Fundamentals of Risk Management

71

---

Approaches to risk management
72
TAbLE 
6.1
Risk management standards
has been translated into many languages. The Australian Standard and the COSO 
standard/framework are designed for use primarily by specialist risk management 
practitioners. The IRM Standard is available as a free download from the IRM
website, and the risk management process used in it is reproduced in Figure 6.1.
For organizations listed on the New York Stock Exchange, the approach outlined 
in the COSO Internal Control framework originally published in 1992 and updated 
in 2013 is recognized by the Sarbanes–Oxley Act of 2002 (SOX). The requirements 
of SOX also apply to subsidiaries of US-listed companies around the world. There-
fore, the COSO approach is internationally recognized and, in many circumstances, 
mandated. It is worth noting that SOX requires the approach described in the COSO 
Internal Control framework (2013). (This is not the same as the COSO ERM frame-
work (2004), although the COSO ERM framework does contain all of the elements 
of the recently revised Internal Control version.)
For many stock exchanges, the greater emphasis in the listing requirements and 
associated corporate governance code is on internal control, rather than risk manage-
ment. This emphasis was maintained in the 2010 version of the Combined Code, 
which has now been renamed the UK Corporate Governance Code, although the 
2010 version did include several enhanced specific risk management requirements. 
Sections of the 2010 version of the UK Corporate Governance Code have been
updated and the current version of the UK Corporate Governance Code is dated 
April 2016.
The COSO Internal Control framework has become the most widely used internal 
control framework in the United States and it has been adapted and/or adopted by 
numerous countries and businesses around the world. An enterprise risk management 
(ERM) version of the COSO framework was produced in 2004 and this has both 
risk management and internal control within its scope.