What happens when a monitored risk breaches the appetite the governing body set

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

A monitored material risk drifts. An early-warning indicator crosses its threshold, and on re-scoring the risk's residual position moves above the tolerance the governing body set. It walks the event through the controls the risk corpus sets, to show a governing body where each engages and what evidence a well-run response leaves behind.

The indicator was watched precisely because the risk it tracks matters. Its threshold is crossed, which is a signal, not yet a decision: the breach is either detected, escalated, and resolved through a governed decision, or noticed late and absorbed without one. This scenario follows the governed path and shows where each corpus control engages.

• Detection. The key-risk-indicator register is where the breach is flagged and escalated, through the thresholds and escalation it defines (its reporting-and-escalation section).
• The tolerance breached. The breach exists relative to the appetite the governing body set; the risk appetite statement is the instrument that defines those tolerance boundaries.
• Re-scoring. The enterprise risk-management standard scoring methodology re-rates the risk and shows it has crossed the band.
• Recording and escalation. The risk-register procedure is where the re-score, the escalation, and the entry's status are recorded and carried through to closure.
• The governed decision. Where the decision is to accept the residual, the risk-acceptance procedure requires an owner, compensating controls, and an expiry or event-based review trigger, and, where a control exception is involved, the exception and risk-acceptance management policy records it at the authority it sets; the decision is a governed one rather than a silent absorption.
• Board visibility. The breach, the decision, and any board decision requested surface in the organization's board reporting, structured per the board risk report, on its cadence.
• Assurance gaps. Where the breach reveals thin assurance over the risk, the assurance map is where that gap is visible.

The indicator flagged the breach rather than a later event revealing it. The re-score and the escalation were recorded through the register procedure, not held informally. The choice was a governed one, a treatment plan or a formal acceptance with an owner, compensating controls, and an expiry or event-based review trigger, rather than a silent absorption. The breach and the decision reached the governing body on its cadence. Each of those is a control the organization can point to and evidence.

• The key-risk-indicator breach record and the Red KRI Escalation Report.
• The register entry showing the re-score and the crossed tolerance boundary.
• The treatment plan, or the acceptance records (owner, compensating controls, and an expiry or review trigger) and any related time-bound exception records (owner and an expiry, where a control exception is involved).
• The board risk report carrying the breach and the decision, and the actions and follow-ups it captured.
• The assurance-map rating for the affected risk.

This page is a non-normative executive narrative that creates no compliance by itself; the linked corpus documents govern, and where this page and a corpus document differ, the corpus document prevails. It routes to the corpus rather than reproducing its values: the appetite tolerance boundaries, the indicator thresholds and escalation timings, the scoring-matrix bands, and the acceptance approval authorities live in the linked documents and are not restated here. This page carries composite claims: the sequence it describes across detection, re-scoring, escalation, the governed decision, board visibility, and assurance requires validation by the adopting organization against its own arrangements. The scenario is illustrative and makes no likelihood claim; a real event's facts determine which controls engage and how.