Most organisations don't build their own risk and control frameworks from scratch. They tend to use a global standard as their structural basis, a common language, and the principles it establishes. That provides a steady framework, enables comparison, and helps you meet the expectations of regulators, auditors, and other stakeholders.
Risk and Compliance people need to understand these standards because they will, in fact, affect how frameworks are designed, tested, and reported in practice.
COSO ERM
The Committee of Sponsoring Organisations of the Treadway Commission (COSO) is one of the most well-known Enterprise Risk Management models. COSO ERM combines risk with strategy, performance, and governance.
COSO's principal strength is in helping organisations link risk management to their business objectives rather than simply treating it as a compliance exercise. It also advances transparency, accountability, and a spirit of continuous improvement.
Many organisations use COSO as the basis for risk reporting throughout the company and for board-level oversight.
COBIT
COBIT (Control Objectives for Information and Related Technologies) is a framework for IT governance and control and is particularly useful for organisations where IT is a central part of the business.
COBIT helps organisations define how IT enables the achievement of business objectives, how it manages technology risk, and how it can be governed through the design of appropriate controls for IT systems, access management, change management, and service continuity. It's frequently used alongside a cyber security programme and other IT control programmes. For highly digital organisations, COBIT provides a disciplined way to manage technology risk.
ISO 31000
ISO 31000 is the well-known global standard for risk management principles and guidelines. It's not a framework that's specific to any one industry or function. It's a broad, flexible framework that enables organisations to develop a risk management approach appropriate to their context, culture, and objectives.
ISO 31000's key benefit is its flexibility. It provides principles, a framework, and a process relevant to all sectors and organisation sizes. Many organisations use it as a guide to a universal, principles-based risk management methodology.
Basel comprises international banking standards (a set of standards for bank regulation, supervision, and risk management) and is particularly relevant to capital adequacy, credit risk, market risk, operational risk, and liquidity risk. Basel III, in particular, introduced much tougher capital and liquidity requirements to make banks better able to withstand shocks and also improved the stress testing regime, the leverage regime, and risk-sensitive supervision. For banks, they are not optional guidelines. They are absolutely central to regulatory compliance and risk governance.
Sarbanes-Oxley controls
Sarbanes-Oxley (SOX) is a U.S. law designed to improve the quality of financial reporting, corporate accountability and internal controls. It's most relevant to public companies and those subject to external financial reporting requirements.
SOX focuses on controls over financial reporting, management certification, auditability, and preventing material error. It's now the standard by which controls over key financial processes are documented, tested and monitored.
Many organisations use the SOX requirements as a model for improving control practices in areas other than finance.
How these schemes differ
All of these schemes provide guidance on risk and control management, but they differ in emphasis, breadth, and intended application. COSO ERM is focused on the combining of risk management with business strategy and governance. COBIT focuses on IT governance and addresses IT risk. ISO 31000 is a principles-based approach that is flexible and can be applied across a range of sectors. The Basel standards focus on banking risk and the related regulatory rules. SOX focuses on internal control over financial reporting and corporate governance. Knowing the differences between them is key to selecting the right framework for your organisation.
- COBIT is all about technology and IT governance.
- ISO 31000 is principle-based and is flexible.
- Basel standards are all about banking and prudential risk.
- SOX is all about internal controls over financial reporting.
Organisations will often use several frameworks in conjunction. A bank, for instance, might use COSO for overall risk management, Basel for capital and liquidity, COBIT for IT controls, and SOX for accounting reporting.
Choosing the right framework
The right framework will differ by industry, regulations, business model, and the organisation's maturity. Most mature organisations won't be using just one framework. They'll create an integrated framework that combines various frameworks and is customised to their own risks and objectives.
To successfully combine multiple frameworks, start by identifying your key risks and regulatory drivers, then work out which frameworks cover each area. You then need to establish a common language and a common set of definitions across the frameworks so there's no ambiguity. Review the overlaps and simplify the controls, eliminating duplication. You need to clearly assign ownership of the controls and the maintenance of the framework. Ongoing communication and training will be key to ensure all teams understand how the combined framework works in practice. You then need to review the whole thing periodically to make sure it stays effective as both the business and the regulatory setting evolve.
Closing perspective
Global standards bring discipline and consistency to risk management and make it more credible. They provide an organisation with a common basis for governance, control design, reporting and assurance. Most importantly, they ensure that risk management is structured and defensible.