Scope sheet
finbryn.com
Internal audit and risk
Enterprise risk management support using COSO ERM and ISO 31000
Finbryn provides enterprise risk management support for CEOs, CFOs and boards of mid-sized companies, PE-backed businesses and nonprofits that have never run a formal risk process, leading workshops and preparing a risk register, scoring scale and board paper on COSO's ERM framework (June 2017 edition). Management and the board own the risks, and Finbryn issues no assurance report.
What is included
- A risk register with owner, impact, likelihood, controls and review date for each risk
- A scoring scale for impact and likelihood that the leadership team agrees before scoring
- A one-page risk appetite statement for the board to approve
- A board paper showing the top risks, indicators and overdue actions
- A review calendar that moves the register through the year
The process
- 1.
Kick-off with the sponsor
We agree who sponsors the work, which framework will be the vocabulary and which leaders will join the workshops.
- 2.
First workshop
The leadership team lists the events that could stop the company reaching its objectives and names an owner for each.
- 3.
Draft register and scoring scale
We merge the list, write each risk as cause, event and consequence and propose a scale the team agrees before scoring.
- 4.
Second workshop and scoring
Leaders score impact and likelihood, then discuss the gaps and set responses and indicators.
- 5.
Risk appetite statement and board paper
A one-page appetite statement and a two-page paper go to the board for changes and approval.
- 6.
Review calendar
Each risk is reviewed on a set date, and the register is refreshed at least once a year.
Software
Microsoft Excel, Microsoft Word
Pricing
Scoped by the number of workshops, the size of the leadership team and how many entities the register covers. It runs separately from the monthly tiers on the pricing page, and Finbryn confirms the fee in writing before the first workshop.
Finbryn is a brand of Northlane Solutions Inc., a Delaware corporation.
Reviewed October 2026