C0.2 Governance and culture

COSO ERM component 1, principles 1 to 5 and 20 [2]; IRM Risk Culture, eight aspects [6]; Orange Book principle A [4]

The component requires that the governing body oversee risk and that its oversight be recorded; that culture be defined, measured in eight aspects on a stated cycle, and reported on the same page as risk and performance (C0.2) [2] [6] [4]. The report joins three things that are usually in three documents, the risk profile, the culture measurement and the performance against objectives, so that a board can see whether the risk it is running, the behavior it is encouraging and the results it is getting agree with each other.

Three sources meet here, and the component reconciles them rather than choosing. The enterprise framework's first component, governance and culture, carries its first five principles, from board oversight to the attraction and retention of capable people, and its twentieth asks for reporting on risk, culture and performance together [2]. The Orange Book's first principle, governance and leadership, is the public-sector statement of the same thing, with the accountable officer named [4]. The practitioner body's culture paper supplies what the other two lack, a way to measure: eight aspects and ten diagnostic questions, the only tool in the set that tells a board what to look at when it asks whether the culture is right [6]. Together they are one component. What it replaces is the culture survey run by human resources and read by nobody on the risk committee, and the board paper on risk that never mentions culture.