Strategic Risk Management Frameworks and Best Practices

Comparing COSO ERM and ISO 31000 Frameworks

ISO 31000 is a broader and more flexible guideline suitable for any organization. In contrast, COSO ERM is more structured and more closely linked to strategy, performance, governance, and value. In practice, ISO is easier to adapt, while COSO is stronger for formal strategic implementation.

Defining Risk Management: ISO vs. COSO

The definitions differ in focus:

• ISO: Defines risk management as coordinated activities to direct and control an organization regarding risk.
• COSO: Defines it as culture, capabilities, and practices integrated with strategy and performance.

The implication is that ISO is more process-focused, while COSO is more strategy-focused.

The Role of Internal Controls

Controls reduce inherent risk to a target or residual risk level. They are considered effective when they successfully lower the likelihood or impact of an event and keep risk within acceptable limits.

Managing Threats and Opportunities

Risk can have both negative and positive effects; therefore, organizations should manage both threats and opportunities. Effective risk management protects existing value while simultaneously helping to create new value.

Challenges in Embedding Risk Management

Common obstacles to successful implementation include:

• Weak organizational culture
• Poor communication
• Unclear roles and responsibilities
• Siloed thinking
• Difficulty making risk part of daily decisions across all levels

Strategic Risk Analysis Models

PESTLE Analysis

PESTLE stands for Political, Economic, Social, Technological, Legal, and Environmental factors. It helps identify external risks by scanning each category systematically. The most unpredictable categories are usually Political or Technological/Environmental.

The LILAC Concept

While not explicitly defined in all standard documents, LILAC likely refers to the elements that build a risk-aware culture, such as Leadership, Communication, and Accountability.

The FIRM Model

FIRM stands for Financial, Infrastructure, Reputational, and Marketplace. These benefits reinforce each other because:

• Better operations improve finances.
• Stronger finances support resilience.
• Resilience protects reputation.
• A strong reputation improves market success and long-term value.

The MADE2 Framework

MADE2 represents Mandatory, Assurance, Decision-making, and Effective/Efficient core processes. When these objectives conflict, organizations should balance them through risk-based decision-making and by aligning compliance with performance.

PACED Principles

PACED stands for Proportionate, Aligned, Comprehensive, Embedded, and Dynamic. The hardest element to implement is usually Embedded, because changing organizational culture and behavior is the most difficult part of the process.