C1.2 Strategy linkage

COSO ERM principles 6 to 9 and 14 [2]

The component requires that three risks of strategy be assessed and recorded at least annually: that the strategy does not fit the organization's mission and values, that the chosen strategy carries implications nobody weighed, and that the strategy is not executed; and that risk be viewed across the portfolio by objective, not one row at a time (C1.2) [2]. The portfolio view is a reporting requirement: for each objective, the risks that bear on it, together, with their combined effect on the likelihood that the objective is met, which is the form C1.6 gives to the number.

It comes from the enterprise framework's 2017 edition, which rewrote the framework around the claim that risk is something an organization takes in pursuit of strategy, and from the Part II finding that this is the only source in the set to treat the choice of strategy as itself a risk decision. Every other framework starts after the strategy is chosen. The three strategy risks are the framework's principles six to nine, and the portfolio view is its fourteenth. The framework's own 2026 survey, finding that few programs are integrated with strategic decisions, is the evidence that the component is needed and not yet common. What it replaces is the register that has a row for “strategic risk” and nothing under it: a strategy that does not fit, a strategy with unweighed implications and a strategy not executed are three scenarios with three owners.