Article
Risk management frameworks: components, principles and responses
Compare COSO's five ERM components, ISO 31000's eight principles and risk response options without turning different models into one checklist.
Contrata editorial team ·
A risk management framework sets out how an organisation manages risk. Principles describe the qualities that work should have. Responses describe what the organisation chooses to do about a particular exposure. Confusing those jobs can produce a policy with several impressive lists and no clear route to a decision.
Questions about five pillars, five types and seven principles need a named source. COSO's 2017 enterprise risk management framework has five components. ISO 31000:2018 has eight principles. Neither establishes a universal numbered list covering every use of the phrase “risk management”.
For a lean supplier-risk team, the useful task is to identify which model each policy statement uses, then connect it to an owner, evidence and an action. The comparison below offers a way to do that. It is an editorial crosswalk, not a claim that the models are interchangeable or that using either demonstrates compliance.
Separate the jobs before comparing the lists
| Term | Question it helps answer | What a policy writer should specify |
|---|---|---|
| Framework component | How is risk management organised? | Responsibilities, objectives, operating arrangements and oversight. |
| Principle | What qualities should risk management demonstrate? | How the team will judge the quality of its approach. |
| Process activity | What work takes place? | How assessment, consultation, treatment and review fit the decision. |
| Risk category | What kind of exposure are we considering? | Definitions that make records comparable. |
| Response or treatment | What will we do about this risk? | Chosen action, authority, resources and checks. |
These are working distinctions for this guide. A category such as operational risk is not a response such as avoiding an activity. For examples of categories, use the supplier-risk definitions and examples; keep that taxonomy separate from the way you organise the programme.
What are the 5 pillars of risk management?
There is no single five-pillar answer that applies across frameworks. If the question refers to COSO's 2017 Enterprise Risk Management—Integrating with Strategy and Performance, its five components are:
- Governance and Culture.
- Strategy and Objective-Setting.
- Performance.
- Review and Revision.
- Information, Communication, and Reporting.
COSO describes these as interrelated components, rather than five successive tasks. Its official executive summary explains the framework and distinguishes it from COSO's separate internal-control framework.
Use the component names to test the completeness of your arrangements. Who owns the supplier decision? Which business objective does the service support? How will the organisation assess exposure, revisit a change and communicate the result? These questions should lead to operating choices, not just headings copied into a policy.
If a training course or internal policy calls another list “the five pillars”, identify that list and its source. Do not relabel COSO's components as ISO principles, or assume an unlabeled five-item diagram refers to this particular COSO publication.
What are the 7 principles of risk management?
The answer depends on the named model. ISO 31000:2018 sets out eight principles, not seven: integrated; structured and comprehensive; customised; inclusive; dynamic; best available information; human and cultural factors; and continual improvement. Its purpose is creating and protecting value; that purpose should not be substituted for one of the eight to force a different count.
ISO's current catalogue entry identifies the 2018 edition as current, confirmed in 2023, with a revision under development. The 2018 text preview available through SIST provides the principle wording. ISO also explains that this is guidance, rather than a certification standard.
For example, asking an operations colleague to examine a supplier proposal can put inclusion into practice. Recording that the available sample excludes an important workload makes an information limitation visible. Reviewing the method after a missed issue supports improvement. These are original applications, not extra official principles.
The NC State ERM Initiative's explanation provides another useful account of the eight. It is archived professional education, not a maintained statement of the standard's current status. If someone requests “seven principles” in a policy review, ask which source they mean rather than silently removing one from ISO's list.
What are the five types of risk management?
“Types” could mean risk categories, specialist disciplines or responses. If it means responses, there is no universal five-item taxonomy. Name the source before adopting its count.
The Australian Department of Finance's risk management toolkit describes a broader treatment menu: avoiding an activity, removing a source, changing likelihood or consequences, sharing, informed retention, and taking more risk for an objective. Its audience is Commonwealth entities; the guidance is useful context, not a duty imposed on every Australian business.
For a supplier discussion, the following original five-group shortlist can organise choices. It combines several treatment mechanisms under “change the exposure”; it is not an official five-part ISO list.
| Discussion choice | Practical question |
|---|---|
| Avoid | Can we meet the objective without undertaking this activity? |
| Change the exposure | Can we remove its source, reduce the likelihood or limit the consequences? |
| Share | What can another party carry, and what exposure remains with us? |
| Retain | Who can make an informed decision to keep the remaining exposure? |
| Pursue an opportunity | Is additional exposure justified by the objective and our approved criteria? |
Choices can be combined. A contract allocating liability does not establish that service disruption cannot occur. A promise to add a control does not demonstrate its effectiveness. Use the inherent and residual risk guide to assess the actual exposure rather than treating a response label as a lower risk rating.
Work the crosswalk through one supplier decision
Consider a fictional organisation proposing to outsource translation of customer letters. Its objective is understandable, accurate communication. The supplier provides a polished sample, but the sample does not cover the specialist terminology used in the proposed letters. All circumstances and outcomes in this example are invented.
The organisation has a framework question: who owns the service and can decide whether the proposed scope is acceptable? The service owner coordinates the review and identifies an appropriately qualified language reviewer. This establishes responsibility; it says nothing yet about translation quality.
Next comes a principle question: what information and perspectives should inform the assessment? The language reviewer needs representative terminology and intended context. The service owner needs to understand volumes and checking capacity. A general sample leaves those matters uncertain; describing the supplier as “reviewed” would conceal the limit.
Finally comes a response question. The team could retain translation internally, change the proposed service, add independent checking, or return an unresolved limitation for an authorised decision. An attractive delivery price does not choose between those options.
In this fictional decision, the organisation holds customer use of the proposed translation service. It will first run a bounded pilot using synthetic letters containing representative terminology. The language reviewer will assess the outputs against agreed criteria, and the service owner will check whether the proposed checking workload is practical. The pilot authorises no customer dispatch and supplies no assumed pass result.
Record those actions, owners and the question to be resolved. Then return the evidence for a decision; do not turn “pilot completed” into “service approved”. The third-party risk decision record helps preserve that distinction.
Put the model names into the policy
Before circulating a policy revision, label each borrowed model and edition. Separate organisational arrangements from assessment activities, categories and treatment choices. For any local shorthand, explain what it combines and what it leaves out.
Test the draft against one supplier proposal: can a colleague identify the objective, responsible reviewer, evidence limit and next decision? If those are missing, another numbered list will not supply them. The useful output is a review someone can act on, with the source terminology still intact.