This lesson examines the two dominant enterprise risk management frameworks globally—the COSO framework (widely used in the USA) and ISO 31000 (preferred in Europe). It covers their core components, differences, and the institutional factors driving their adoption.

• The COSO Framework (USA): COSO (Committee of Sponsoring Organizations of the Treadway Commission) is specifically focused on ERM as an ongoing process and is largely aimed at helping US organizations meet their requirements for reporting under the Sarbanes–Oxley Act (SOX) . The approach is structured and governance-focused, with an emphasis on financial control, audit, and internal governance . In North America, ERM processes are too often approached as a compliance exercise from SOX, starting with a risk and control register mapping—a bottom-up approach .

• The ISO 31000 Framework (Europe/Global): ISO 31000 is a principles-based, adaptable standard published by the International Organization for Standardization . Unlike COSO, it is meant to be a more voluntary guidance and is a more generic and process-oriented standard focused on the importance of an overall risk management framework . The standard is based on three core components: Principles (foundation for effective risk management), Framework (structure tying risk management to leadership and strategy), and Process (a structured cycle of communication, risk identification, analysis, and treatment) .

• Differences in Risk Management Culture – USA vs. Europe: A leading risk management expert highlights the cultural differences: “Risk management in the USA is too often a compliance exercise from SOX… it is a bottom-up approach. Risk management in Europe, which is most often aligned with ISO 31000, is a more business perspective that starts with objectives… it is often a top-down approach aligned with strategy and performance” . This explains why European risk management is seen as a business tool and enabler, with more board-level involvement .

• ERM Adoption Evidence: Empirical research on ERM adoption by the 100 largest US and European firms found significant cultural–institutional variations that explain differences between US and European ERM practices . For European firms, total firm risk was not associated with ERM adoption, suggesting other firm and cultural–institutional factors are more influential .