COSO ERM Guide

I really like COSO new guidance: “From Guidance to Action: Exploring Practical Enterprise Risk Management.”

For me, this publication does exactly what many ERM materials fail to do: it translates risk management from a framework, methodology, or reporting exercise into a practical operating model for decision-making.

The document makes a very important point: ERM should move organizations from documenting risks to influencing choices. Risk management should not be limited to heat maps, registers, long risk lists, and quarterly reports. It should provide decision-ready signals: what changed, what matters now, who owns the response, and what should trigger action.

Photo: https://www.magnific.com/pl/

This is very close to how I usually define risk management in one sentence:

Risk management is making conscious decisions based on the information available at a given moment.

COSO clearly emphasizes that strategy and risk are inseparable. Every strategic decision includes an explicit or implicit risk posture. The only question is whether the organization discusses that posture early enough, when decisions can still be shaped, or too late...

The publication also identifies four ideas that make the difference between ERM activity and ERM impact:

•  ERM creates value through both protection and creation.

• Strategy and risk must be linked.

• Many organizations still face a real implementation gap.

• Effective ERM must be decision-led, lightweight, and embedded in how the business operates.

This is exactly the direction risk management should take.

The guide presents 10 ERM operating disciplines that, in my opinion, reflect very well what risk management should be in practice:

1. Link strategy and risk

2. Treat value creation as a required outcome

3. Make risk appetite meaningful and usable

4. Manage risk as a portfolio

5. Prioritize decisions over documentation

6. Measure value, not activity

7. Run governance as a behavior system

8. Embed ERM into operating rhythms

9. Build candor as a capability

10.  Learn continuously

In many organizations, ERM still becomes a reporting cycle. Risks are identified, scored, mapped, updated, and presented. But the key question is often missing:

• What decision did this change?

• If ERM does not influence a decision, trigger an escalation, change a priority, improve resource allocation, or help leaders understand uncertainty, then it may be activity, but it is not value.

The goal is not a bigger risk register or a better-looking heat map. The goal is fewer surprises, faster pivots, visible ownership, and practices that work under real constraints.

Link

Author: Sebastian Burgemejster