COSO's Updated Enterprise Risk Management Framework—A Quest For Depth And Clarity

In 2004, COSO published its first comprehensive guidance on enterprise risk management (ERM) ‐ Enterprise Risk Management — Integrated Framework. Then, in June of 2017, COSO released a new, more detailed and complex ERM framework titled Enterprise Risk Management—Integrating with Strategy and Performance. This article examines the relationship between ERM and internal control, and then examines the similarities and differences between the 2004 and 2017 COSO ERM Frameworks. While little is new in the 2017 Framework, its focus on the integration of ERM with strategy‐setting and performance and deeper recognition of the role of governance and culture provides a comprehensive framework and impetus for firms to be intentional about integrating these important concepts.