Home > Risk > What is the relationship between Governance, ERM, and Internal Control?

What is the relationship between Governance, ERM, and Internal Control?

I have a number of files available for download from my Profile and one is this diagram: https://www.box.net/shared/me48udpnxi. I worked on it with Professor Andrew Chambers.

I admit to being influenced by the South African King Code III of corporate governance. I see governance as broadly covering how the organization is directed and managed, and that includes the consideration and management of risk (ERM). Controls are used to ensure risk responses are as they should be. The second page shows the various types of risk, and how they act across governance, risk, and controls.

Some risk practitioners believe that ERM includes Governance. I am not in that number, because I believe that setting strategies, optimizing performance, and providing related oversight are in Governance and not in ERM. Some aspects of Governance can be considered part of ERM, but not all.

There are certain aspects of Governance that could be considered part of a system of internal control. COSO talks about the Control Environment later, which includes the operation of the board and internal audit. To the extent that they are required to ensure stuff happens the way it should (my lay definition of internal control), that’s OK.

So, everything inter-relates and the borders on the Venn diagram are fuzzy rather than precise. Nevertheless, I think this captures the broad sense of the relationship.

Agree? Comments?

  1. Norman Marks
    June 12, 2011 at 6:50 AM

    I have a separate internal audit-focused discussion on this at http://www.theiia.org/blogs/marks// Please join us.

  2. Ck6
    June 12, 2011 at 7:19 AM

    Norman, think of Governance as “external” control and ask the question, “if internal control is part of an ERM program, shouldn’t external control?” How the directors of the company govern, directly affects the owners interest in the organization and as such governance should be a part of the ERM effort.

    Remember the leader of the ERM effort is a facilitator and not a manager of the underlying processes – finance, management, production, etc..

  3. June 12, 2011 at 7:32 AM

    Hello Norman. I view governance as an aspect of risk management and of internal controls. They are inter-related, but, of course, not each aspect of each inter-relates. For example, tone at the top, the exercise of authority, inclusiveness, and the manner of exercising diligence are all important aspects of governance that also directly relate to ERM/risk management and internal controls. I believe it can also be argued that the manner of setting strategies including risk assessment and tolerance, optimizing performance, and providing related oversight are part of risk management and internal control.

    David Tate, Esq. (San Francisco)

  4. Norman Marks
    June 12, 2011 at 7:49 AM

    I am not familiar with the term ‘external control’. Can you share where this comes from and what it means?

    • Ck6
      June 12, 2011 at 8:24 AM

      Norman, internal controls provide a basis for Management’s operating the company in a sound and consistent manner as agreed to by the owners/owner’s representatives. Governance describes how the owners present their stewardship to the world (or externally). The two areas are different, but both should be a part of the ERM program.

  5. Larry Brown
    June 12, 2011 at 12:17 PM

    Norman – My view is that you and Professor Chambers have drawn an abridged version of the COSO ERM framework. You have the four COSO ERM objective areas in slide 2/2 – strategy operations, reporting and compliance, and you’ve managed to compress the eight COSO ERM components into three – G, R and C.

    Good from a less is more approach, but in substance ERM = GRC.

    Keep up the good work.



  6. Norman Marks
    June 12, 2011 at 4:12 PM

    I have been asked to explain why ERM is part of Governance. This is what I said:

    The risks that need to be managed are those that might impact the organization’s strategies and objectives. These are not set as part of ERM. They are set as part of the governance activity.

    When the board and management strive to set and achieve their objectives, they do so with risk-related information and they also adapt and respond to risk – as part of how they manage and direct the organization.

    If you define Governance as how you manage and direct the organization to achieve its objectives, then ERM as part of that.

    If you don’t like that simple definition of mine, here is what the OECD has (and I believe this is the most commonly used definition of Governance):
    “A set of relationships between a company’s management, its board, its shareholders and other stakeholder. Corporate governance also provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined.”

    This is what the Australian Stock Exchange says:
    “The system by which companies are directed and managed. It influences how the objectives of the company are set and achieved, how risk is monitored and assessed, and how performance is optimized.”

    If that is how Governance is defined, how can there be any debate on the fact that ERM is included?

  7. Jim DeLoach
    June 12, 2011 at 5:19 PM

    I have always believed that ERM was a subset of Governance. Governance includes strategy setting, performance management, risk management and effective internal control, among other things. Those who believe ERM encompasses governance are likely thinking that ERM cannot work if there is an unengaged board, a lack of transaparency, an unbalanced compensation structure, a CEO who ignores the warning signs, etc., i.e., tone at the top and other issues that effective governance overcomes. While they are right, that doesn’t mean ERM is intended to dictate how boards and CEOs behave, compensate people and decide what to measure and report. Good governance enables ERM to work. Without it, ERM cannot succeed. At the same time, an effective ERM process augments good governance.

  8. Ck6
    June 12, 2011 at 6:10 PM

    I think we are getting tangled in terminology and differences in organizational management in different areas. Saying Governance is part of ERM isn’t saying ERM should run the organization. However, Governance is part of the ERM matrix and the Risk Manager has to take Governance, just like Customer Service, into consideration when preparing the organization’s risk profile.

  9. June 13, 2011 at 5:19 AM

    I fully agree with Ck6. I remember this kind of discussion from my work in developing the ISO31000. Dependent from which kind of “Risk Mgmt area” people were acting (Finance, Banks, Insurance, Health & Safety, Space, Nuclear, Aerospace, Security, IT) they were using totally different terminology. It took by the way more than 2 years to agree that a risk can have bothg a negative and a positive impact! ;)))

    According to my experience ERM is per definition for many (most?) Risk Mgmt practioners the “Entire Risk Mgmt Scope”, meanwhile G, R and C is different parts of it.

    A similar sub-discussion is if BCM is a part of ERM, or ERM is a part of BCM? The most important thing is of course that the same kind of Risk Mgmt view, roles and terminology is used by everyone in the same/whole organization.

  10. Norman Marks
    June 13, 2011 at 6:37 AM

    I have a metaphor I would like to share:

    – Governance determines where the ship should go, then steers the ship based on all available information to optimize the journey, communicating with stakeholders, etc.

    – Risk management advises the ship captain on potential dangers and opportunities. Risk management is the Navigator, the Radar/Sonar operator, and the watchman.

  11. Ck6
    June 13, 2011 at 6:40 AM

    That is a good analogy Norman.

  12. David
    June 13, 2011 at 3:27 PM

    I like this analogy, particularly for getting the message across to middle management.Unless you know the purpose of the journey RM won’t be able to advise on the potential dangers and opportunities.

    What would be your metaphor for Complinace management, Internal controls and BCM?

  13. Cuneyt Balci
    June 13, 2011 at 4:01 PM

    Hi Norman – i have used that diagram before but now i know how it had managed to embed itself into my subconcious (i must have seen it during our workshops last year).

    Love the analogy btw.

  14. Cuneyt Balci
    June 13, 2011 at 4:04 PM

    @ David – how about the life rafts on the side of the ships allow the ship? The size and adequacy of the lift rafts depend upon how successful your BCM planning is. i.e. can you still continue to your destination OR was your planning just to save the ‘crew’ from the impending crisis?

  15. Cuneyt Balci
    June 13, 2011 at 4:06 PM

    @ David (2nd attempt)– how about the life rafts on the side of the ship? The size, adequacy and versitility of the lift rafts depend upon how thorough your BCM planning is. i.e. can you still continue to your destination on the life rafts OR was your planning just to save the ‘crew’ from the impending crisis?

  16. Norman Marks
    June 13, 2011 at 4:49 PM

    David, there are compliance officers on ships. They will be concerned with discharges to the ocean, food safety, etc.

    The internal controls officer might be the 1st officer, who monitors operations.

    Business continuity management? I suspect either the Engineering or 1st officer, who is responsible for not only evacuation but also the emergency procedures in general.

  17. Raymond Ang
    June 13, 2011 at 5:00 PM

    Hi Norman

    I’ve been following your blog with interest, and analogies here just made me smile. This reminds me of the time I used the Titanic as an ERM case study for a previous client. Whoever said “ERM is a Journey”, probably didn’t think it would take on a nautical nature! Great to see such a lively discussion.

    • Norman Marks
      June 14, 2011 at 10:51 AM

      Great to hear from you, Raymond. trust all is well in Singapore.

  18. David
    June 14, 2011 at 2:33 PM

    Thanks for the metafor examples.

    Raymond, in your Titanic case study were the tragic outcomes a result of poor governance, poor ERM or a fuzzy combination?

  19. Kathryn
    June 16, 2011 at 6:13 AM

    Well thanks to all of you. I have learned alot from this discussion and it has cleaned the concepts and their interralated components up for me. As part of the crew, I salute you!

  20. David
    June 26, 2011 at 2:47 PM

    While the metaphor is a good way to get a message across be mindful that all crew members should manage risk within their realm of responsibility and comply with any regulations, policies and procedures etc. Its not just about the navigator or watchman.

  21. Niran
    July 8, 2011 at 2:28 PM

    Hi Norman,

    Thank you for initiating such a thought provoking discussion which has triggered many good perspectives.

  22. Chikondi Chitawo
    February 1, 2012 at 2:31 AM

    What is the relationship between corpirate governance and risk?

    • Norman Marks
      February 1, 2012 at 6:21 AM

      Hi Chikondi, as I see it corporate governance is how you direct and manage the organization. One of the essential elements to effective governance is an understanding of risk, so all the governance frameworks emphasize the importance of board oversight of the risk management process.

      I don’t see governance as including management’s risk management, but providing oversight and approving the criteria used to determine how much risk to take.

  23. sa
    April 20, 2012 at 9:43 PM

    what is the relationship between internal control and risk management?

  24. Sandra
    September 26, 2018 at 5:45 AM

    evaluate the relationship between governance, risk and compliance in ERM

  1. July 6, 2011 at 7:14 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: