The Limitations of ERM
The COSO committee clears the air by stating the observed limitations, discussing the misguided
notion that with embedded internal controls, the organisation will achieve its objectives.
In the viewpoint of COSO, there are three distinct concepts that must be regarded:
1. Risk relates to the future, which is described as being inherently uncertain.
2. ERM can only provide reasonable assurance, and does not provide that the objectives must
be met.
3. ERM cannot provide absolute assurance of outcomes with respect to any one of the
objectives.