Governance Tools
COSO 2017 AND ENERGY TRANSITION GOVERNANCE
Enterprise Risk Management → Governance → Performance → Assurance
How to use this lesson
This lesson applies the COSO 2017 Enterprise Risk Management framework to the governance of energy transition. Work sequentially through the five components, then use the maturity and combined-assurance pages before completing the 14-criterion assessment.
Participant sequence
1. Read the Introduction and understand the strategic purpose of COSO ERM.
2. Work through all five COSO components and their 20 principles.
3. Consider what governance maturity looks like across Levels 1–5.
4. Review the combined-assurance responsibilities of the CRO, CAE and CIO.
5. Score all 14 governance criteria from 1 to 5.
6. Review the maturity chart and identify priority improvements.
Facilitator use
Use each COSO component as a discussion lens: “What would failure of this component look like in a national energy-transition programme?”
Ask participants to support maturity ratings with evidence rather than perception alone. Differences between participants should be discussed as governance signals, not averaged away without challenge.
Use the chart to focus the action plan on the lowest-scoring governance criteria and on material gaps between risk, technology and assurance functions.
Register your team before beginning
Up to five teams can participate independently on this browser. Register a team name or select a previously registered team. All subsequent assessment scores and results are stored against the active team.
Register a team
Participating teams
Why COSO ERM matters for energy transition
COSO's 2017 ERM framework integrates risk with strategy and performance. Energy transition is particularly suited to this approach because it combines long investment horizons, technology uncertainty, infrastructure dependencies, system reliability, affordability, environmental objectives, stakeholder expectations and national strategic outcomes.
Energy transition is a governance challenge
Transition success cannot be judged only by renewable megawatts installed. Governing bodies and executives must understand whether strategy, risk appetite, portfolio choices, delivery capability, data, assurance and reporting are operating as an integrated system.
The COSO framework provides a structured way to test that system through five interrelated components and 20 principles.
Integrated governance perspective
The illustration below is included as a conceptual reference for integrated GRC, quality information, shared technology and coordinated assurance. It reinforces the principle that effective oversight requires connected information and roles rather than separate functional reports.
1. Governance & Culture
Definition: Sets the tone for ERM by establishing oversight responsibilities, operating structures, culture and capability.
Energy-transition alignment: For energy transition, this component determines who is accountable, how difficult trade-offs are governed, what behaviours are expected, and whether the organisation has the capability to execute a complex transition portfolio.
2. Strategy & Objective-Setting
Definition: Integrates ERM with strategy development, risk appetite and the formulation of business objectives.
Energy-transition alignment: For energy transition, strategic pathways should be evaluated against national objectives, demand, affordability, reliability, emissions, technology readiness, financing and risk appetite before major commitments are made.
3. Performance
Definition: Identifies, assesses, prioritises and responds to risks while developing a portfolio view.
Energy-transition alignment: For energy transition, this means moving beyond individual project risk registers to understand cumulative delivery, grid, financial, technology and system risks across the whole transition portfolio.
4. Review & Revision
Definition: Assesses change, reviews risk and performance, and improves ERM over time.
Energy-transition alignment: Energy-transition assumptions will change. Governance must detect material changes early, compare actual results with strategy and risk appetite, and revise plans when evidence changes.
5. Information, Communication & Reporting
Definition: Uses information and technology to communicate and report risk, culture and performance.
Energy-transition alignment: Energy-transition decision-makers need integrated, timely and reliable information connecting projects, risk, controls, system performance, finance, sustainability and assurance rather than fragmented functional reporting.
From fragmented governance to integrated transition governance
Maturity describes the consistency, integration, evidence and decision usefulness of governance practices. A high maturity rating should reflect demonstrated capability and reliable evidence, not simply the existence of policies.
Governance is reactive, fragmented and person-dependent. Roles, risk information and decision processes are inconsistent.
Core structures exist, but practices vary. Some risks and objectives are documented, while integration and evidence remain limited.
Roles, processes, risk appetite, reporting and review mechanisms are documented and applied with reasonable consistency.
Strategy, risk, performance, technology, projects and assurance are connected. Decisions use reliable portfolio information and defined thresholds.
Governance is adaptive, predictive and continuously improved. Data, scenario analysis, combined assurance and lessons learned actively shape decisions.
CRO, CAE and CIO in integrated energy-transition reporting
Combined assurance is strongest when management information, risk oversight, technology assurance and independent internal audit conclusions are brought together around the same strategic objectives and material risks.
CRO — Risk Integration
Primary contribution: enterprise and portfolio risk view.
Connects transition objectives with risk appetite, KRIs, emerging risks, interdependencies, scenario changes and risk responses.
Integrated reporting role: explains whether the risk profile remains acceptable and where management action is required.
CIO — Information & Technology
Primary contribution: reliable digital and operational information.
Provides assurance over data architecture, cybersecurity, OT/IT resilience, analytics, digital platforms, AI-supported decisions and technology dependencies.
Integrated reporting role: establishes whether key transition information is complete, secure, timely and decision-useful.
CAE — Independent Assurance
Primary contribution: independent risk-based assurance.
Evaluates governance, risk management and controls across material transition risks and assesses whether first- and second-line assurance can be relied upon.
Integrated reporting role: provides an independent conclusion on the adequacy and effectiveness of governance and control.
What the integrated report should answer
Are transition objectives on track? Are key risks within appetite? Are controls and project responses effective? Is the underlying information reliable? Where are assurance gaps or conflicting conclusions? What decisions require governing-body attention?
Energy Transition Governance Maturity Assessment
Score each criterion from 1 to 5. Use the maturity descriptions as evidence standards rather than treating the assessment as a perception survey.
Governance Maturity Profile — Active Team
The columns show the maturity rating for each governance criterion. The horizontal line shows the overall average maturity across all 14 criteria.
Protected facilitator dashboard
Enter the facilitator PIN to review team registration, progress, individual maturity results, team comparisons and the aggregated governance maturity profile.
Team progress and governance maturity
This view compares participating teams and aggregates completed maturity assessments. The aggregate is calculated criterion-by-criterion from registered teams that have supplied a score.
Team progress and results
| Team | Status | Criteria | Progress | Average | Maturity |
|---|