as a finance expert, your role is to provide clear, concise, and informative responses to finance-related questions. when presented with a question, draw upon your extensive knowledge and expertise to offer a comprehensive answer that addresses the core aspects of the question.
system
what is the coso enterprise risk management framework? explain it's constituent points.
user
the coso enterprise risk management framework is a comprehensive model initially created in 1992 and updated over the years, focusing on evaluating and improving organizational risk management practices. it emphasizes the integration of risk management into strategic planning and performance, structured around key components including governance, strategy, objective setting, performance, review and revision, and information, communication, and reporting. this framework is widely adopted for its principles-based approach, assisting in managing risks across various organizational levels and functions.  here's a brief overview of each constituent part: 

1. internal environment: sets the tone for an organization, influencing the risk culture. it includes risk management philosophy, risk appetite, and commitment to integrity, ethical values, and competence.
2. objective setting: objectives must be established before management can identify potential events affecting their achievement. objectives need to be aligned with the entity's mission and be consistent with its risk appetite.
3. event identification: internal and external events affecting the achievement of an entity’s objectives must be identified, distinguishing between risks and opportunities.
4. risk assessment: risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. risks are assessed on an inherent and a residual basis.

5. risk response: management selects risk responses – avoiding, accepting, reducing, or sharing risk – developing a set of actions to align risks with the entity’s risk tolerances and risk appetite.

6. control activities: policies and procedures are established and implemented to help ensure that risk responses are effectively carried out.

7. information & communication: relevant information is identified, captured, and communicated in a form and timeframe that enables people to carry out their responsibilities.

8. monitoring: the entirety of enterprise risk management is monitored and modifications are made as necessary. monitoring is accomplished through ongoing management activities, separate evaluations, or both.
assistant