COSO ERM in a COVID-19 world

Paul Sobel, the COSO Chairman, asserted recently that ERM frameworks can provide valuable principles during organisational recovery from crises. I disagree. ERM is fundamentally flawed and cannot improve decision-making. The evidence for this claim is nearly fifty years of observation and the pandemic itself.

ERM is a marketing-driven belief system without scientific validation. The term originated as a label invented by RIMS to distinguish new business services. COSO adopted it to reinvigorate the Internal Control Framework after the Enron scandal. Neither origin inspires confidence in the concept’s intellectual foundations.

Two failures are critical. First, the word “risk” lacks consistency. It possesses dozens of formal definitions, which renders it useless as a transactional term in a conversation about what to do. Second, one-size-fits-all risk management systems cannot integrate into the distinct operational processes of distinct organisations. They sit beside the business. They do not enter it.

The evidence of ineffectiveness is not hidden. Across nearly fifty years in this field, I have observed that organisations practising “risk management” maintain entirely separate decision-making processes. The register is in one room. The decision is in another. Consistent surveys show persistently low ERM maturity levels, yet the leadership’s dismissal is attributed to them not understanding the concept. They understand it. They recognise it as ineffective.

COVID-19 was the test. When the pandemic arrived, organisations did not consult their risk registers, risk appetite statements, or business continuity plans. They focused on reducing vulnerability and identifying opportunities. They made decisions. The risk-management apparatus was not present in the room where the decisions happened, because it has never been present in that room.

No credible evidence demonstrates that ERM improves organisational performance. Correlations between ERM adoption and success reflect already-successful companies’ capacity to afford such systems, or regulatory compliance. Not genuine value creation.

The alternative is to help people make better decisions directly. State the purpose. Name the assumptions. Decide what to monitor. That is what the Universal Decision-Making Method does. It does not require a framework, a committee, or an acronym.