OVERVIEW

Risk has real relevance in a business environment, especially when the pace of change is continuous acceleration. Corporate leadership and boards of directors are facing new challenges as they design and evaluate internal controls under the new Section 404 rules. These rules require the use of an appropriate control framework when designing and evaluating internal controls. The Securities and Exchange Commission (SEC) and the oversight board have clearly stated that the COSO Integrated Framework meets their criteria. The Committee of Sponsoring Organizations of the Treadway Commission issued its report in 1992. The committee created a follow-up study in 2001 called the Enterprise Risk Management (ERM) Framework and released it in draft form on July 15, 2003 and the final version in September 2004. A basic understanding of the two frameworks is important, together with insight into how the tools can have impact extending past Sarbanes-Oxley compliance.

The ERM Framework pushes past the original COSO Framework, which has become the model for a strong system of internal control. ERM provides a model for evaluating an organization's risk management activities. Strategic formulation is added to the three business objectives of operational effectiveness, reliable financial reporting, and compliance with laws and regulations. The intent was to provide a framework that would enhance governance judgment with the flexibility of a principles-based approach to evaluating and responding to business risk. The oversight board did not specifically require operational effectiveness or mention the ERM Framework in its final rules. However, these concepts offer organizations best...