Ask a risk manager which framework the company uses and you will usually hear “COSO” or “ISO 31000” in the tone of someone naming a religion. Ask what that means for how a risk is identified, scored, responded to, and reported, and the answer gets vaguer, because most organizations run a home-grown process with a framework’s name on the cover, and most internal auditors assess it against a checklist drawn from the same framework without asking whether the process actually produces decisions. The frameworks are not interchangeable and they are not competitors. COSO ERM is about integrating risk into strategy and performance at the enterprise level; ISO 31000 is a process standard that works at any level; NIST’s frameworks are built for information systems and cyber; the Basel principles are for operational risk in banks; the Three Lines Model is not a risk framework at all but a description of who does what. An auditor who knows the differences can tell an organization which one it is actually using, which is often not the one it names, and whether the process it has built serves the purpose it claims.
This guide is the working comparison. It sets out the nine frameworks and models an internal auditor meets, in a table that states what each is for and what it is not; a decision table for which framework fits which situation; the common anatomy every framework shares, mapped across COSO ERM, ISO 31000, and NIST so that an auditor can assess any process against the same eight elements; a toolkit of fourteen risk assessment techniques with when each works and how each fails; a work program for auditing a risk management framework; a five-level maturity model; a worked ERM assessment at MidState Beverage, whose risk register rated route cash “medium” the year a driver diverted $18,400; and the mistakes that make framework audits into compliance exercises. It was rewritten in September 2026 to reflect the current editions of each framework and the Global Internal Audit Standards. The site’s internal audit risk assessment guide covers the function’s own use of these techniques for planning, which is a different exercise from auditing management’s.
In this guide
- The frameworks at a glance: what each is for
- Choosing: which framework fits which situation
- The common anatomy: eight elements every framework shares
- The techniques toolkit: fourteen methods and when each works
- Auditing a risk management framework: the work program
- A five-level maturity model
- Worked example: MidState Beverage’s ERM assessment
- Common mistakes in framework audits
The frameworks at a glance: what each is for
The table lists the frameworks in the order an auditor is most likely to meet them. The “what it is not” column is the one to read, because most framework misuse comes from asking a framework to do something it was not built for: using COSO ERM as a control checklist, treating ISO 31000 as a certifiable standard, or presenting the Three Lines Model as if it prescribed a process.
| Framework | Issuer and current edition | Built for | Structure | What it is not |
|---|---|---|---|---|
| COSO Enterprise Risk Management: Integrating with Strategy and Performance | COSO, 2017 (with supplements on ESG-related risk and cloud) | Enterprise-level integration of risk into strategy-setting, objective-setting, and performance | Five components (governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting) and twenty principles | Not a control framework and not a process manual; it says what an integrated ERM looks like, not how to run a workshop |
| COSO Internal Control – Integrated Framework | COSO, 2013 | Design and evaluation of internal control over operations, reporting, and compliance | Five components and seventeen principles; the risk assessment component (Principles 6 to 9) is where risk enters | Not an ERM framework; its risk assessment is in service of control, not strategy |
| ISO 31000 | ISO, 2018 | A generic risk management process usable at any level, in any organization | Eight principles, a framework (leadership, integration, design, implementation, evaluation, improvement), and a process (scope, identification, analysis, evaluation, treatment, monitoring, recording, communication) | Not certifiable (it is guidance, unlike ISO 9001 or 27001); not prescriptive on techniques or appetite |
| IEC 31010 | IEC/ISO, 2019 | The techniques catalog that accompanies ISO 31000 | Thirty-plus assessment techniques with applicability by stage | Not a framework; a reference for choosing methods |
| NIST Risk Management Framework (SP 800-37 Rev. 2) | NIST, 2018 | Managing security and privacy risk for information systems, mandatory for US federal systems and widely adopted elsewhere | Seven steps: prepare, categorize, select, implement, assess, authorize, monitor; paired with SP 800-53 controls | Not an enterprise framework; it manages system-level risk within a security program |
| NIST Cybersecurity Framework 2.0 | NIST, 2024 | Organizing and communicating cybersecurity risk management outcomes for any organization | Six functions: govern, identify, protect, detect, respond, recover; profiles and tiers | Not a control catalog and not a risk assessment method; a taxonomy of outcomes |
| Basel Committee Principles for the Sound Management of Operational Risk | BCBS, revised 2021, with the standardized approach for capital | Operational risk governance, identification, assessment, monitoring, and reporting in banks; capital calculation under the standardized approach | Twelve principles across governance, risk management environment, ICT, business continuity, disclosure; the seven Basel event types | Not applicable outside banking except by analogy; the event taxonomy is widely borrowed |
| The IIA’s Three Lines Model | The IIA, 2020 (replacing the Three Lines of Defense) | Describing the roles of management (first and second line), internal audit (third line), and the governing body in risk and control | Six principles; roles, not layers; internal audit’s independence explicit | Not a risk management process; says nothing about how risks are assessed |
| FAIR (Factor Analysis of Information Risk) | The FAIR Institute; Open Group standard | Quantifying cyber and operational risk in financial terms | A taxonomy decomposing risk into loss event frequency and loss magnitude, estimated with ranges and simulation | Not a management framework; a measurement method used inside one |
Two frameworks in the table are regularly confused with each other and with the third. COSO ERM 2017 is not the 2004 cube; the 2017 edition dropped the cube and the “eight components” and reorganized around five components and twenty principles integrated with strategy, and organizations still describing their ERM in cube terms are describing a framework COSO retired. And the Three Lines Model of 2020 explicitly abandoned the “defense” framing and the idea that lines are organizational layers; it describes roles, several of which one person can hold, and it places the governing body above the lines rather than as one of them. The site’s COSO 17 principles guide covers the control framework, and the internal audit and ERM guide the roles the Three Lines Model assigns.
Choosing: which framework fits which situation
Most organizations should use more than one, and the practical question is which framework governs which layer. The table maps common situations to the framework that fits, with the reason; the last column notes the framework people reach for by habit and why it disappoints.
| Situation | Framework that fits | Why | What people reach for instead |
|---|---|---|---|
| A board wants risk integrated into strategy and performance reporting | COSO ERM 2017 | Built for exactly that; its principles give the board a language for appetite, portfolio view, and performance linkage | ISO 31000, which says little about strategy or the board |
| A mid-sized company needs a workable risk process at every level without a large program | ISO 31000 process, with IEC 31010 for techniques | Generic, proportionate, usable by a plant manager and a CFO alike | COSO ERM, whose twenty principles overwhelm a small organization |
| A public company needs to support SOX 404 or a UK Provision 29 declaration | COSO Internal Control 2013 | The recognized control framework; risk assessment in service of control objectives | COSO ERM, which is not a control framework and will not satisfy the auditor |
| An IT function needs to manage system and cyber risk in a way regulators recognize | NIST CSF 2.0 for the program; NIST RMF for system authorization; ISO 27001/27005 where certification matters | Purpose-built; regulators and customers recognize them | A generic enterprise register with “cyber” as one line |
| A bank needs operational risk management that examiners accept and capital that can be calculated | Basel principles and the standardized approach; COSO ERM for the enterprise layer | Mandatory in substance for regulated banks | ISO 31000 alone, which examiners do not recognize as sufficient |
| A CISO needs to justify security spend in money | FAIR inside NIST CSF | Converts scenarios to loss ranges the CFO can compare | Heat maps, which cannot be compared to a budget |
| The board wants to know who does what in risk and assurance | The Three Lines Model | Its only purpose | Nothing; this is the one case where the habitual choice is right |
| A public sector body needs a risk process aligned to government expectations | ISO 31000 with the relevant national guidance (the UK Orange Book, US OMB Circular A-123 for federal agencies) | Proportionate and expected by oversight bodies | COSO ERM, which assumes a commercial strategy context |
The common anatomy: eight elements every framework shares
Strip the vocabulary away and every risk management framework has the same skeleton, which is useful to an auditor for two reasons: an organization’s process can be assessed against the eight elements whichever framework it names, and a process that names a framework but lacks an element has a gap the framework’s own terms will describe. The mapping below shows where each element lives in COSO ERM, ISO 31000, and NIST CSF 2.0, and the question an auditor asks of each.
| Element | COSO ERM 2017 | ISO 31000:2018 | NIST CSF 2.0 | The audit question |
|---|---|---|---|---|
| 1. Governance and accountability | Governance and culture component (Principles 1 to 5): board oversight, operating structures, culture, values, talent | Framework: leadership and commitment; integration | Govern function: organizational context, strategy, roles, policy, oversight | Who owns risk management, who owns each risk, and does the board see it? |
| 2. Objectives and appetite | Strategy and objective-setting (Principles 6 to 9): business context, risk appetite, strategy evaluation, objectives | Process: scope, context, and criteria | Govern: risk management strategy including appetite and tolerance | Is appetite stated in terms that can be compared to an assessment, and are objectives the anchor for risks? |
| 3. Identification | Performance (Principle 10): identifies risk | Process: risk identification | Identify function: asset management, risk assessment, improvement | Is identification systematic (universe, drivers, events, emerging risks) or a workshop list? |
| 4. Assessment | Performance (Principles 11 and 12): assesses severity, prioritizes | Process: risk analysis and risk evaluation | Identify: risk assessment | Are impact and likelihood evidenced, is inherent separated from residual, and does the scoring survive comparison with actual losses? |
| 5. Response and treatment | Performance (Principles 13 and 14): implements responses, develops portfolio view | Process: risk treatment | Protect, detect, respond, recover functions | Is each response a decision (accept, reduce, share, avoid) with an owner, and are the controls that reduce risk mapped to it? |
| 6. Monitoring and indicators | Review and revision (Principles 15 to 17): substantial change, reviews risk and performance, pursues improvement | Process: monitoring and review | Govern and identify: continuous improvement; detect: continuous monitoring | Are there indicators with thresholds, and did anything happen when one was breached? |
| 7. Reporting and communication | Information, communication, and reporting (Principles 18 to 20) | Process: communication and consultation; recording and reporting | Govern: oversight; communication throughout | Does reporting reach decision-makers in a form that changed a decision? |
| 8. Culture and capability | Governance and culture (Principles 3 to 5) | Principles: human and cultural factors; framework: resources | Govern: roles, responsibilities, and authorities; awareness and training under protect | Do people escalate bad news, and are they able to assess risk in their own area? |
The element that is most often missing is the second. Organizations identify and score risks for years without ever stating how much of each they are willing to carry, which leaves the assessment with nothing to be compared against and the board with a heat map it cannot act on; the site’s risk appetite guide covers how to write and audit an appetite statement. The element most often faked is the sixth: a slide of key risk indicators that are really lagging performance measures with no thresholds and no record of an escalation, which the worked example below found at MidState.
The techniques toolkit: fourteen methods and when each works
Frameworks say what to do; techniques are how it gets done, and IEC 31010 lists more than thirty. The fourteen below are the ones an internal auditor will actually meet, assess, or use, with the stage each serves, what it does well, and how it goes wrong. The last column matters most in an audit: an organization’s choice of technique tells you what its process can and cannot see.
| Technique | Stage | What it does well | How it fails |
|---|---|---|---|
| Structured workshops and brainstorming | Identification | Surfaces risks known to operators; builds ownership | Groupthink; the loudest voice sets the list; recency bias toward last year’s incident |
| Structured interviews with a fixed question set | Identification | Reaches people who do not speak in workshops; comparable across units | Interviewer bias; executives describe the risks they want audited |
| Risk universe and taxonomy | Identification | Completeness: every entity, process, and risk category considered systematically | Becomes a compliance list; emerging risks outside the taxonomy are missed |
| Loss event and incident analysis | Identification; assessment | Grounds likelihood in what actually happened; the Basel event taxonomy gives comparability | Under-reporting; near misses not captured; tail events absent from the history |
| Risk and control self-assessment (RCSA) | Assessment | Process-level, owner-driven, repeatable; links risks to controls | Self-assessment optimism; ratings drift toward “effective” without evidence; see the site’s RCSA guide |
| Impact and likelihood scoring with a matrix | Assessment | Fast, comparable, understood by everyone | Ordinal scores treated as numbers; multiplication of ranks; a “medium” that means nothing; the matrix hides tail risk |
| Bow-tie analysis | Assessment; treatment | Maps causes, the event, consequences, and the controls on each side; exposes where controls are thin | Time-consuming; used for one showpiece risk and never again |
| Failure mode and effects analysis (FMEA) | Assessment | Systematic for processes and products; scores detectability as well as severity and occurrence | Engineering heritage; heavy for business processes; risk priority numbers misused |
| Scenario analysis | Assessment | Forces thinking about severe but plausible events; the basis for stress testing and resilience planning | Scenarios chosen to be survivable; no follow-through to responses |
| Stress testing and reverse stress testing | Assessment | Quantifies the impact of adverse conditions; reverse stress testing finds what breaks the business | Models with unexamined assumptions; results not acted on |
| Monte Carlo simulation and quantitative modeling (including FAIR) | Assessment | Produces loss distributions and ranges rather than a single score; comparable to budgets and appetite in money | False precision from weak inputs; opacity to the board; expensive to maintain |
| Key risk indicators (KRIs) | Monitoring | Leading signals with thresholds that trigger action before a loss | Lagging KPIs relabeled; no thresholds; no escalation when breached |
| Root cause analysis (five whys, fishbone) | Treatment; learning | Turns incidents into systemic fixes | Stops at the person; the same incident recurs |
| Heat maps and risk registers | Reporting | Communicates the portfolio at a glance; the register is the system of record | The map becomes the analysis; the register becomes a list maintained for the audit committee and read by no one else |
An auditor’s rule of thumb: a mature process uses at least one technique from each stage, uses a quantitative method for the risks that matter most, grounds its likelihoods in loss data, and can show a decision that a KRI breach or a scenario changed. A process that uses only workshops and a matrix has an identification method and a reporting method and nothing in between. The site’s guides to the RCSA process and the risk register cover two of the techniques in the depth an assessment of them needs.
Auditing a risk management framework: the work program
Auditing risk management is one of the assurance roles the Three Lines Model reserves for internal audit, and it is also one the Global Internal Audit Standards expect the function to perform: Standard 9.1 requires the chief audit executive to understand the organization’s governance, risk management, and control processes, and the function’s plan should include assurance over their effectiveness. The program below assesses the eight elements against whichever framework the organization names, with the tests that distinguish a process that produces decisions from one that produces documents. It runs 280 to 400 hours for a mid-sized organization.
| Element | Tests | Evidence of effectiveness | Evidence of a paper process |
|---|---|---|---|
| Governance and accountability | Read the charter, policy, and a year of board and risk committee minutes; interview the CRO or equivalent, two executives, and the chair; confirm each top risk has a named owner who can describe it | Minutes show challenge and decisions; owners answer without notes | Risk is a standing agenda item with a slide and no discussion; owners are “the executive team” |
| Objectives and appetite | Obtain the appetite statement; test whether each top risk’s assessment is compared to appetite; trace two decisions (an acquisition, a new product, a budget cut) to an appetite consideration | Appetite in measurable terms; assessments show headroom or breach; decisions reference it | Appetite as adjectives (“low appetite for regulatory risk”); no decision references it |
| Identification | Reconcile the register to the universe, the strategy, the incident log, and the external environment; test whether the last three material incidents were on the register before they happened | Systematic coverage; emerging risks added between cycles; incidents were foreseen as risks | The register is a workshop output refreshed annually; the incidents were not on it |
| Assessment | Re-perform the scoring for ten risks from evidence; compare rated likelihood to loss history; check inherent versus residual and the controls that make the difference; test any quantitative model’s inputs | Scores evidenced and reproducible; residual risk tied to specific controls; models with documented assumptions | Scores by consensus; every risk “medium” residual; controls listed generically |
| Response and treatment | For ten risks: the response decision, its owner, its status, and whether the controls relied on have been tested by anyone | Decisions recorded with dates; controls mapped and assured | “Mitigated by existing controls” with no controls named |
| Monitoring and indicators | Obtain the KRI set; test each for leading versus lagging, threshold, data lineage, and frequency; find the last three breaches and what happened | Leading indicators with thresholds; breaches escalated and actioned | Financial KPIs relabeled; no thresholds; no breach ever recorded |
| Reporting and communication | Review a year of risk reporting to the board and executives; interview two directors on what they did with it | Reports drive decisions directors can name | Heat map unchanged for six quarters; directors cannot recall using it |
| Culture and capability | Test the escalation of bad news through two examples; assess training and the competence of risk owners; review whether incentives reference risk | Bad news reached the board within days; owners trained; incentives include risk outcomes | Incidents surfaced through audit or regulators; risk training is a slide deck |
| Integration and use by internal audit | Assess whether the function’s own risk assessment and plan use management’s assessment, and whether the function has evaluated it before relying on it | Reliance documented after evaluation; differences explained | The audit plan copies the register; or ignores it entirely |
The incident test in the identification row is the sharpest single procedure available. Take the three most costly things that went wrong in the last two years and ask whether the register had them, at what score, and whether anyone acted before the event. A register that rated the eventual loss “medium” and unchanged for three cycles has told you what the process can see, and the finding writes itself. The site’s guide to operational risk covers the loss event data that makes the test possible, and the work program guide the format.
A five-level maturity model
Boards ask “how mature is our risk management,” and a maturity model answers in a form they can compare year to year. The model below is generic and can be applied per element, which is more useful than one overall score, because most organizations are at level 4 on reporting and level 2 on appetite. The level names are deliberately plain.
| Level | Name | What it looks like | Typical evidence |
|---|---|---|---|
| 1 | Reactive | Risks addressed after incidents; no register or an unused one; no appetite; no owner of the process | Incident-driven board discussions; audit findings as the only risk information |
| 2 | Documented | A framework named, a policy written, a register maintained, an annual workshop; scores by consensus; no appetite in measurable terms; reporting that does not change decisions | Register, policy, heat map; minutes showing receipt without discussion |
| 3 | Managed | Owners accountable; appetite stated and compared to; assessments evidenced; KRIs with thresholds for the top risks; responses tracked; the process operates between annual cycles | Appetite statement; KRI breaches escalated; risk decisions minuted |
| 4 | Integrated | Risk information used in strategy, budgeting, and performance; quantitative methods for the risks that matter; loss data feeds assessment; internal audit relies on the process after evaluating it; culture escalates | Strategy papers with risk analysis; models with documented assumptions; incidents foreseen on the register |
| 5 | Optimizing | The process improves itself from outcomes; scenario and reverse stress testing routine; appetite recalibrated from experience; risk capability distributed to the front line | Post-incident changes to method; appetite revisions with rationale; front-line risk decisions documented without central prompting |
Worked example: MidState Beverage’s ERM assessment
MidState Beverage is a three-state drinks distributor with twelve depots, 300 routes, and about $31 million a year in cash and checks collected by drivers. Its enterprise risk management process, run by the CFO’s office and described in the board papers as “COSO-based,” consisted of an annual workshop producing a register of 63 risks scored on a five-by-five matrix, a heat map presented to the audit committee each year, and a risk policy last revised in 2021. In FY26 a Dayton driver diverted $18,400 over five months before a customer complaint exposed it, and the FY27 route cash audit then rated the process Unsatisfactory with five findings. The audit committee asked internal audit to assess the ERM process itself, and the engagement assessed it against the eight elements using COSO ERM as the named framework.
| Element | Finding | Maturity |
|---|---|---|
| Governance | No executive owned the process below the CFO; the board’s risk discussion was ten minutes a year on the heat map; the twelve depot managers, who ran the operations carrying most of the risk, had never seen the register | 2 |
| Appetite | No appetite statement; the policy said the company had “a low appetite for financial loss,” which no assessment had ever been compared against | 1 |
| Identification | “Cash handling loss” appeared on the register, rated likelihood 2 and impact 3 (medium), unchanged since 2022; the two acquired distributors did not appear at all; the FY26 diversion and the FY27-01 findings were the two largest loss events of the period and the register had foreseen neither at a level anyone acted on | 2 |
| Assessment | Scores set by workshop consensus with no evidence; the cash handling likelihood of 2 (“unlikely”) sat alongside 37,400 settlements a year with 1,412 self-approved overrides; inherent and residual risk not distinguished; “existing controls” cited for every risk without naming one | 2 |
| Response | Every register entry showed “mitigate” with no owner, date, or control mapping; no risk had a recorded acceptance decision | 1 |
| Monitoring | The “KRI dashboard” presented to the committee contained revenue, margin, and days sales outstanding, all lagging performance measures, none with a threshold; no KRI had ever been breached because none could be; settlement variance data that would have flagged the Dayton route existed in the route module and was reported to no one | 1 |
| Reporting | The same heat map for three years with cosmetic changes; no director interviewed could name a decision the risk report had influenced | 2 |
| Culture | Depot clerks had raised the self-approval issue with depot managers and been told “that’s how the module works”; no channel existed for depot staff to escalate risk concerns; risk was not in anyone’s objectives or incentives | 1 |
| Overall | A documented process that did not manage risk: it produced a heat map for the committee and no decisions; the company’s largest operational exposure had been rated medium and left there. Rated Unsatisfactory; nine actions, owner CEO, including an appetite statement for cash and inventory loss, ownership of the process by a named executive, evidence-based scoring for the top fifteen risks, three leading KRIs for route cash with thresholds and escalation, and quarterly reporting built around decisions | Overall 1.5 on the five-level model |
The engagement’s most useful output was not the rating but the demonstration, in one table, that the register had rated the company’s most damaging risk “medium” for four years and that the data to know better had been sitting in the route module the whole time. That connection between the framework’s output and the organization’s actual losses is what turns a framework audit from a compliance review into something the board acts on, and it is the reason the identification and monitoring tests in the work program are built around incidents rather than documents. The GRC framework guide covers how MidState rebuilt the process in the year that followed.
Common mistakes in framework audits
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Auditing conformance to the named framework | A checklist of COSO ERM’s twenty principles ticked against documents | A process can conform on paper and manage nothing | Assess the eight elements for effect: decisions made, incidents foreseen, breaches actioned |
| Confusing the frameworks | COSO ERM used to evaluate controls; ISO 31000 presented as a certification; the Three Lines Model described as a process | The wrong criteria produce the wrong findings | Name what the organization actually uses at each layer and assess against that |
| Accepting the scores | Register ratings taken as facts | Consensus scores are opinions; the audit’s value is in testing them | Re-perform ten scores from evidence; compare to loss history |
| Ignoring appetite | No finding on the absence of a measurable appetite | Without appetite the assessment cannot be evaluated and the board cannot decide | Appetite is the second element; its absence is a High finding |
| Treating KPIs as KRIs | A dashboard of financial results accepted as risk monitoring | Lagging measures report losses after they occur | Test each indicator for leading quality, threshold, and escalation history |
| Not testing against incidents | No comparison of the register to what went wrong | The single most revealing test is skipped | Three largest incidents against the register, every time |
| Auditing the register, not the decisions | Findings about formatting and completeness of the list | The list is an output; the process exists to change decisions | Trace decisions to risk information; interview directors on use |
| Internal audit relying on an unevaluated process | The audit plan built on management’s register without assessing it | The function inherits management’s blind spots; Standard 9.1 expects evaluation before reliance | Assess before relying; document differences |
| Quantification theater | A Monte Carlo output presented with unexamined inputs | False precision persuades boards of things nobody knows | Test inputs, assumptions, and sensitivity; report ranges with their basis |
| One overall maturity score | “Level 3” for the whole process | Hides a level 1 on appetite behind a level 4 on reporting | Score per element; report the profile |
Frameworks are scaffolding, and the test of a risk management process is not which scaffold it stands on but whether anyone changed a decision because of what it produced. An auditor who assesses the eight elements against that test, with the organization’s own incidents as the evidence, will produce a report the board recognizes as true, whichever framework name is on the policy. The site’s guides to common ERM misconceptions and why ERM is different cover the conceptual ground this guide assumes.
Related guides
- Internal audit risk assessment — the function’s own use of these techniques
- Risk appetite statements — the element most often missing
- The RCSA process — self-assessment done properly
- The risk register — the system of record
- The COSO 17 principles — the control framework and its risk assessment component
- Internal audit’s role in ERM — the Three Lines roles in practice
- Operational risk — Basel event types and loss data
- Auditing cybersecurity programs — NIST CSF in an audit
- Building a GRC framework — rebuilding after an assessment like MidState’s
- GIAS Domain IV: managing — Standard 9.1 and reliance on management’s assessment
- All Guides — the full index
- Risk Taxonomy: How to Build One, With a Three-Level Example — building the categories every other risk tool uses.
- Risk Assessment Matrix: Design, Calibration and Pitfalls — design, calibration and the pitfalls.
- Auditing the ERM Program: Criteria, Maturity, Independence — criteria, maturity and the independence trap when auditing the second line
- Designing a KRI Program: Selection, Thresholds, Escalation — turning a metric wishlist into an early warning system with thresholds that trigger action
- Enterprise Risk Management by James Lam: Summary and Lessons for Auditors — ERM in practice, from incentives to controls.
Leave a Reply