Current Edition Checked October 24, 2026
Widely used by boards and auditors in the United States, alongside COSO’s Internal Control framework.
What It Covers
A framework for enterprise risk management tied to strategy setting and performance, organized as five components and twenty principles.
Who It Applies To
Organizations, often public companies and their boards, that want risk considered in strategy and performance.
Key Requirements
- Governance and culture.
- Strategy and objective-setting.
- Performance.
- Review and revision.
- Information, communication, and reporting.
What an Auditor Asks to See
- How risk appetite was set and how it shapes decisions.
Where Systems Fall Short
- Risk appetite statements too general to guide a decision.
How QES Helps
Through QES’s risk and cybersecurity partner.
Related Standards
Sources. COSO — Committee of Sponsoring Organizations of the Treadway Commission (opens in a new tab). Status checked October 24, 2026. This page summarizes COSO ERM; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.