COSO ERM Components: Governance, Strategy, Performance, Review, Information

I was sitting in a boardroom in Chicago back in 2017 when the CFO of a $2 billion manufacturing company asked me a question that changed how I think about risk management: "We have ISO 27001, SOC 2, internal audit, compliance officers, and a risk committee. So why did we just lose $47 million to a supply chain disruption we never saw coming?"

The answer was uncomfortable but enlightening: they were managing individual risks brilliantly but had no enterprise view of how those risks interconnected, amplified each other, and impacted strategic objectives.

That's where COSO's Enterprise Risk Management Framework becomes invaluable. And after implementing it across industries from healthcare to financial services to manufacturing over the past fifteen years, I can tell you this: COSO ERM isn't just another compliance checklist—it's a fundamental shift in how organizations think about risk, strategy, and performance.

Let me take you through the five components that make COSO ERM actually work in the real world.

Understanding COSO ERM: More Than Risk Management

Before we dive into the components, let's get something straight. COSO ERM isn't about preventing all risks. It's about understanding risks well enough to make informed decisions about which ones to take, which to mitigate, and which to avoid entirely.

I remember consulting with a fintech startup in 2020. Their founding team was paralyzed by risk. Every new feature, every market expansion, every partnership got bogged down in endless "what if" discussions. They were so focused on avoiding risk that they were missing massive opportunities.

When we implemented COSO ERM, something clicked. The framework helped them distinguish between risks that threatened their core business and risks worth taking for strategic advantage. Within six months, they'd launched in three new markets, acquired two competitors, and tripled revenue—not by ignoring risk, but by managing it strategically.

"Risk management isn't about eliminating risk. It's about making risk-aware decisions that align with your strategic objectives and risk appetite."

The Five Components: An Integrated System

Here's what makes COSO ERM different from other risk frameworks: the five components work together as an integrated system. You can't cherry-pick. You can't skip steps. Each component builds on and reinforces the others.

Let me show you how they connect:

Now let's break down each component with real-world application.

Component 1: Governance & Culture – The Foundation That Everything Builds On

In 2019, I worked with a healthcare system that had spectacular risk management documentation. Policies for everything. Risk registers that would make auditors weep with joy. And yet, they had three significant security breaches in eighteen months.

The problem? Their culture didn't support risk management. Frontline employees saw risk procedures as bureaucratic obstacles. Middle managers bypassed controls to hit performance targets. Senior leadership talked about risk but rewarded results regardless of how they were achieved.

Governance and culture isn't about what you say—it's about what you reward, what you tolerate, and what you model from the top.

What Governance & Culture Actually Means

This component establishes the foundation for enterprise risk management through:

Board Oversight:

• Setting the organization's risk appetite

• Reviewing major risk decisions

• Ensuring adequate resources for risk management

• Holding management accountable for risk outcomes

Operating Structures:

• Defining roles and responsibilities for risk management

• Establishing reporting lines and accountability

• Creating risk committees and oversight functions

• Integrating risk into organizational structure

Organizational Culture:

• Defining ethical values and expected behaviors

• Creating psychological safety for risk reporting

• Rewarding risk-aware decision making

• Punishing risk-taking that violates appetite

Real-World Implementation

Here's what worked at a financial services company I advised:

Before COSO ERM:

• Risk management was the compliance team's job

• Business units saw risk officers as roadblocks

• Risk discussions happened after decisions were made

• People were afraid to report near-misses

After Implementing Governance & Culture:

• Every business unit had embedded risk champions

• Risk appetite was discussed before major initiatives

• Monthly risk reviews became strategic planning sessions

• Near-miss reporting increased 340% (without punishment)

The transformation took eighteen months, but the result was remarkable. They avoided a $12 million fraud scheme because a junior analyst felt empowered to question a transaction that "felt wrong" despite pressure from a senior executive.

"Culture eats strategy for breakfast. And in risk management, culture determines whether your framework is a living system or just impressive documentation."

Key Elements of Effective Governance & Culture

My Experience: The CEO Who Changed Everything

I'll never forget working with a regional bank where risk management was failing despite massive investment in tools and training. The turning point came when the new CEO did something radical.

In his first board meeting, he presented three strategic initiatives and asked the board to help him identify what could go wrong. Not as theater—he genuinely wanted their input. Then he publicly committed to reporting on those specific risks quarterly, whether the news was good or bad.

Within three months, the cultural shift was palpable. If the CEO could openly discuss risks and uncertainties, everyone else could too. Risk reporting tripled. Early warnings reached decision-makers. They avoided two regulatory issues and a major technology failure simply because people felt safe raising concerns.

That's governance and culture in action.

Component 2: Strategy & Objective-Setting – Where Risk Meets Ambition

Here's a pattern I've seen repeatedly: organizations set ambitious strategic objectives, then treat risk management as a separate exercise that happens afterward. It's like building a rocket ship and then asking security to fireproof it once it's already built.

COSO ERM flips this around. Risk considerations should shape strategy from the beginning.

The Strategy-Risk Integration

In 2021, I worked with a technology company planning aggressive international expansion. Their initial strategy: enter 12 new countries in 18 months.

When we applied COSO ERM's Strategy & Objective-Setting component, we analyzed:

The revised strategy was less aggressive on paper but far more likely to succeed. And it did—they're now successfully operating in 8 countries with positive cash flow, while competitors who rushed in are retreating from several markets after expensive failures.

How to Apply Strategy & Objective-Setting

Step 1: Define Business Context

Understand the environment you're operating in:

• Market dynamics and competitive landscape

• Regulatory requirements and trends

• Technological changes and disruptions

• Stakeholder expectations and pressures

I worked with a healthcare provider that set aggressive growth targets without considering the regulatory environment. CMS was tightening reimbursement rules, which would directly impact their revenue model. By integrating risk analysis into strategy setting, they pivoted to a more sustainable growth model focused on efficiency rather than volume.

Step 2: Define Risk Appetite

This is where most organizations struggle. Risk appetite isn't "we're conservative" or "we're aggressive." It's specific, quantified boundaries.

Here's an example from a manufacturing client:

Step 3: Evaluate Alternative Strategies

Don't just analyze your chosen strategy—analyze the alternatives too.

A retail client was debating three growth strategies:

1. Aggressive e-commerce expansion

2. Physical store expansion in new regions

3. Hybrid model with moderate growth in both

We built a risk assessment for each:

They chose the hybrid approach. While competitors went all-in on e-commerce and struggled with fulfillment issues and cyber attacks, this company grew steadily with manageable risk.

Linking Strategy to Performance

Here's where it gets powerful: once you've set risk-informed strategic objectives, you need to cascade them down to operational objectives with their own risk considerations.

Strategic Objective: Expand into Asian markets

• Performance Objective 1: Establish operations in Singapore within 12 months

  • Associated Risks: Regulatory approval delays, talent acquisition challenges, technology infrastructure

• Performance Objective 2: Achieve $10M revenue in Year 1

  • Associated Risks: Market acceptance, pricing pressure, currency fluctuation

• Performance Objective 3: Maintain existing service levels in current markets

  • Associated Risks: Resource drain, leadership attention divided, quality degradation

Each objective has assigned ownership, specific metrics, and identified risks that need monitoring.

"Strategy without risk management is hope. Risk management without strategy is paranoia. COSO ERM integrates both into informed decision-making."

Component 3: Performance – Turning Risk Awareness Into Action

The Performance component is where the rubber meets the road. This is about identifying, assessing, prioritizing, and responding to risks in the context of your strategic objectives.

I've seen organizations with 500+ risks in their risk register, tracking everything from meteor strikes to coffee machine malfunctions. That's not risk management—that's risk theater.

The Real Performance Component

In 2020, I helped a pharmaceutical company streamline their risk management. They had 847 identified risks. We applied COSO ERM's Performance component rigorously:

Risk Identification Process:

Then we prioritized those 184 risks based on:

1. Impact on strategic objectives

2. Likelihood within strategic timeframe

3. Velocity (how fast the risk could materialize)

4. Current control effectiveness

The final result: 23 top-tier risks requiring active management, 61 secondary risks requiring monitoring, and 100 risks delegated to operational management.

This focus transformed their risk management from overwhelming to actionable.

Risk Assessment Framework

Here's the assessment methodology that's worked across industries:

Risk Response Strategies

Once you've assessed risks, you need to respond. COSO ERM defines four primary response strategies:

A Real-World Performance Story

Let me share a powerful example from 2022. I was advising a logistics company during the supply chain crisis. They'd identified a critical risk: dependency on a single port for 60% of their volume.

Risk Assessment:

• Impact: Critical ($200M+ revenue at risk)

• Likelihood: High (labor disputes, capacity constraints, weather)

• Velocity: High (disruptions could happen with <1 week warning)

• Current Controls: Weak (no alternatives identified)

Response Strategy Evaluation:

They chose to reduce the risk by investing $12M to develop capabilities at two alternative ports. Six months later, a major labor strike shut down their primary port for three weeks. While competitors scrambled and lost millions, they rerouted through alternatives with minimal disruption.

That $12M investment saved an estimated $67M in losses and prevented customer defections worth another $40M+ in long-term revenue.

Component 4: Review & Revision – The Component Most Organizations Ignore

Here's an uncomfortable truth: most organizations treat their ERM framework as a "set it and forget it" system. They build it, get it approved by the board, and then wonder why it becomes less relevant over time.

COSO ERM's Review & Revision component recognizes that risk management must evolve as the business, market, and threat landscape evolve.

What Gets Reviewed and When

The Power of Continuous Review

I worked with a technology company in 2020 that had a sophisticated ERM framework built in 2018. It was comprehensive, well-documented, and completely outdated.

Their 2018 framework focused heavily on:

• On-premises data center risks

• Traditional competitor threats

• Established market dynamics

• In-person customer engagement

By 2020, their reality was:

• 80% cloud infrastructure

• New competitors from adjacent industries

• Rapid market disruption

• Digital-first customer experience

Their top 10 risks from 2018 weren't even in the top 30 anymore. Meanwhile, their actual top risks—cloud vendor concentration, API security, digital customer experience—weren't adequately addressed.

We implemented a robust Review & Revision process:

Monthly Reviews:

• Key Risk Indicators (KRI) dashboard review

• New risk identification and escalation

• Control effectiveness monitoring

• Risk response progress tracking

Quarterly Reviews:

• Risk portfolio rebalancing

• Emerging risk assessment

• Control testing results

• Risk appetite alignment check

Annual Reviews:

• Complete framework relevance assessment

• Risk appetite recalibration

• Strategic risk landscape analysis

• ERM maturity evaluation

Within twelve months, their ERM framework was current, relevant, and actually driving decisions.

Key Risk Indicators: The Early Warning System

One of the most powerful tools in Review & Revision is developing meaningful Key Risk Indicators (KRIs). These are not the same as KPIs—they're forward-looking signals that a risk is increasing.

Here's an example from a financial services client:

When KRIs hit thresholds, it triggers review and action before the risk materializes.

Lessons from Crisis: COVID-19 Review & Revision

The COVID-19 pandemic perfectly illustrated why Review & Revision matters. I was working with seven different organizations when the pandemic hit, and the difference between those with robust review processes and those without was stark.

Organizations WITH Strong Review & Revision:

• Activated pandemic response plans within 48 hours

• Pivoted to remote work with minimal disruption

• Identified new risks (remote work security, mental health, supply chain) within first week

• Revised risk appetite based on new reality

• Adjusted strategic objectives based on changed market

Organizations WITHOUT Review & Revision:

• Took weeks to respond effectively

• Ad hoc decisions created new risks

• Struggled to identify what changed and how to adapt

• Maintained outdated risk priorities

• Missed market opportunities due to slow adaptation

One client with strong Review & Revision processes told me: "Our ERM framework didn't predict COVID-19, but it gave us the structure to respond, adapt, and emerge stronger. We reviewed and revised our entire risk portfolio in three weeks. Competitors are still figuring out what happened."

"In a changing world, a static risk management framework is a liability. Review and Revision transforms ERM from documentation into a dynamic decision-support system."

Component 5: Information, Communication & Reporting – Making Risk Visible

I've consulted with organizations that had excellent risk identification, thorough assessment, and smart response strategies. Yet they still failed because the right information didn't reach the right people at the right time.

Information, Communication & Reporting is the nervous system of your ERM framework. It's how risk intelligence flows through the organization, enabling informed decisions at every level.

The Three Layers of Risk Communication

Building Effective Risk Reporting

In 2021, I worked with a healthcare system whose risk reporting was failing spectacularly. They generated a 147-page monthly risk report that nobody read. The board received the same detailed information as operational managers. Critical risks were buried in pages of minutiae.

We rebuilt their reporting structure:

Board-Level Dashboard (1 page):

TOP ENTERPRISE RISKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk                          | Trend | Status | Appetite
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Cybersecurity Breach          |  ↑    |   🔴   | EXCEEDS
Regulatory Compliance         |  →    |   🟡   | WITHIN
Talent Retention              |  ↓    |   🟢   | WITHIN
Clinical Quality              |  →    |   🟢   | WITHIN
Financial Sustainability      |  ↑    |   🟡   | WITHIN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Management-Level Report (5 pages):

• Executive summary (same as board view)

• Top 10 risk details with metrics and trends

• Risk response status and resource requirements

• Emerging risk analysis

• Control effectiveness summary

Operational Dashboards (Real-time):

• Department-specific risks and KRIs

• Action items and ownership

• Control monitoring and testing status

• Incident tracking and lessons learned

The transformation was remarkable. Board engagement tripled. Management made faster risk-based decisions. Operational teams had clarity on their responsibilities.

Communication That Actually Works

Risk communication isn't just about reports—it's about creating a risk dialogue throughout the organization.

Here's what worked at a manufacturing company:

We doubled down on what worked and eliminated what didn't.

Technology-Enabled Risk Reporting

Let me be candid about technology: the best ERM tool is the one your organization will actually use. I've seen companies spend hundreds of thousands on sophisticated GRC platforms that became digital shelf-ware because they were too complex.

That said, the right technology can transform risk reporting:

A mid-sized financial services company I advised started with Power BI dashboards and SharePoint for documentation. Total cost: about $300/month. It worked perfectly for their needs and grew with them. Two years later, they invested in a mid-tier GRC platform, but only after they'd proven the value of structured risk management.

The Communication Failure That Became a Success Story

I need to share a painful but instructive example from 2019. A technology company had identified a critical vendor concentration risk—80% of a key component came from a single supplier in Southeast Asia.

The risk was properly identified, assessed as "Critical," and documented in their risk register. The board received quarterly updates showing this as a top risk. But nothing happened.

Why? The communication was informational, not actionable.

The reports said "Vendor concentration risk remains critical." But they didn't explain:

• What would happen if the supplier failed (6-month production halt, $200M revenue impact)

• What it would cost to mitigate (12M for alternative supplier development)

• What decision was needed (Board approval for investment)

• What would happen if we did nothing (accept risk that exceeded appetite)

When the supplier had a fire that halted production for two months, the company lost $89M and the board asked, "Why didn't we know about this?"

They did know. They just didn't know what to DO about it.

We rebuilt their risk communication to be action-oriented:

Before: "Vendor concentration risk status: Critical"

After: "DECISION REQUIRED: Vendor Concentration Risk

• Current State: 80% dependency on single supplier

• Risk: $200M revenue exposure if supplier fails

• Trend: Supplier financial health declining (credit rating downgraded)

• Options:

  1. Accept risk (exceeds board appetite) - $0 cost, full risk

  2. Develop alternative supplier - $12M investment, 70% risk reduction

  3. Acquire supplier - $85M acquisition, eliminate risk but new risks

• Recommendation: Option 2, decision needed by Q2 board meeting

• Decision Owner: CEO with Board approval"

That's communication that drives action.

"Risk information without context creates noise. Risk communication with clear implications and required decisions creates value."

Bringing It All Together: The Integrated ERM System

Here's what I've learned after fifteen years implementing COSO ERM: the components aren't a checklist to complete sequentially. They're an integrated system that works together continuously.

Let me show you how this plays out in practice with a real example from a retail company:

The Integration in Action

Governance & Culture sets the foundation:

• Board establishes risk appetite: "Accept moderate innovation risk to achieve 15% annual growth"

• Culture emphasizes "smart risks, openly discussed"

• Risk ownership assigned to business unit leaders

↓

Strategy & Objective-Setting applies risk appetite to decisions:

• Strategic objective: Expand e-commerce by 40%

• Risk assessment identifies: Technology scaling risk, customer data protection risk, fulfillment capacity risk

• Decision: Proceed with phased approach to stay within risk appetite

↓

Performance translates strategy into action:

• Identifies specific risks: Cloud infrastructure capacity, payment security, vendor fulfillment

• Assesses each risk against appetite

• Implements responses: Infrastructure scaling plan, PCI DSS certification, multiple fulfillment partners

↓

Review & Revision monitors and adapts:

• Monthly KRIs show customer data volume growing faster than projected

• Quarterly review identifies new risk: data privacy regulations in new markets

• Annual review confirms strategic direction but adjusts timeline based on actual risk experience

↓

Information, Communication & Reporting enables decision-making:

• Dashboard shows cloud capacity trending yellow (approaching limits)

• Executive report highlights need for infrastructure investment decision

• Board approves additional $2M based on clear risk information

↓

Feeds back to Governance & Culture:

• Successful risk-informed decision reinforces culture

• Board sees value of ERM in enabling strategy

• Organization builds confidence in risk management process

This is ERM as a living system, not a compliance exercise.

Common Implementation Pitfalls (And How to Avoid Them)

After implementing COSO ERM across dozens of organizations, I've seen the same mistakes repeatedly:

Pitfall 1: Starting Too Big

The Mistake: Trying to build the perfect, comprehensive ERM framework covering every possible risk from day one.

The Reality: A healthcare client spent 14 months building a complete ERM framework with 600+ risks, detailed assessment methodologies, and comprehensive documentation. By the time they finished, the business had changed, key stakeholders had moved on, and nobody used it.

The Better Way: Start with the top 10-15 enterprise risks. Build the framework around what matters most. Expand gradually as you prove value.

Pitfall 2: Making It a Compliance Exercise

The Mistake: Treating COSO ERM as something you do "for the auditors" or "because COSO says so."

The Reality: When ERM is compliance-driven, it becomes documentation theater. People fill out forms because they have to, not because it helps them make better decisions.

The Better Way: Position ERM as a strategic decision-support tool. Show how it helps leaders make better decisions, allocate resources more effectively, and achieve objectives more reliably.

Pitfall 3: Technology First, Framework Second

The Mistake: Buying expensive GRC software before understanding what you're trying to accomplish.

The Reality: I've seen organizations spend $300K+ on GRC platforms that sat unused because they didn't have clear processes to automate.

The Better Way: Start with spreadsheets and simple dashboards. Prove the value of structured risk management. Then invest in technology to scale what's working.

Pitfall 4: Risk Management by Committee

The Mistake: Creating elaborate governance structures with multiple committees, layers of review, and complex approval processes.

The Reality: A manufacturing company had risk decisions going through four committees taking 6-8 weeks. By the time decisions were made, the risk landscape had changed.

The Better Way: Clear ownership, appropriate delegation, and fast escalation for decisions that exceed authority levels.

Measuring ERM Effectiveness

How do you know if your COSO ERM implementation is working? Here are the metrics that actually matter:

But here's the most important measure: Are you making better decisions because of ERM?

If the answer is yes, you're succeeding. If the answer is "we're doing ERM because we have to," you're failing—regardless of how good your documentation looks.

The Path Forward: Your ERM Journey

If you're starting or improving your COSO ERM implementation, here's my advice from the trenches:

Months 1-3: Foundation

• Secure executive sponsorship (essential, non-negotiable)

• Define scope and objectives

• Establish governance structure

• Identify top 10-15 enterprise risks

• Create simple risk assessment methodology

Months 4-6: Framework Development

• Develop risk appetite statements

• Create risk response strategies for top risks

• Build basic reporting dashboards

• Start regular risk reviews

• Begin communication and awareness

Months 7-12: Operationalization

• Expand risk identification across organization

• Integrate ERM into strategic planning

• Develop KRIs for top risks

• Train risk champions throughout organization

• Prove value through risk-informed decisions

Year 2+: Maturity and Optimization

• Automate where valuable

• Deepen risk culture

• Enhance predictive capabilities

• Integrate with other management systems

• Continuously improve based on lessons learned

Final Thoughts: ERM as Competitive Advantage

I started this article with a story about a $47 million supply chain loss that went unseen. Let me end with a different story.

In 2020, I worked with two companies in the same industry facing the same pandemic-driven supply chain crisis. Both had similar size, revenue, and market position.

Company A had no integrated ERM. They reacted to each crisis as it emerged. Made decisions based on whoever shouted loudest. Burned through cash trying everything. Lost key customers when they couldn't deliver reliably.

Company B had implemented COSO ERM eighteen months earlier. They:

• Had pre-identified supply chain concentration as a top risk

• Developed alternative supplier relationships before the crisis

• Made rapid, risk-informed decisions about which products to prioritize

• Communicated proactively with customers about impacts and timelines

• Emerged with stronger customer relationships and market share gains

The difference? Company B used COSO ERM not as a compliance framework, but as a strategic management system.

Three years later, Company A was acquired by a competitor. Company B doubled in size and went public.

That's the power of enterprise risk management done right.

"COSO ERM doesn't predict the future. It prepares you to navigate uncertainty with confidence, make informed decisions under pressure, and turn risk into strategic advantage."

The five components—Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, and Information, Communication & Reporting—aren't bureaucratic requirements. They're the operating system for resilient, adaptive organizations that thrive in uncertainty.

The question isn't whether you can afford to implement COSO ERM. It's whether you can afford not to.