Alex Sidorenko Review of the New COSO ERM Guidance 2026

Key Takeaways

• Prioritizing decisions over documentation could cut 60% of risk‑register work.
• Linking strategy and risk makes risk analysis actionable, not just noise.
• Treating value creation as a risk outcome drives measurable business impact.
• Building candor as a capability addresses cultural barriers in risk conversations.
• COSO still clings to risk appetite, limiting full decision‑led transformation.

Pulse Analysis

The 2026 COSO ERM Guidance arrives at a moment when enterprises are demanding risk insights that move beyond static heat maps and compliance checklists. By framing risk management around four decision‑centric questions—what decision is needed, options, outcome drivers, and ownership—the document aligns risk analysis with the cadence of strategic planning. This decision‑led approach resonates with CEOs and CFOs who need concise, actionable intelligence to allocate capital, negotiate contracts, or adjust supply chains in real time.

Sidorenko highlights ten operating disciplines that collectively push the profession toward value creation. Prioritizing decisions over documentation alone could eliminate roughly 60% of the low‑value risk‑register activity that plagues many organizations. Linking risk directly to strategy, treating value creation as a required outcome, and fostering candor tackle both technical and cultural deficiencies. However, the guidance retains the traditional risk appetite construct and the five‑component framework, which many practitioners view as relics of a compliance‑first era. These legacy elements may temper the speed of adoption, especially in firms that have built their risk architecture around appetite metrics and portfolio management.

For risk leaders, the Practitioner Translation Guide offers a pragmatic roadmap: replace scoring debates and after‑the‑fact reviews with repeatable, decision‑ready behaviors. Yet the guide stops short of prescribing quantitative methods—scenario analysis, Monte Carlo simulations, or sensitivity testing—to flesh out the “what could change the outcome” question. Organizations that supplement the guidance with robust uncertainty modeling and address the political dynamics of delivering unwelcome risk insights will unlock the full potential of decision‑led ERM, positioning themselves for stronger performance in volatile markets.