ISO 31000:2009 & COSO ERM Jakarta, 2018 Facilitators: Dr. Antonius Alijoyo MBA., ERMCP., CERG., CGAP., CCSA., CFSA., CGEIT., CFE - Ketua KomTek 03-10 BSN - Founder CRMS Indonesia - Ketua UmumIRMAPA COSO References 2 COSO frameworks do not replace each other, are distinct, & complimentary Internal Control Framework - 2013 ERM Framework - 2017 2 COSO References COSO ERM Framework – Integrating with Strategy and Performance Explores ERM and strategy from 3 different perspectives: • The possibility of strategy and business objectives not aligning with mission, vision, and values • The implications from the strategy chosen • Risk to executing the strategy ERM Framework -2017 3 COSO References COSO ERM Framework – Integrating with Strategy and Performance Focuses on 5 interrelated components Plus, introduces 20 principles 4 COSO References COSO ERM Framework – Integrating with Strategy and Performance 1. Governance and Culture: Governance sets the organization’s tone, reinforcing the importance of, and establishing oversight responsibilities for, enterprise risk management. Culture pertains to ethical values, desired behaviors, and understanding of risk in the entity. 2. Strategy and Objective-Setting: Enterprise risk management, strategy, and objective- setting work together in the strategic-planning process. A risk appetite is established and aligned with strategy; business objectives put strategy into practice while serving as a basis for identifying, assessing, and responding to risk. 5 COSO References COSO ERM Framework – Integrating with Strategy and Performance 3. Performance: Risks that may impact the achievement of strategy and business objectives need to be identified and assessed. Risks are prioritized by severity in the context of risk appetite. The organization then selects risk responses and takes a portfolio view of the amount of risk it has assumed. The results of this process are reported to key risk stakeholders. 4. Review & Revision: By reviewing entity performance, an organization can con-sider how well the enterprise risk management components are functioning over time and in light of substantial changes, and what revisions are needed. 5. Information, Communication, & Reporting: Enterprise risk management requires a continual process of obtaining and sharing necessary information, from both internal and external sources, which flows up, down, and across the organization. 6 COSO ERM & ISO 31000 COSO ERM Framework 1. Exercises Board Risk Oversight—The board of directors provides oversight of the strategy and carries out governance responsibilities to support management in achieving strategy and business objectives. 2. Establishes Operating Structures—The organization establishes operating structures in the pursuit of strategy and business objectives. 3. Defines Desired Culture—The organization defines the desired behaviors that characterize the entity’s desired culture. 4. Demonstrates Commitment to Core Values—The organization demonstrates a commitment to the entity’s core values. 5. Attracts, Develops, and Retains Capable Individuals—The organization is committed to building human capital in alignment with the strategy and business objectives. 7 COSO ERM & ISO 31000 COSO ERM in ISO 31000 perspective 8 COSO ERM & ISO 31000 COSO ERM Framework 6. Analyzes Business Context—The organization considers potential effects of business context on risk profile. 7. Defines Risk Appetite—The organization defines risk appetite in the context of creating, preserving, and realizing value. 8. Evaluates Alternative Strategies—The organization evaluates alternative strategies and potential impact on risk profile. 9. Formulates Business Objectives—The organization considers risk while establishing the business objectives at various levels that align and support strategy. 9 COSO ERM & ISO 31000 COSO ERM in ISO 31000 perspective 10