What are the latest Enterprise risk management frameworks in health insurance?

1 COSO ERM

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five accounting and auditing associations that provides guidance on internal control, fraud prevention, and risk management. In 2017, COSO updated its ERM framework to align with its internal control framework and reflect the evolving business environment. The COSO ERM framework consists of five components: governance and culture, strategy and objective setting, performance, review and revision, and information, communication, and reporting. Each component has several principles and practices that help organizations integrate risk management into their decision making and value creation processes.

2 ISO 31000

The International Organization for Standardization (ISO) is an independent, non-governmental body that develops and publishes standards for various fields and industries. ISO 31000 is a standard that provides principles and guidelines for effective risk management across all types of organizations and activities. The standard was revised in 2018 to simplify its structure and language and emphasize the integration of risk management into the organizational culture and strategy. The ISO 31000 framework consists of three elements: risk management principles, risk management framework, and risk management process. The principles describe the characteristics of effective risk management, such as being tailored, transparent, and dynamic. The framework outlines the steps to design, implement, monitor, and improve the risk management system, such as establishing the context, roles, and policies. The process describes the activities to identify, analyze, evaluate, treat, and communicate risks, such as using risk criteria, risk assessment tools, and risk treatment options.

3 IRM Risk Appetite Framework

The Institute of Risk Management (IRM) is a professional body that provides education, training, and certification for risk management practitioners. In 2019, IRM published a risk appetite framework that aims to help organizations define, articulate, and use their risk appetite to support their strategy and objectives. The framework defines risk appetite as the amount and type of risk that an organization is willing and able to take in pursuit of its goals. The framework also introduces the concepts of risk capacity, risk tolerance, and risk profile to measure and monitor the risk appetite. The framework suggests a four-step process to develop and implement the risk appetite framework, which involves setting the context, defining the risk appetite, communicating and embedding the risk appetite, and reviewing and updating the risk appetite.

4 RIMS Risk Maturity Model

The Risk and Insurance Management Society (RIMS) is a global association that represents the interests of risk managers and professionals. In 2006, RIMS developed a risk maturity model that assesses the maturity level of an organization's ERM program based on seven attributes: ERM-based approach, ERM process management, risk culture, risk identification and assessment, risk appetite and tolerance, risk response and action, and risk monitoring and communication. The model provides a scoring system and a benchmarking tool that help organizations identify their strengths and gaps in their ERM practices and compare their performance with their peers and best practices. The model also offers recommendations and resources to improve the ERM program and achieve higher levels of maturity and value.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?