Enterprise risk management support using COSO ERM and ISO 31000

Either works if it is used consistently. The table compares what each one is, so the choice can rest on fit instead of habit.

Companies whose auditors and lenders already work from COSO's internal control framework often keep COSO ERM for consistency. Companies whose customers or regulators ask about ISO 31000 use its process and keep the register in the same format. ISO states that ISO 31000 cannot be used for certification, so a claim of being ISO 31000 certified on a customer questionnaire is wrong and should be corrected, not repeated.

A register row has the same few fields for every risk. Keeping them identical is what lets the board compare a cyber risk with a customer concentration risk.

• A risk statement in the form cause, event, consequence (for example: because two customers hold most of the receivables, a late payment from either could breach a loan covenant).
• The objective the risk threatens and the owner, a named executive.
• Impact and likelihood scores on the agreed scale, before and after the controls that exist.
• The response: accept, reduce, transfer or avoid, with the action and the date.
• One or two key risk indicators, such as days sales outstanding or the number of unreconciled items, that give early warning.
• The date the risk was last reviewed and the date of the next review.

The first workshop produces a long list of candidate risks. The second merges them into a register of a size the board can read. Finbryn drafts, the leadership team edits, and no risk goes into the register without an owner who agreed to it.

COSO's Principle 7 says the organization defines risk appetite in the context of creating, preserving and realizing value. For a mid-sized company that becomes a one-page statement the board approves, written in measures the leadership team can act on. It might say that cash will not fall below a stated number of weeks of payroll, that no single customer will exceed a stated share of revenue, that the company will not enter a market without a feasibility study, or that any breach of a loan covenant goes to the board in the same week.

The statement is useful only if it can be breached. A statement such as "we have low appetite for risk" cannot be tested, while "cash cover below the stated floor is reported to the board within the week" can be. Finbryn drafts the statement from the workshop and the register, the board changes it, and it is reviewed with the register each year. The measures usually line up with the covenants in your lender covenant reporting, if you have one.

The board paper is two pages: the top risks and how each has moved since last time, the key risk indicators against their thresholds, the actions that are overdue and one or two decisions the board is asked to make. A heat map of impact against likelihood helps a reader see the shape at a glance, as long as the scores underneath have reasons attached.

For a company that may list, the same paper builds the habit that disclosure rewards. Item 407(h) of SEC Regulation S-K requires a registrant to describe the board's role in the oversight of risk, including how the board administers that function and how it relates to the board's leadership structure. A board that already reviews a register has something to describe. The board reporting pack guide shows how the risk paper sits beside the financial pages.

Internal audit evaluates this process and should not run it. If Finbryn ran your risk workshops or keeps the register current, our independence policy keeps risk management itself off any internal audit plan we support until the chief audit executive confirms, as Standard 2.2 requires, that the earlier advisory work does not impair objectivity. If the same person leads both, Standard 7.1 of the Global Internal Audit Standards requires alternative arrangements for objective assurance over the area where the chief audit executive has the other role.

The register and the audit plan answer different questions. The register asks what could stop the business from reaching its objectives. The audit plan asks which of those risks to test this year, and how. Standard 9.1 of the Global Internal Audit Standards requires the chief audit executive to understand how the organization identifies and assesses significant risks and selects control processes before building the plan, so a register that exists makes that step faster.

When there is no register, the first internal audit plan includes a risk assessment of its own. That still works, but it covers fewer risks than a register built with the whole leadership team and it stops at the audit universe. When there is a register, the audit plan starts from its top-rated risks, adds areas the register does not cover and reports back on whether the controls named in the register operate. Both pages are written to be used together: see co-sourced internal audit for who performs the testing.

Finbryn runs risk workshops and prepares the risk register, scoring and board reporting for management and the board to own. Finbryn does not manage risk for the company, give legal advice or issue any assurance report. It does not rate a risk as acceptable on the board's behalf, and it does not provide the opinion on internal control that a lender or regulator might request.

This is risk management support. It is not an audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or internal control.

Insurance purchasing, legal exposure and regulated risk such as bank capital are outside the scope. Where a risk needs a specialist, the register names the specialist as the response.