ISO 31000 or COSO ERM?

ISO 31000 sets out principles and a process. COSO ERM ties risk to strategy and performance. Many organisations draw on both.

1 min read

ISO 31000

ISO 31000 is an international standard built around principles, a framework and a process. It is short, applies to any organisation and is guidance, so organisations do not certify against it.

COSO ERM

The COSO framework, updated in 2017 as Integrating with Strategy and Performance, sets out five components and twenty principles. It is widely used by organisations with strong internal control and audit functions.

How to choose

Start with what your board, regulators and auditors expect. Many organisations use the ISO 31000 process for day-to-day risk management and COSO ERM to link risk to strategy. The framework matters less than whether people use it.

Keep reading

More guides

After the refineries: how South Africa’s fuel business makes money going into 2027South Africa now imports more than half its fuel, runs two refineries and loses its Mozambican gas supply after 2028. Who the players are and where margin and exposure sit.What South African fuel boards must have on the register before 2027The ten strategic risks for South African fuel businesses going into 2027: what each one is, why it is on the register now, the early warnings and who should own it.Days of cover, licences, gas: the controls that move the ratingFor each of the ten oil and gas risks in South Africa: the control that moves the rating, the gap most commonly observed and the evidence a board should ask for.What a risk assessment should tell your boardIt should show your biggest exposures, how well they are controlled and what to fix first.Why risk registers go staleA risk register goes stale when nobody owns the actions in it.Writing a risk appetite statement people can useA risk appetite statement only works if it sets limits people can act on.

Common questions

Before you book

What is the key point?

ISO 31000 sets out principles and a process. COSO ERM ties risk to strategy and performance. Many organisations draw on both.

ISO 31000: what does this mean?

ISO 31000 is an international standard built around principles, a framework and a process. It is short, applies to any organisation and is guidance, so organisations do not certify against it.

COSO ERM: what does this mean?

How to choose: what does this mean?

Start with a free assessment

Book with our team. A review of where your risk management stands today and a recommended next step.

Request a Free Assessment