What the governing body should require to know its enterprise risk is governed

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

Enterprise risk is governed only if the governing body can see it operating, not merely be assured it does. The question is not whether the organization has a risk function, but whether risk is identified, scored on a consistent scale, judged against an appetite this body set, treated or formally accepted with an owner, and reported to the board on a cadence, with each step visible in a record rather than a reassurance. Each of those expectations maps to a specific artefact in the risk corpus that an executive can ask to see.

• The enterprise governance and risk-management policy is the dependency of the programme: it sets the framework, principles, roles, and accountability that the other controls require; the governing mandate precedes any control to govern.
• The enterprise risk-management standard makes a contribution to consistent evaluation: its risk taxonomy and scoring methodology give units a common scale on which risks become comparable.
• The key-risk-indicator register makes a contribution to early warning: it defines the indicators, thresholds, and escalation that surface a risk moving before it breaches its tolerance.
• The risk appetite statement is a dependency of any within-appetite or out-of-appetite judgement: that judgement requires the appetite and its tolerance boundaries to exist first.
• The enterprise risk register defines the evidence record for the risk state: the schema in which each risk's score, treatment, and residual position are captured.
• The risk-acceptance procedure is a prevention control against silent acceptance: a mandatory stop at which an undocumented residual risk is documented, owned, and time-bound rather than absorbed.
• The board risk report makes a contribution to informed oversight: it structures the periodic flow of risk information to the board for challenge.
• The assurance map makes a contribution to seeing where assurance over material risk has gaps, on a defined rating scale.
• The exception and risk-acceptance management policy is the dependency for a governed deviation: it requires each exception to be risk-assessed, time-bound, approved, and centrally tracked rather than unrecorded.

• Require an appetite this body set, and require risk reported against it. An appetite no one owns, or a register never read against it, stops before the corpus starts.
• Expect evidence, not assurances. The register extract, the acceptance records with expiries or review triggers, the completed board report, and the assurance-map ratings are evidence classes; a control the organization cannot evidence is not demonstrably operating.
• A formally accepted residual risk is a governed decision, not a silent absorption. Acceptances carry owners, compensating controls, and an expiry or event-based review trigger.
• Risks scored on one consistent scale can be aggregated to a board view. A register scored ad hoc cannot.

• The current enterprise risk-register extract, with scores, treatment, and residual position.
• The approved risk appetite statement, and the register read against it.
• The risk-acceptance records, each with an owner, compensating controls, and an expiry or review trigger.
• The latest board risk report, and the actions and follow-ups it captured.
• The current assurance-map ratings for the material risks, and any open items in the enterprise exception register.

This page is a non-normative executive narrative that creates no compliance by itself; the linked corpus documents govern, and where this page and a corpus document differ, the corpus document prevails. It routes to the corpus rather than reproducing its values: the appetite categories and tolerance boundaries, the scoring-matrix bands and rating thresholds, the register field schema, the acceptance durations and approval-authority levels, the assurance rating scale, and the board-report cadence live in the linked documents and are not restated here. This page carries composite claims: the division of labour it describes across the risk policy, standard, register, indicators, appetite, acceptance, reporting, and assurance controls requires validation by the adopting organization against its own arrangements.