According to the COSO enterprise risk management (ERM) framework, which of the following is not part of the new paradigm in ERM?

The "new paradigm" of the COSO Enterprise Risk Management (ERM) framework, as detailed in the 2017 "Integrating with Strategy and Performance" update, emphasizes the integration of risk management into the organization's most critical strategic decisions. Aligning risk appetite with strategy (B), enhancing risk response decisions (C), and reducing operational surprises to improve performance (D) are all core tenets of this modern, value-driven approach. In contrast, assessing risk factors (A) is a fundamental and timeless activity of any risk management process, including older, more compliance-focused models. While essential, the assessment of risks itself is not what defines the new paradigm; rather, the new paradigm is defined by how that assessment is integrated with strategy and performance.

B. Aligning risk appetite and strategy: This is a central theme of the COSO 2017 framework, which explicitly connects ERM to the strategy-setting process to create and preserve value.
C. Enhancing risk response decisions: A key goal of modern ERM is to use risk information to make better business decisions, thereby optimizing performance and the achievement of objectives.
D. Reducing operational surprises and losses: This is a primary benefit of effective ERM, contributing to performance stability and the preservation of value, which are key focuses of the new framework. ---

1. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance.

Page 1 (Executive Summary): The document states, "This publication addresses the evolution of enterprise risk management and the need for organizations to improve their approach to managing risk... It is the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value." This directly supports that options B, C, and D are key aspects of the new paradigm, while A is a foundational practice that the new paradigm builds upon.

2. Fraser, J. R., & Simkins, B. J. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons, 59(6), 689-698. https://doi.org/10.1016/j.bushor.2016.06.007

Page 690, Section 2 ("The evolution of ERM"): The authors distinguish traditional risk management (TRM) from modern ERM, noting that ERM is "a strategic discipline that is forward-looking and integrated across the organization." This highlights the strategic nature of the "new paradigm" (Options B, C, D) compared to the more fundamental, process-oriented task of simply assessing risks (Option A), which was also part of TRM.

3. Beasley, M. S., Clune, R., & Hermanson, D. R. (2005). Enterprise risk management: An empirical analysis of factors associated with the extent of implementation. Journal of Accounting and Public Policy, 24(6), 521-531. https://doi.org/10.1016/j.jaccpubpol.2005.10.001

Page 522: This early paper on ERM adoption defines ERM as a process to "manage risks within its risk appetite." This concept of aligning risk appetite with strategy (Option B) is presented as a defining characteristic of the shift towards a more holistic ERM approach, distinguishing it from prior, less integrated risk management activities.