Critiques Towards Coso's Enterprise Risk Management (ERM) Framework in Its Basic Assumptions

Abstract

Most professionals in internal control, risk management and other similar bailiwickshave agreed that Enterprise Risk Management discourses would've invariablyreferred to what the COSO had produced recently: the framework underlying ERM.But this paper takes a bit different stance that views several problematic issuesstem from unclear conceptions of either the basic premise underlying ERM or thenature of some ERM's components outlined by COSO. This paper notes that, atleast, there are three points of COSO framework that should be streamlined inorder to smoothly establish an ERM policy in organizations as follows;1. Obscured definition of “risk” that remains unresolved in COSO,2. COSO's view in determining the optimum balance between risk and outcome;3. Practical difficulties in implementing ERM under the COSO frameworkAs an alternative, this paper argues that rather than being confused with “risk”and “optimum balance” terms as mentioned by COSO, something that might bedeemed as too academic, we better emphasize our concern towards what AnthonyMarshal mentions as the “impact of negligence” (Marshall, Anthony; 2004).Furthermore, this paper also introduces a “reasonable care” treatment –acontrollable threshold where some acceptable treatments should be in place toovercome certain predictable exposures, no matter that if they will strike youafterwards– as a preferable risk mitigation action for organizations. This is amore practical and reasonable approach in treating exposures that a companymight be challenged by, rather than trying to cover too many types of risk.Liability arises from fault. If there is no fault, there is no liability. If there is nonegligence, there is no fault. And this premise should be upheld when organizationsstart developing their ERM.Keywords: risk, optimum balance, impact of negligence and reasonable car