responsibilities, and internal audit has not independently validated the stress-testing model. The risk committee receives information but lacks a consolidated view of concentrations and management actions.

Approach and solution

Meridian establishes a board-approved taxonomy and risk appetite statement. It maps COSO components to ISO processes and assigns regulatory obligations to named owners. Finance, treasury and risk jointly develop a scenario that links interest-rate shocks, deposit outflows, collateral values and borrower defaults. The bank introduces limits for concentration and liquidity survival horizons, requires model validation and creates a third-party exit plan. The chief risk officer receives direct access to the risk committee, while business units retain first-line ownership.

The bank also distinguishes three measures: regulatory capital compliance, internal capital adequacy and recovery capacity. These are reported together but not treated as identical. Escalation triggers specify who acts, how quickly and which actions are permitted.

Outcome

In the next exercise, the bank identifies a capital shortfall earlier, reduces concentrated exposures and demonstrates to its supervisor that management actions are credible. The most important improvement is not a new software platform; it is the alignment of data, accountability, scenarios and decisions.

Learning points

1. Multiple frameworks require mapping and translation, not parallel bureaucracy.
2. A satisfactory regulatory ratio does not guarantee resilience under stress.
3. Correlated risks must be analyzed across business and legal-entity boundaries.
4. Board information must support decisions, not merely document meetings.
5. Outsourcing risk remains the organization’s responsibility.

11. Challenges and Critical Evaluation

Framework proliferation can produce duplicated registers and inconsistent reporting. The remedy is a controlled internal framework with cross-references to external requirements.

False precision arises when subjective estimates are presented as highly accurate scores. Models should communicate uncertainty, sensitivity and confidence limitations.

Model risk includes inappropriate design, poor data, coding errors, misuse and failure to update assumptions. Independent validation and outcome monitoring are essential.

Risk aggregation is difficult because exposures may be measured at different frequencies, horizons and confidence levels. Correlations can change in crises, so diversification benefits should not be assumed to be stable.

Culture and incentives cannot be inferred from policy documents alone. Indicators include challenge quality, escalation behavior, treatment of bad news, employee turnover, whistleblowing patterns and whether senior performers are held accountable.

Regulatory arbitrage occurs when institutions structure activity to reduce formal requirements without reducing underlying risk. Supervisors increasingly examine substance, group-wide exposures, outsourcing and non-financial risk rather than relying only on legal-entity ratios.

Sustainability and climate-related risk are increasingly incorporated into supervisory expectations. Climate risk may affect credit, market, insurance, operational and reputational exposures through physical and transition channels. It is often a driver of existing risk categories rather than a completely separate risk type. Scenario analysis is useful, but long horizons, uncertain policy responses and limited historical data make results highly assumption-dependent.

Best-Practice Checklist

An effective ERM system should have:

• a board-approved appetite linked to strategy;
• clear ownership and independent challenge;
• a common taxonomy and reliable data lineage;
• documented criteria for likelihood, impact and control effectiveness;
• integrated capital, liquidity and solvency assessment;
• severe-but-plausible scenario analysis;
• reporting that highlights trends, concentrations and breaches;
• tested escalation and recovery actions;
• independent assurance and model validation; and
• periodic review of culture, incentives and emerging risks.

Chapter Summary

COSO ERM and ISO 31000 are complementary general-purpose approaches. COSO emphasizes governance, strategy, appetite, performance, portfolio thinking and reporting. ISO 31000 emphasizes principles, context, assessment, treatment, monitoring and continual improvement. Neither framework is a substitute for judgment, accountability or sector regulation.

Banking regulation adds risk-based capital, liquidity, supervisory review, stress testing and disclosure expectations. Insurance solvency regimes focus on policyholder protection, eligible own funds, risk-based capital and forward-looking solvency assessment. Corporate governance places ultimate oversight responsibility on the board and requires credible challenge, appropriate expertise, effective internal control and responsible incentives.

The central managerial lesson is integration. A mature ERM system translates external requirements into one coherent internal architecture, connects risk to decisions and tests resilience under uncertainty. Compliance is necessary, but effective ERM is demonstrated by the quality of decisions made before and during adverse conditions.

Key Terms

Enterprise risk management: Coordinated management of risks affecting organizational objectives.

Risk appetite: The amount and types of risk an organization is willing to accept.

Risk capacity: The maximum risk an organization can absorb within legal, financial and operational constraints.

Risk tolerance: Acceptable variation around a particular objective or limit.

COSO ERM: A framework integrating risk with strategy and performance.

ISO 31000: International guidelines for principles, framework and process of risk management.

Risk taxonomy: A structured classification of risk categories, events, causes and consequences.

Risk owner: Person accountable for managing a specified risk.

Three Lines Model: A model clarifying governance, management, risk support and independent assurance roles.

Risk-weighted assets: Regulatory exposure amounts adjusted for prescribed or modeled risk weights.

CET1 capital: The highest-quality form of regulatory bank capital, subject to regulatory eligibility rules.

Pillar 1: Basel minimum capital requirements.

Pillar 2: Supervisory review of capital adequacy and risk management.

Pillar 3: Public disclosure supporting market discipline.

Stress testing: Analysis of performance and solvency under adverse scenarios.

Liquidity coverage ratio: High-quality liquid assets relative to stressed 30-day net cash outflows.

Solvency ratio: Eligible own funds divided by a regulatory solvency capital requirement.

ORSA: An insurer’s forward-looking own risk and solvency assessment.

Model risk: Risk arising from inappropriate models, data, implementation, use or assumptions.

Proportionality: Application of requirements according to size, complexity and risk profile.

Review Questions

Short Answer Questions

1. Distinguish a framework from a regulation.
2. What are the five components of COSO ERM?
3. What three activities constitute risk assessment under ISO 31000?
4. What is the purpose of Basel Pillar 2?
5. Distinguish risk appetite from risk capacity.

Long Answer Questions

1. Compare COSO ERM and ISO 31000 in terms of purpose, structure, flexibility and implementation challenges.
2. Explain how Basel’s three pillars support banking-sector resilience.
3. Discuss the board’s responsibilities for enterprise risk governance.
4. Explain how insurance solvency requirements differ from ordinary accounting equity measures.
5. Evaluate the strengths and weaknesses of using risk matrices in enterprise risk management.

Analytical / Application Questions

1. A bank’s capital ratio is above its regulatory minimum, but its stress test shows severe liquidity pressure. Explain why this is possible and recommend three management actions.
2. Design a framework-integration plan for a multinational organization using COSO ERM, ISO 31000 and a sector-specific regulatory framework.
3. Assess Meridian Bank’s original ERM arrangements using the Three Lines Model and recommend changes to accountability, challenge and assurance.

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes COSO ERM from a narrow internal-control framework?

A. It integrates risk with strategy and performance.

B. It eliminates the need for board oversight.

C. It applies only to financial institutions.

D. It prescribes one universal risk matrix.

Correct Answer: A. It integrates risk with strategy and performance.

Question 2

Under ISO 31000, risk is best defined as:

A. The probability of a financial loss only.

B. The effect of uncertainty on objectives.

C. Any event that violates a regulation.

D. The amount of insurance purchased.

Correct Answer: B. The effect of uncertainty on objectives.

Question 3

Which Basel pillar concerns public disclosure and market discipline?

A. Pillar 1

B. Pillar 2

C. Pillar 3

D. The leverage pillar

Correct Answer: C. Pillar 3

Question 4

A bank has eligible regulatory capital of 120 million and risk-weighted assets of 1,000 million. Its capital ratio is:

A. 0.12%

B. 1.2%

C. 12%

D. 120%

Correct Answer: C. 12%

Question 5

Which statement about risk appetite is correct?

A. It is the maximum risk physically possible in the economy.

B. It describes the types and amount of risk the organization is willing to accept.

C. It is identical to a risk register.

D. It applies only to insurance underwriting.

Correct Answer: B. It describes the types and amount of risk the organization is willing to accept.

Question 6

The primary purpose of an insurer’s ORSA is to:

A. Replace all regulatory capital requirements.

B. Assess forward-looking risks, capital needs and solvency.

C. Calculate employee bonuses.

D. Set accounting depreciation rates.

Correct Answer: B. Assess forward-looking risks, capital needs and solvency.

Question 7

In the Three Lines Model, internal audit primarily provides:

A. First-line ownership of business risks.

B. Independent assurance.

C. The board’s risk appetite.

D. External credit ratings.

Correct Answer: B. Independent assurance.

Question 8

If high-quality liquid assets are 150 million and stressed 30-day net cash outflows are 100 million, the simplified LCR is:

A. 0.67%

B. 1.5%

C. 67%

D. 150%

Correct Answer: D. 150%

Question 9

Why is regulatory compliance considered a floor rather than the complete definition of sound ERM?

A. Regulation never addresses risk.

B. An organization may comply formally while retaining weak culture or poor resilience.

C. Regulators prohibit internal controls.

D. Compliance applies only to shareholders.

Correct Answer: B. An organization may comply formally while retaining weak culture or poor resilience.

Question 10

Which action best addresses framework proliferation?

A. Create an unrelated risk register for every standard.

B. Ignore sector regulations and use only one voluntary framework.

C. Create a common internal taxonomy and map external requirements to it.

D. Transfer all risk ownership to internal audit.

Correct Answer: C. Create a common internal taxonomy and map external requirements to it.