ERM does not guarantee the success of a business. It provides better information to managers and a more robust process for them to deploy, but does not necessarily transform a poor manager into a good manager. COSO points out that “limitations result from the realities that human judgment in decision-making can be faulty, decisions on responding to risk and establishing controls need to consider the relative costs and benefits, breakdowns can occur because of human failures such as simple errors or mistakes, controls can be circumvented because of human failures such as simple errors or mistakes, controls can be circumvented through collusion by two or more people, and management has the ability to override enterprise risk management decisions.” The COSO definition also refers to “reasonable assurance.” According to COSO, “reasonable assurance reflects the notion that uncertainty and risk relate to the future, which no one can predict with precision.” In addition, COSO states on page 8 of the framework:
Reasonable assurance does not imply that enterprise risk management frequently will fail. ... The cumulative effect of risk responses that satisfy multiple objectives and the multipurpose nature of internal controls reduce the risk that an entity may not achieve its objectives. ... However, an uncontrollable event, a mistake, or an improper reporting incident can occur. In other words, even effective enterprise risk management can experience a failure. Reasonable assurance is not absolute assurance.