Identify the components of the ERM Framework as per COSO

The COSO ERM framework is structured around 8 components. These components apply across all four business objectives and at every level of the organization.

Internal Environment:

This is the foundation. It establishes the entity’s risk culture — the risk management philosophy, risk appetite, integrity, and ethical values. Everything else in ERM is built on this foundation.

Objective Setting:

Objectives must exist before management can identify risks that might affect their achievement. This component sets the enterprise risk objectives in alignment with the organization’s mission and strategic direction.

Event Identification:

The bank identifies internal and external events that may affect the entity’s ability to achieve its objectives. Events can have positive impacts (opportunities) or negative impacts (risks).

Risk Assessment:

Each identified risk is assessed based on two factors: how likely it is to happen, and how badly it could hurt the bank if it does. This allows management to determine how risks should be managed and prioritize their attention.

Risk Response:

After assessing risks, the bank decides what to do about them. There are four response options — the 4Ts: Tolerate (accept the risk), Treat (implement controls to reduce it), Transfer (insure or outsource it), or Terminate (stop the activity causing it).

Control Activities:

These are the actual policies, procedures, and controls put in place to ensure that risk responses are properly carried out throughout the organization at all levels.

Information and Communication:

Relevant information must be identified, captured, and communicated in a form and timeframe that allows people to carry out their responsibilities. Effective communication flows down, across, and up the organization.

Monitoring:

ERM is not a one-time exercise. This component involves continuously evaluating whether the ERM program is working effectively. Adjustments are made when it is not.