Skip to main content
Governance Authority
Category: Enterprise Risk Management

Risk Governance

Simply put

Risk governance is the system through which an organization's board and senior management set direction for, authorize, and oversee how the enterprise deals with uncertainty. It establishes who holds accountability for risk decisions and connects those decisions to the organization's broader strategy and objectives. It is generally distinct from day-to-day risk management, which carries out these activities within the framework that governance sets.

Formal definition

Risk governance refers to the structure, policies, and accountability arrangements by which a board and senior management direct, authorize, and oversee an enterprise's response to risk, and by which risk management evaluation, decisions, and actions are connected to enterprise strategy and objectives. It typically defines roles, decision rights, and oversight responsibilities, positioning the board in an oversight capacity while management executes risk-taking and risk management activities within that framework. Scope, structure, and specific requirements vary by jurisdiction, sector, and entity type; in regulated contexts such as banking, supervisory guidance may address governance over strategic, compliance, and operational risks alongside credit, liquidity, and interest rate risk. This entry is educational and not legal, audit, or compliance advice.

Why it matters

Risk governance matters because it establishes where accountability for risk decisions sits and how those decisions connect to what the organization is actually trying to achieve. Without a clear governance structure, risk-taking can become disconnected from strategy, oversight can blur into operational involvement, and no one may hold clear responsibility when significant exposures materialize. By setting direction, authorizing risk-taking within defined boundaries, and overseeing how risk is managed, risk governance helps ensure that the enterprise's response to uncertainty is deliberate rather than accidental.

The distinction between governance and day-to-day risk management is central to why this concept is important. Risk governance generally positions the board in an oversight capacity, setting the framework, policies, and accountability arrangements, while management executes risk-taking and risk management activities within that framework. Confusing the two can lead to boards drawn into operational detail they are not equipped to manage, or to management operating without adequate direction or authorization. Clear governance keeps these roles separate and reinforcing.

In regulated sectors, the stakes are higher still. In banking, for example, supervisory guidance may address governance over strategic, compliance, and operational risks alongside credit, liquidity, and interest rate risk, reflecting the range of exposures such institutions carry. Because scope, structure, and specific requirements vary by jurisdiction, sector, and entity type, the practical shape of risk governance in any given organization depends heavily on its context.

Who it's relevant to

Boards and board committees
Risk governance places the board in an oversight capacity, responsible for setting direction, authorizing risk-taking within defined boundaries, and overseeing how the enterprise confronts uncertainty. Boards and their committees rely on clear governance arrangements to hold accountability without straying into the day-to-day risk management activities that management executes.
Senior management
Senior management typically shares responsibility with the board for directing and overseeing the enterprise's response to risk, while also executing risk-taking and risk management activities within the governance framework. Understanding where governance responsibility ends and operational risk management begins is essential to operating within their authorized mandate.
Chief risk officers and risk functions
Those running risk functions operate within the framework, structure, policies, and accountability that risk governance sets. A clear understanding of governance helps them align risk management evaluation, decisions, and actions with enterprise strategy and objectives, and clarifies the decision rights and reporting lines through which they operate.
Regulated institutions such as banks
In regulated sectors, supervisory guidance may address governance over strategic, compliance, and operational risks alongside credit, liquidity, and interest rate risk. Institutions in these sectors must tailor their risk governance to applicable supervisory expectations, which vary by jurisdiction and entity type.
Governments and public bodies
Governments carry responsibility for managing a range of complex crises, including pandemics, climate and other natural hazards, cyber, and terrorist threats. Risk governance provides a system for directing and overseeing how such entities confront these uncertainties, though the structures involved differ from those in corporate settings.

Inside Risk Governance

Board-level oversight
Risk governance typically situates ultimate accountability for the risk framework with the board or a designated committee (such as a risk or audit committee). The board's role is generally oversight, approving the risk appetite, challenging management, and monitoring, rather than day-to-day risk management, which sits with management.
Risk appetite and tolerance framework
A structured articulation of the amount and type of risk an organization is generally willing to accept in pursuit of objectives (appetite), along with more granular limits (tolerance) and the total capacity to absorb risk. These are distinct concepts and should not be treated interchangeably.
Roles, responsibilities, and lines of defense
A defined allocation of duties among operational management (first line), risk and compliance oversight functions (second line), and independent assurance such as internal audit (third line). Risk governance clarifies who owns, who oversees, and who provides assurance over risks.
Policies, framework, and reporting
The documented policies, decision rights, escalation paths, and management information flows that enable risks to be identified, assessed, and reported to the appropriate level. Frameworks such as COSO ERM or ISO 31000 are commonly referenced as voluntary references to structure these elements, but neither is universally mandatory.
Culture and accountability
The tone set by the board and senior management regarding risk-taking and control, including incentives, behaviors, and mechanisms that reinforce accountability. Risk governance concerns how these expectations are established and monitored across the organization.

Common questions

Answers to the questions practitioners most commonly ask about Risk Governance.

Is risk governance just another name for enterprise risk management (ERM)?
No. The two are related but distinct. Risk governance generally refers to the structures, roles, accountabilities, and oversight arrangements through which an organization directs and supervises how risk is managed, typically a board-level and leadership concern. ERM, by contrast, is generally the operational process and set of activities through which management identifies, assesses, responds to, and monitors risk across the enterprise. In short, risk governance is largely about oversight and accountability, while ERM is largely about the processes management uses to execute risk management. Conflating the two tends to blur the line between the board's oversight duty and management's operational responsibility.
Does the board manage the organization's risks under a risk governance model?
Generally no. Under most governance models, the board's role is oversight, setting the tone, approving the risk appetite or framework, and satisfying itself that management has appropriate processes in place, rather than the day-to-day management of individual risks, which is typically a management responsibility. Attributing operational risk management to the board, or oversight to management, misstates where accountability usually sits. The precise allocation of duties can vary by jurisdiction, entity type, and the organization's own governance arrangements, and boards frequently delegate specific aspects of oversight to committees such as an audit or risk committee.
How should a board and management divide responsibilities within a risk governance structure?
A common approach is to make the board (often through a designated committee) accountable for oversight, reviewing and approving the risk framework and appetite, and challenging management's reporting, while management owns the design and operation of risk processes. Many organizations articulate this using a three-lines model, in which operational management owns and manages risk, risk and compliance functions provide oversight and challenge, and internal audit provides independent assurance. The specific mapping should be documented and tailored to the entity; there is no single mandatory structure, and the appropriate design depends on the organization's size, sector, and complexity.
Which frameworks can inform the design of a risk governance structure?
Organizations often draw on recognized frameworks such as COSO's enterprise risk management framework, ISO 31000, and corporate governance codes or principles applicable in their jurisdiction. It is important to note that these frameworks differ in scope and purpose, some address risk management processes, others address broader governance, and that most are voluntary reference points rather than universally binding requirements. Certain statutory or listing-rule obligations may apply depending on jurisdiction, sector, and entity type, so an organization should confirm which requirements are legally binding on it and treat frameworks as guidance to be adapted rather than adopted wholesale. This is educational information and not legal or compliance advice.
How can a board gain assurance that risk governance is working effectively?
Boards typically seek assurance from multiple sources, including management reporting, independent internal audit, and, where relevant, external assurance providers. In evaluating risk processes, it is generally useful to distinguish control design (whether a control is capable of achieving its objective) from operating effectiveness (whether it actually functions as intended over time), as assurance over one does not establish the other. The appropriate depth and mix of assurance depends on the organization's risk profile and the significance of the risks involved, and remains a matter for the board's judgment.
How does risk appetite fit into risk governance, and who sets it?
Risk appetite, broadly, the amount and type of risk an organization is willing to pursue in seeking its objectives, is commonly approved at board level as part of oversight, with management responsible for translating it into operational limits and monitoring adherence. It is worth distinguishing appetite from related concepts: risk tolerance generally refers to acceptable variation around specific objectives or limits, and risk capacity to the maximum risk an organization could bear. Treating these as interchangeable can undermine the framework. The specific process for setting and cascading appetite depends on the organization's structure and should be documented so that accountability is clear.

Common misconceptions

Risk governance and risk management are the same thing.
They are related but distinct. Risk governance generally refers to the oversight structures, accountabilities, and decision rights, typically owned at the board level, while risk management refers to the operational processes of identifying, assessing, and treating risks, which management typically owns. Conflating the two obscures where accountability sits.
Adopting a recognized framework such as COSO ERM or ISO 31000 is legally required and guarantees good risk governance.
These are generally voluntary frameworks or standards, not binding law in most jurisdictions, though some regulators or listing rules may reference them for certain entities. Adoption alone does not ensure effective governance; what matters is how a framework is applied, and requirements vary by jurisdiction, sector, and entity type.
The board is responsible for managing the organization's risks.
In many governance models the board's role is oversight, approving the risk appetite, challenging management, and monitoring, rather than operational risk management, which typically rests with management and the second and third lines. Attributing operational duties to the board misstates the accountability structure.

Best practices

Document a clear risk appetite statement approved by the board, and distinguish it from more granular risk tolerances and the organization's overall risk capacity so limits and thresholds are unambiguous.
Define and periodically review the allocation of responsibilities across the lines of defense so that ownership, oversight, and independent assurance roles are distinct and not blurred.
Ensure reporting and escalation paths deliver risk information to the appropriate committee or board level at a frequency and granularity that supports effective oversight and challenge.
Select any reference framework (for example, COSO ERM or ISO 31000) based on the organization's size, sector, and jurisdictional requirements, and treat it as a structuring tool rather than a compliance checkbox.
Confirm applicable binding requirements, such as statutes, regulations, or listing rules relevant to the entity type and jurisdiction, separately from voluntary codes and best practice, and seek professional advice where obligations are uncertain.
Periodically assess the effectiveness of risk governance arrangements, including board and committee composition, information quality, and risk culture, rather than assuming that having a framework in place equates to it operating effectively.