There’s a lot to like in COSO’s From Guidance to Action: Exploring Practical Enterprise Risk Management. While it says it’s about applying the COSO ERM framework, I think it goes well beyond that limited document. My congratulations to the people at Crowe who wrote it.
With this document, COSO has moved to a clear focus on enabling informed and intelligent decisions. For example, they say that they want to:
…move ERM from documenting risks to influencing choices. The goal is embedded risk decisioning – a repeatable way of working, built into planning, investment, delivery, and escalation – so leaders get decision-ready risk signals even when the risk team isn’t driving.
In other words, effective risk management helps an organization succeed, not just avoid failures.
That is excellent! So is their explanation that the level of risk is not a single point.
Here are some key quotes:
- ERM earns relevance when it contributes to decisions, not just documents. Its value shows up in outcomes leaders and boards care about: clearer choices, earlier pivots, fewer surprises, and stronger board confidence.
- If ERM does not influence decisions, it is activity, not effectiveness.
- Many programs produce outputs; far fewer improve decisions. Heavy artifact production – risk registers,…
