Loading ...
Sorry, an error occurred while loading the content.

23227Re: [GOV DG] New COSO ERM - Governance and Culture

Expand Messages
  • Norman Marks
    Oct 5

      IMHO, risk management helps a board and top management navigate their way to achieving objectives.

      - Understand what might happen on that path
      - Consider whether that is desirable, acceptable, or not
      - Decide what you are going to do about it
      - Act

      It's what good managers and decision-makers have been doing their entire careers. Risk management provides more discipline to the process and considers what needs to go well if you are to be effective in performing those 4 steps with every decision - from strategy-setting to execution.

      In other words, its not really about risks - its about achieving objectives.

      I hope this helps. Its covered in more detail in World-Class Risk Management.


      Norman D. Marks, CPA, CRMA
      Author, Evangelist and Mentor for Better Run Business
      OCEG Fellow, Honorary Fellow of the Institute of Risk Management

      On Thursday, October 5, 2017, 9:15:18 AM PDT, Dave Tate tateatty@... [GOV_DG2] <GOV_DG2-noreply@...> wrote:


      Greetings all. I have started going through the new COSO ERM framework. One comment, and one question.

      1. It is a lot of material. In addition to understanding and learning the materials, I have one overriding issue, which is, if I am given 20 minutes to initially explain and interest a board, or an audit committee, or in-house attorneys in the framework and why they should use it, from a legal perspective, that seems like a pretty difficult task, so in addition to developing my own materials I will be looking for discussions or materials that I can also use from other people which will help with that task. I'm not being critical, but I am concerned that the framework is sufficiently complicated such that I will lose the audience.

      2. Focusing on governance and culture, in both the first component, and then also in the fifth component for reporting purposes, are governance and culture primarily or only from the ERM or risk management view (that is, do the entity and its leaders encourage ERM and risk management), or are we also getting into, as possible examples, ethics, integrity, tone at the top, possible rewards that are offered to employees for performance, treatment of employees and customers, whether the entity and its leaders encourage employees to speak up, compliance with work place legal requirements, and whether the entity and its leaders actually walk the talk, etc.?

      Thanks for your comments.
      David Tate, Esq. (Royse Law Firm, California (Menlo Park Office)    
    • Show all 6 messages in this topic