The starter taxonomy COSO ERM textbooks teach but no platform ships.
Every ERM program starts the same way: identify stakeholders, capture their concerns, derive risk appetite. Most teams reinvent this taxonomy from scratch. We've productised it — used inside Barafaa to auto-seed governance setups, and free to download for your own use.
What this maps to
COSO ERM 2017 — five components, principle 6 (analyzes business context) and principle 7 (defines risk appetite).
IIA Standards — performance standard 2010 (engagement planning informed by stakeholder expectations).
Financial
Cash Liquidity
Investors · Lenders · Audit Committee · Treasury
Sufficient liquid reserves and forecasted cash flow to meet obligations under stress scenarios.
Earnings Per Share
Shareholders · Analysts · Board
Sustainable EPS growth that reflects underlying business performance, not accounting choices.
Compliance
Code of Conduct Violations
Board · Regulators · Employees · Customers
Zero tolerance for material violations; transparent investigation and remediation pathway.
Litigation Exposure
Legal · Audit Committee · Insurers
Predictable legal exposure within disclosed reserves; no surprise material claims.
Operations
Data Confidentiality
Customers · Regulators · CISO · Privacy Office
No unauthorised disclosure of customer, employee or strategic data.
Data Integrity
CFO · External Auditors · Operations
System-of-record data is complete, accurate, and timely across the financial close and reporting cycle.
Employee Morale
Employees · People & Culture · Executive Team
Engagement, eNPS, and voluntary attrition stay within target ranges across critical talent segments.
Strategic
Reputation
Customers · Board · Investors · Media
Brand sentiment, customer trust, and stakeholder confidence remain net-positive through events.
See it cascade end-to-end
Inside Barafaa, every concern auto-links to risks, controls and audit engagements. One screen shows how a board-level objective traces all the way to a finding's corrective action.