Policy
Enterprise Governance and Risk Management Policy
This policy establishes the enterprise governance and risk management framework, principles, roles, and control requirements that guide consistent identification, assessment, treatment, monitoring, and reporting of risk across the organization. It is aligned with ISO 31000:2018 Clauses 5 and 6, COBIT 2019 APO12, CSA CCM v4.1 GRC domain, NIST SP 800-39, ISO/IEC 23894:2023 for AI risk, and the NIST AI RMF 1.0. The policy integrates risk, compliance, privacy, security, resilience, ethics, and sustainability across business, technology, data, and AI systems.
- Type
- Policy
- Version
- 1.4.22
- Date
- 2026-10-27
- Owner
- Chief Risk Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Risk Management
- Review frequency
- Annual or as required by regulatory or framework changes
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Policy statements
- 5. Roles and responsibilities summary
- 6. Related documents
- 7. Framework alignment
- 8. Exceptions
- 9. Enforcement
- 10. Licence
Frameworks it maps to
- ISO 31000:2018
- ISO/IEC 23894:2023
- ISO/IEC 42001:2023
- COBIT 2019
- CSA CCM v4.1
- CSA AICM v1.1
- NIST SP 800-39
- NIST AI RMF 1.0
- OECD AI Principles
- GDPR
- PIPEDA
- PIPL
- LGPD
- APEC CBPR
Related documents
- Enterprise Risk Management Standardrisk
- Risk Register Procedurerisk
- Risk Acceptance Procedurerisk
- Exception and Risk Acceptance Management Policygovernance
- Cross-Framework Alignment Matrixgovernance
- AI Security and Risk Standardai
Next
All Documents