Enterprise risk governance
Do we know our enterprise risk is actually governed, not just listed?
A risk register is not the same as governed risk. The governing body needs to see that risks are measured on one consistent scale, weighed against an appetite it set, escalated when a tolerance is breached, decided through a governed acceptance rather than absorbed silently, and reported on a cadence, with assurance mapped to the risks that matter most.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
- What the governing body should require to know its enterprise risk is governedexecutive brief
- What the governing body should ask about risk appetite, the register, acceptances, early-warning indicators, and board reportingoversight question set
- What happens when a monitored risk breaches the appetite the governing body setscenario
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- Enterprise Governance and Risk Management Policypolicy, Risk
- Exception and Risk Acceptance Management Policypolicy, Governance
- Enterprise Risk Management Standardstandard, Risk
- Risk Acceptance Procedureprocedure, Risk
- Risk Register Procedureprocedure, Risk
- Assurance Map Registerregister, Risk
- Key Risk Indicator Catalogueregister, Risk
- Board Risk Report Templatetemplate, Risk
- Enterprise Risk Register Templatetemplate, Risk
- Risk Appetite Statement Templatetemplate, Risk
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- APEC CBPR
- Basel Committee Corporate Governance Principles
- Basel Committee Operational Risk Principles
- Cloud Security Alliance (CSA)
- COBIT
- COSO ERM 2017
- CSA AICM
- CSA CCM
- FRC UK Corporate Governance Code
- GDPR
- IIA Three Lines Model 2020
- ISO 31000
- ISO/IEC 23894:2023
- ISO/IEC 27001
- ISO/IEC 42001
- LGPD
- NIST AI RMF
- NIST CSF
- NIST IR 8286 (Rev. 1; and 8286A/B/C/D)
- NIST IR 8286C Rev. 1
- NIST SP 800-221 / 800-221A
- NIST SP 800-37 Rev. 2
- NIST SP 800-39
- NIST SP 800-53
- OECD AI Principles
- OECD G20 Principles of Corporate Governance
- PIPEDA
- PIPL
Go deeper