COSO's Framework for Enterprise Risk Management
A new framework from COSO aims to help companies evaluate risk across the enterprise
By Sarah D. Scalet
March 01, 2005 — CSO — The CSO's job is all about risk. And if the Committee of Sponsoring Organizations (COSO) of the Treadway Commission has its way, soon everyone else's job will be about risk too.
COSO, a voluntary council with members from five accounting organizations, made its name with its internal control framework, which was cited in the Sarbanes-Oxley Act as an example of controls companies could use to prevent fraudulent financial reporting. Now the group has released a framework about enterprise risk management (ERM), of which internal controls are only a small part.
"ERM provides a comprehensive way for companies to avoid surprises," contributor Rick Steinberg told the crowd at what amounted to a release party for the document in midtown Manhattan in late September. "That's the bottom line."
The framework breaks ERM into four categories
Now that the framework has been finalized, it's up to companies to decide if they want to adopt it
"The marketplace will now decide if this is useful," says longtime chairman John Flaherty, the former general auditor of PepsiCo. "If the product is as good as we think it is, it's going to sell, and companies will adopt it."
A free executive summary of the framework is available at www.coso.org, where visitors can also purchase the two-volume set for $75.
Read more about data protection in CSOonline's Data Protection section.
Other stories by Sarah D. Scalet
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- Introduction to VMware vCenter Site Recovery Manager 5
- Introduction to Virtualization
- Preventing Unplanned Downtime with Server Virtualization
- Secure Cloud Infrastructure and Next-Generation Data Centers - An Interactive Panel for Decision Makers
- Gartner Next Generation Network IPS Webcast
- Understand Your Data: The Future of Backup and Archiving
- Overcome Top 7 Admin Challenges of Active Directory
- Insiders Can Ruin Your Company. Take Action.
- Top Solutions and Tools to Prevent Devastating Malware
- X-Ray of the PCI Process-4 Proactive Steps
- Streamline Compliance and Increase ROI
- Beyond SFTP: Five Ways Secure Managed File Transfer Can Improve Your Business
CSO Corporate Partners
- Patch Tuesday preview, February 2012
Microsoft published its Patch Tuesday Preview for February of 2012 a few minutes ago. IT admins can expect nine bulletins to address 21 security vulnerabilities.
It looks like four bulletins will be rated critical while the rest are designated as important.
Affected Microsoft products are:
- M86 report proves water is wet
- Actor, banker, soldier, spy: Suits and Spooks Anti-Conference aims to redefine security
More Salted Hash with Bill Brenner
