Components of ERM Frameworks

ERM as a Control Cycle

Before diving into specific frameworks, it's helpful to see ERM as a sophisticated, firm-wide application of a familiar concept: the Actuarial Control Cycle (ACC). The ACC provides a general problem-solving paradigm: define the problem, design a solution, and monitor the results. ERM applies this same iterative logic across the entire enterprise to manage the full spectrum of risks the organization faces in pursuit of its objectives.

The following resource explains this connection, showing how the stages of the ACC map directly onto the core pillars of an ERM framework.

High-Level Frameworks: COSO and ISO 31000

To implement this control cycle across a complex organization, companies often adopt standardized frameworks. These provide a common language and structure for risk management. The video below gives a clear explanation of what a framework is and introduces one of the most prominent examples: the COSO ERM framework.

The COSO framework, updated in 2017, is built around five interrelated components, which are themselves supported by 20 underlying principles. The image below presents these components and principles, serving as an excellent visual summary.

Let's briefly examine these five components. The same video provides a helpful walkthrough.

Another major global standard is ISO 31000. While COSO is often associated with financial controls and auditing, ISO 31000 provides a more generic, process-oriented guideline. It is structured around a cycle of Integration, Design, Implementation, Evaluation, and Improvement, all driven by Leadership and Commitment.

While you don't need to memorize every detail of both frameworks for the CP1 exam, it is important to understand that different but overlapping models exist. They all share the common goals of integrating risk management into decision-making, achieving objectives, and applying a continuous, cyclical process.

Core Components for Actuarial Practice

While high-level frameworks like COSO are useful, actuaries often work with a more granular set of functional components. The Actuarial Standard of Practice (ASOP) No. 58 provides a list of common components that form an ERM framework from an actuary's perspective. This list serves as an excellent "cheatsheet" for the exam.

Let's break down each of these components.

1. Governance: This is the foundation. It defines the roles, responsibilities, and structures for managing risk. A key governance model is the "Three Lines of Defense".

   • First Line: Business and process owners who own and manage risk as part of their daily jobs (e.g., underwriters, portfolio managers).
   • Second Line: Oversight functions that support the first line and set risk management policy (e.g., the Risk Management department, Compliance).
   • Third Line: The internal audit function, which provides independent assurance to the board that the first and second lines are effective.

   The video below explains this crucial concept in detail.

2. Risk Identification: The process of finding, recognizing, and describing risks that could affect the achievement of objectives. This can involve workshops, interviews, and reviewing historical loss data.

3. Risk Classification: The process of organizing identified risks into a structured risk taxonomy. This helps in prioritizing and managing risks systematically. Common categories include market risk, credit risk, operational risk, and insurance risk.

4. Risk Appetite: This is one of the most critical components. It defines the amount and type of risk an organization is willing to accept in pursuit of its objectives. It is formally expressed in a Risk Appetite Statement and translated into quantitative risk limits and triggers.

5. Risk Mitigation: The process of selecting and implementing options for addressing risk. These options typically include:

   • Accepting the risk (if it's within the risk appetite).
   • Avoiding the risk (by not engaging in the activity that creates it).
   • Transferring the risk (e.g., through insurance or reinsurance, as we discussed in the last lesson).
   • Controlling the risk (by implementing controls to reduce its likelihood or impact).

6. Risk Metrics: The qualitative and quantitative measures used to assess and monitor risk exposures against risk limits. Examples include Value at Risk (VaR), stress test results, and Key Risk Indicators (KRIs).

7. Capital Management: This involves ensuring the organization has sufficient capital to absorb unexpected losses and support its strategic objectives. It links directly to regulatory capital requirements and internal economic capital models.

8. Stress Testing and Scenario Analysis: A set of tools used to explore the impact of severe but plausible events on the organization's financial position. This helps test resilience and validate risk appetite limits.

9. Own Risk and Solvency Assessment (ORSA): A report, required by many regulators (like under Solvency II), that summarizes the entire ERM process. It requires the insurer to document its risk profile, how it manages those risks, and how it assesses its own capital needs to remain solvent over a forward-looking period. It is the culmination of the entire ERM cycle.

Conclusion

An Enterprise Risk Management framework is the comprehensive structure of processes, policies, and culture by which an organization manages its full range of risks to achieve its strategic objectives. It is a formal, top-down application of the iterative control cycle that is fundamental to actuarial work.

While high-level models like COSO and ISO 31000 provide the conceptual architecture, for an actuary, the framework is best understood through its functional components. These components work together in a continuous cycle: governance sets the rules, risks are identified and classified, a risk appetite is defined, mitigation strategies are chosen, and performance is measured and monitored using metrics, stress tests, and capital models, with the entire process often summarized in an ORSA report.

In our next lesson, we will perform a deep dive into what is arguably the most important component of the ERM framework: risk appetite. We will explore how it is defined, articulated, and operationalized to guide all risk-taking activities within an organization.

Key Takeaways & Cheatsheet

This table maps the practical actuarial components to the COSO framework and the Actuarial Control Cycle, providing a consolidated view for your exam preparation.