A profitable expansion can expose an entity to supplier failure, currency movements and cash shortages before customers pay. Enterprise risk management (ERM) integrates decisions about these uncertainties with strategy, business objectives and performance.
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed a framework connecting risk management with stakeholder value. COSO ERM considers whether a strategy fits the entity’s mission, what exposures the strategy creates, and how uncertainty affects execution.
COSO ERM supports several practical benefits:
- Identifying opportunities and adverse events before resources are committed.
- Comparing alternative strategies using their potential results and associated risks.
- Coordinating responses when several departments depend on the same supplier, customer or funding source.
- Reducing unexpected performance variability and allocating resources to the most significant exposures.
- Improving the information available to management, directors and other stakeholders.
COSO ERM supports a reasonable expectation that relevant risks are understood and actively managed. It cannot guarantee successful objectives because judgments, assumptions, information and responses remain imperfect, while unexpected events can overwhelm available resources.
Common mistakes
- Wrong framework selected. Seventeen principles and control environment identify the internal-control framework; the ERM framework contains twenty principles.
- Premium omitted. Harbor’s $112,200 exercised-call currency cost excludes the $2,080.80 financed premium, understating total payment of $114,280.80.
- VaR treated as maximum. The supplied $80,000 threshold leaves the severity of losses beyond that threshold unspecified.
Bottom line
- COSO ERM integrates strategy, objectives, performance and stakeholder value through five components and twenty principles.
- Appetite describes acceptable risk, capacity describes absorbable risk, and tolerance defines acceptable variation around a specific objective.
- Risk responses are accept, avoid, pursue, reduce and share, selected using residual exposure, benefits, costs and binding limits.
- Expected value, variability and VaR answer different questions; none independently establishes that severe outcomes are acceptable.
Exam shortcut
Start with the objective and underline every binding limit. Reject an infeasible response before comparing expected benefits. For currency cases, write “pay” or “receive,” identify the quotation units, and net only compatible amounts and dates. Put hedge alternatives on one settlement date. Add premiums and financing costs before comparing protection. Separate “how much” from “when” in inventory cases. For financing, calculate usable proceeds before annualizing cost.
The full lesson (about 10,814 words, 72 min read) adds 4 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- I.B4
Browse all free CPA BAR lessons or jump into free CPA BAR practice questions.