Let’s start with a look at the objectives across the top face of the COSO cube
Now we have four categories of objectives: Strategic, operations, reporting and compliance
Strategic objectives –are those high level goals aligned with the mission of the organization
Strategic objectives are those very same objectives that have been defined as critical to the success of corporate strategy
Consider such objectives as:
Achieving a 60% market share
Maintaining technological leadership in the industry
Strategic and operational objectives may be subject to externalities beyond the control of management.
In these instances, ERM provides assurance that the board is notified in a timely manner the extent of progress toward these objectives.
You don’t often think of enterprise risk management as having much of a role to play in delivering strategy,
but as we work through the framework, you’ll see that risk management has everything to do with meeting your strategic objectives
Next, we have operational objectives
Operational objectives are those goals describing the effective and efficient use of resources
Consider such operational objectives as:
Maintaining a defect rates to less than 0.1% of production
or achieving plant availability of 95%
Containing overtime hours to less than 2% of the total hours worked
These objectives are important because they obviously impact profitability,
but also product quality and customer service; all those things that are necessary for a business to be successful
The risk management framework provides structured guiderails to keep the organization on track to meet these objectives
Third, we have reporting objectives, which address reliable internal and external reporting
Internal reporting is important to ensure that key indicators are measured and monitored to enable management to take action when necessary.
External reporting is important to ensure the organization meets the needs of its stakeholders,
which impacts the continued flow of capital to meet strategic objectives.
A lot of time in recent years has been spent focusing on Internal Controls over Financial Reporting
to comply with the Sarbanes-Oxley Act in the U.S. and National Instrument 52-109 in Canada
The COSO model underpins much of this work but is only focused on one of the four objectives of ERM.
In our discussion, we are looking considering all four objectives,
but same framework you likely used to address the certification requirements.
Lastly, we have compliance objectives. Compliance objectives ensure conformance with all applicable laws and regulations
For example: Compliance with health and safety regulations
hazardous materials regulations
environmental protection, securities laws, civil laws...
Failure to meet a compliance objective can result in significant fine or even threaten going concern
So obviously, we need to have mechanisms in place to monitor progress towards achievement of these sorts of objectives as well
A particular objective may fall into more than one category.
The same way as a single objective may the responsibility of more than a one executive.
The categorization doesn’t impact how the framework is applied.
What’s important for you to understand in this session is that the objectives of risk management don’t exist in isolation.
The objectives contemplated by this dimension of the COSO framework often begin with those identified in our strategic and operating plans,
but we shouldn’t be limited in our thinking and we must consider all objectives explicit or implied to bring context to our risk management plan.
With that in mind, lets now move onto the actual application of the framework itself,
which is where the next video begins. So until next time….
Don’t stop until you get to the top and when you get to the top don't stop.