Enterprise Risk Governance and Frameworks

Introduction and Context

Enterprise risk management (ERM) is the coordinated process through which an organisation identifies, assesses, responds to, monitors and reports risks that may affect its objectives. In accounting and finance, risk management is not limited to market losses or insurance. It includes financial, operational, strategic, compliance, technology, reputational, conduct, liquidity and emerging risks.

Modern organisations operate through interconnected systems. A cyber incident may interrupt operations, create regulatory penalties and damage reputation. A treasury decision may affect liquidity, creditworthiness and strategic investment. Effective governance therefore requires more than isolated risk registers. It requires clear accountability, appropriate controls, reliable information and active oversight by the board.

This chapter examines three influential foundations of enterprise risk governance: ISO 31000, the COSO Enterprise Risk Management framework and the Three Lines Model. It also explains risk appetite, tolerance, limits, ownership, board oversight, risk culture, reporting, controls and the role of the chief risk officer (CRO).

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and principles of enterprise risk governance.
2. Apply the ISO 31000 risk-management process.
3. Describe the components of COSO ERM and compare them with ISO 31000.
4. Explain the Three Lines Model and distinguish management, risk functions and internal audit.
5. Define risk appetite, tolerance, limits and risk ownership.
6. Evaluate board oversight, risk culture, controls and risk reporting.
7. Explain the responsibilities and independence requirements of a CRO.
8. Analyse a practical risk-governance problem and recommend improvements.

1. Risk Governance as an Organisational System

Risk governance is the allocation of authority, responsibility and accountability for managing uncertainty. It connects the board’s oversight responsibilities with management’s decision-making and the control activities performed throughout the organisation.

A sound governance system answers five questions:

• What objectives is the organisation pursuing?
• What uncertainties could prevent or assist achievement of those objectives?
• Who owns each risk and has authority to respond?
• What information must be escalated, to whom and when?
• How can the board obtain assurance that risk management is working?

Risk governance differs from risk management, although the two are closely related. Governance establishes direction, accountability and oversight. Risk management is the process of identifying and responding to uncertainty. Internal control is the set of policies, procedures and activities designed to provide reasonable assurance that objectives will be achieved.

Risk cannot be eliminated without also eliminating many opportunities. The purpose of ERM is therefore not zero risk. It is informed decision-making within approved boundaries, with risks understood in relation to strategy, capital, liquidity, performance and stakeholder obligations.

Risk Categories

Common categories include:

These categories should not be treated as independent. A useful risk taxonomy supports consistent language, but management must also examine interdependence and concentration.

2. ISO 31000

ISO 31000:2018, Risk Management—Guidelines, provides principles, a framework and a process for managing risk. It is guidance rather than a certifiable management-system standard. Its central idea is that risk management should be integrated into governance, strategy, planning, reporting, values and operations.

2.1 Principles

ISO 31000 identifies principles that describe effective risk management. In practical terms, risk management should:

• be integrated into organisational activities;
• use a structured and comprehensive approach;
• be customised to the organisation’s context;
• involve relevant stakeholders;
• be dynamic and responsive to change;
• use the best available information while recognising uncertainty and limitations;
• consider human and cultural factors;
• support continual improvement and learning; and
• create and protect value.

The principle of integration is particularly important. A risk register prepared by a specialist department but ignored in capital budgeting is not effective ERM.

2.2 ISO 31000 Framework

The framework helps an organisation embed risk management. Leadership and commitment are essential. The governing body should ensure that risk management is aligned with strategy, adequately resourced and periodically reviewed. Management should establish roles, communication arrangements, accountability and performance measures.

The framework includes design, implementation, evaluation and improvement. It is therefore iterative rather than a one-time project. Changes in regulation, technology, strategy or market conditions may require the framework to be redesigned.

2.3 ISO 31000 Process

The process generally involves:

1. Communication and consultation. Relevant internal and external stakeholders contribute information and understand decisions.
2. Scope, context and criteria. The organisation defines objectives, internal and external context, decision boundaries and risk criteria.
3. Risk assessment. Risks are identified, analysed and evaluated.
4. Risk treatment. The organisation selects and implements responses.
5. Monitoring and review. Risk conditions, controls and assumptions are examined.
6. Recording and reporting. Decisions, evidence, owners and outcomes are documented.

Risk identification asks what could happen, why it could happen and what consequences may result. Risk analysis considers likelihood, consequences, existing controls and uncertainty. Qualitative scales such as low, medium and high may be suitable for initial screening, but they must be defined consistently.

Risk evaluation compares analysed risk with established criteria. A risk may be accepted, treated, transferred or avoided. Treatment options include changing the activity, reducing likelihood, reducing consequences, sharing the risk through contracts or insurance, or retaining the risk by informed decision.

A simple expected-loss estimate can support prioritisation:

Probability is expressed from 0 to 1, and financial consequence is measured in currency. This relationship is a simplified decision aid. It assumes the probability and consequence estimates are meaningful and does not capture non-financial effects, extreme uncertainty, correlation, timing or risk aversion. It should not be interpreted as a prediction of the exact loss.

For example, if a payment-fraud event has an estimated probability of 0.04 in a year and a possible financial consequence of $500,000, the estimated annual loss is $20,000. Management may still invest more than $20,000 in controls because regulatory, reputational and customer consequences are not fully represented by the calculation.

3. COSO Enterprise Risk Management

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published Enterprise Risk Management—Integrating with Strategy and Performance in 2017. COSO ERM emphasises the relationship between risk, strategy and performance. Risk is considered during strategy formulation, implementation and performance evaluation.

COSO describes five interrelated components:

3.1 Governance and Culture

Governance establishes board oversight, operating structures, desired behaviours and accountability. Culture reflects how people perceive and respond to risk in practice. A formal policy cannot compensate for incentives that reward excessive short-term risk-taking.

3.2 Strategy and Objective-Setting

The organisation considers risk and risk appetite when evaluating strategic alternatives and setting objectives. Objectives should be sufficiently clear to allow risks to be identified and evaluated.

3.3 Performance

Risks are identified and assessed according to severity. The organisation prioritises risks, selects responses and develops a portfolio view. Responses commonly include accepting, avoiding, pursuing, reducing and sharing risk.

3.4 Review and Revision

Management reviews whether risk and performance remain aligned. Significant changes may require revisions to strategy, objectives, controls or risk appetite.

3.5 Information, Communication and Reporting

Relevant information must flow vertically and horizontally. Reporting should be timely, reliable, sufficiently complete and understandable to its users.

COSO also presents ERM through several perspectives, including mission, vision and core values; strategy and business objectives; performance; review and revision; and information, communication and reporting. The framework is not a checklist guaranteeing success. It is a structure for judgement, dialogue and accountability.

ISO 31000 and COSO ERM Compared

The frameworks are complementary. An organisation may use COSO to structure governance and ERM responsibilities while applying ISO principles and process steps to particular risks.

4. The Three Lines Model

The Three Lines Model, associated with the Institute of Internal Auditors, clarifies organisational roles. It does not mean that only three departments manage risk, nor does it imply that risk responsibility can be delegated away from management.

First Line: Management and Operations

The first line owns and manages risks. Operational managers identify risks, implement controls, operate processes and take corrective action. For example, a procurement manager is responsible for supplier due diligence and segregation of purchasing and payment duties.

Second Line: Risk, Compliance and Specialist Functions

The second line provides expertise, support, monitoring and challenge. It may include enterprise risk, compliance, legal, information security, health and safety, treasury risk and model-risk functions. These functions help develop policies, monitor exposures, test selected controls and escalate concerns. They should have sufficient independence from the activities they oversee.

Third Line: Internal Audit

Internal audit provides independent and objective assurance and advice on governance, risk management and control. It reports functionally to the audit committee or equivalent governing body, although it may have administrative reporting to management. Internal audit should not own operational risks or design controls that it will later audit.

The board and executive management sit above and alongside the model as governing bodies, not as a fourth line. They provide oversight, resources, direction and accountability. External assurance providers, regulators and other stakeholders may provide additional assurance but are not substitutes for internal responsibility.

5. Risk Appetite, Tolerance, Limits and Ownership

These terms are related but not interchangeable.

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain in achieving its objectives. It is a strategic statement approved by the board and may include both financial and non-financial dimensions.

Risk tolerance is the acceptable range of variation around an objective or risk outcome. Tolerance is usually more specific than appetite. For example, the organisation may have a moderate appetite for credit risk but a narrow tolerance for overdue regulatory reports.

Risk limits are operational boundaries designed to keep exposures within approved appetite and tolerance. A trading desk may have a position limit, a treasury function may have a counterparty limit, and a business unit may have a data-access limit.

Risk capacity is the maximum risk the organisation can absorb before threatening its viability, obligations or critical objectives. Capacity is constrained by capital, liquidity, legal obligations, technology, reputation and stakeholder expectations.

Risk owner is the person accountable for ensuring that a particular risk is identified, assessed, treated, monitored and reported. A risk owner may delegate tasks, but normally cannot delegate accountability without a formal reassignment.

A useful hierarchy is:

Figure: The relationship between risk capacity, appetite, tolerance and operational limits.

The hierarchy should operate in both directions. Board-approved appetite must be translated into measurable limits, while repeated limit breaches may indicate that appetite is unrealistic or that controls are ineffective.

6. Board Oversight and the Chief Risk Officer

The board is responsible for oversight, not for managing every individual risk. Its responsibilities commonly include approving strategy and risk appetite, understanding major exposures, challenging management assumptions, ensuring appropriate expertise and reviewing whether risk governance is effective.

An effective board asks questions such as:

• Which risks could prevent the organisation from achieving its strategy?
• What assumptions support current risk assessments?
• Which risks are close to tolerance or capacity?
• Are incentives encouraging behaviour inconsistent with stated values?
• What information is missing from management reports?
• How quickly would the board know about a major incident?

Board committees can support oversight. A risk committee may focus on enterprise risk and appetite; an audit committee may focus on financial reporting, internal control and internal audit; a remuneration committee may examine whether incentives create inappropriate risk. Responsibilities must be coordinated to avoid gaps.

The CRO leads or coordinates the enterprise risk function. Typical responsibilities include developing the risk framework, advising the board and executives, maintaining risk taxonomy and appetite processes, challenging business assessments, coordinating stress testing, aggregating exposures and reporting material concerns.

The CRO’s effectiveness depends on authority and independence. The CRO should have direct access to the chief executive, board or risk committee and should be able to escalate concerns without suppression. However, the CRO is not the owner of every organisational risk. Business management retains first-line accountability.

Potential conflicts arise when the CRO is responsible for both challenging decisions and meeting commercial targets. A strong governance design defines reporting lines, escalation rights, access to information and performance evaluation. The CRO should be influential without becoming a substitute for management judgement or board responsibility.

7. Risk Culture, Controls and Reporting

Risk culture consists of shared attitudes, values and behaviours concerning uncertainty and control. It is observable through decisions, incentives, challenge, escalation and treatment of mistakes. Indicators of a healthy culture include willingness to report near misses, consistent consequences for misconduct, realistic performance targets and respectful challenge.

Culture can be assessed through employee surveys, turnover, whistleblowing data, training results, incident trends, control overrides and interviews. None of these measures is definitive. Quantitative indicators should be interpreted alongside qualitative evidence.

Control Design and Operation

Controls may be:

• Preventive, such as approval requirements and segregation of duties;
• Detective, such as reconciliations, exception reports and surveillance;
• Corrective, such as incident response and recovery procedures;
• Manual or automated; and
• Entity-level or process-level.

A control is effective only when it is appropriately designed and operates consistently. A policy that is never followed is not an effective control. Excessive controls can also create workarounds, delay decisions and obscure responsibility.

A basic control assessment distinguishes inherent risk from residual risk. Inherent risk is exposure before considering controls; residual risk is the exposure remaining after controls and responses. These are conceptual assessments, not necessarily precise numerical quantities.

Risk Reporting

A useful risk report is decision-oriented. It should explain the exposure, trend, cause, potential consequence, current controls, risk owner, proximity to limits, management action and required decision. Reports should distinguish actual incidents from indicators and forecasts.

Key risk indicators (KRIs) may include liquidity coverage, overdue receivables, system availability, staff turnover, control failures or complaints. A KRI becomes useful when it has a defined owner, data source, frequency, threshold and escalation response.

Reporting problems include excessive volume, inconsistent definitions, delayed data, false precision, aggregation that hides concentration and traffic-light ratings without clear action. A red rating should identify who must act and by when.

8. Applied Case: Northbridge Payments Ltd.

Background

Northbridge Payments Ltd. is a fictional, illustrative medium-sized payment-services company. It has grown rapidly through mobile payment products. Its board receives monthly financial reports but only quarterly risk reports. The company has experienced two service outages, a suspected account-takeover incident and increasing regulatory scrutiny.

Problem

The company’s risk register lists cyber, operational and compliance risks, but no individual is clearly accountable for several entries. The chief information officer reports technology incidents to the chief executive, while the compliance officer reports separately to the audit committee. There is no approved enterprise risk appetite statement. Management reports show risk ratings but do not show limit breaches, trends or overdue actions.

Analysis

The situation reveals several governance weaknesses. First, the board has not translated strategy into risk appetite. Second, ownership is fragmented. Third, second-line challenge is underdeveloped. Fourth, internal audit has not assessed the end-to-end incident-management process. Finally, reporting is too infrequent for rapidly changing cyber and operational exposures.

Using ISO 31000, Northbridge should clarify its context and objectives, identify interconnected risks, assess likelihood and consequences, select treatments, monitor indicators and record decisions. Using COSO ERM, the board should connect growth strategy with risk appetite, performance and culture. Using the Three Lines Model, operational managers should own controls, risk and compliance should provide challenge, and internal audit should independently assess governance and control.

Approach and Solution

The board approves an appetite statement that permits innovation and moderate operational risk but has very low tolerance for unauthorised access to customer funds, material regulatory breaches and prolonged service interruption. Management translates this into limits, such as maximum outage duration, incident-escalation time, unresolved high-risk vulnerabilities and permitted access exceptions.

Each material risk receives a named owner. A CRO or equivalent risk leader establishes a common taxonomy and reporting calendar. A cross-functional risk committee reviews cyber, operations, compliance and customer-impact information together. KRIs are linked to thresholds and documented responses. Internal audit creates an assurance plan covering access management, resilience, incident response and regulatory reporting.

Outcome

After implementation, the board receives a monthly dashboard with trend information and explicit decisions required. A vulnerability threshold breach triggers executive escalation. A post-incident review identifies control and cultural causes rather than blaming individual employees. The company’s governance becomes more transparent, although residual risk remains.

Learning Points

The case demonstrates that risk governance is a system rather than a document. Appetite must be converted into operational boundaries. Ownership must be explicit. Specialist functions must challenge without taking over first-line responsibility. Reporting must support timely decisions, and internal audit must provide independent assurance.

9. Limitations and Contemporary Issues

Frameworks can create an illusion of control. Risk assessments may be biased, historical data may not represent future conditions, and low-probability events may be underestimated. Aggregation models can conceal dependencies, while qualitative ratings can produce inconsistent results. Boards must therefore challenge assumptions and consider scenarios, stress events and emerging risks.

Technology changes both risk and control. Artificial intelligence may improve anomaly detection, forecasting and monitoring, but it can introduce model risk, bias, privacy concerns, cybersecurity vulnerabilities and unclear accountability. AI-generated risk reports require human validation, documented data sources and controls over model changes. No organisation should treat automated output as independent assurance.

Climate change, geopolitical instability, outsourced technology and supply-chain concentration require broader risk perspectives. Third-party risk management should examine due diligence, contractual rights, concentration, resilience, incident notification and exit arrangements. Resilience planning should consider how critical services continue during disruption, not merely how quickly systems return to normal.

Ethical governance requires truthful reporting, fair treatment of stakeholders, protection of confidential information and willingness to escalate bad news. Suppressing risk information to protect bonuses or reputation is a governance failure even if no immediate loss occurs.

Best-Practice Checklist

An organisation seeking to strengthen enterprise risk governance should:

1. Align risk governance with strategy and objectives.
2. Approve a clear risk appetite and define capacity, tolerance and limits.
3. Assign named owners with appropriate authority.
4. Separate first-line ownership, second-line challenge and third-line assurance.
5. Maintain reliable risk data and common definitions.
6. Use KRIs with thresholds, owners and escalation actions.
7. Review culture, incentives and conduct as well as formal controls.
8. Provide the board with concise, timely and decision-oriented reporting.
9. Test resilience through scenarios and stress events.
10. Review the framework after incidents, strategic changes and emerging risks.

Chapter Summary

Enterprise risk governance establishes how an organisation directs, owns, manages and oversees uncertainty. ISO 31000 provides principles and an iterative process based on context, assessment, treatment, monitoring and communication. COSO ERM emphasises the integration of risk with governance, culture, strategy, performance and reporting. The Three Lines Model clarifies that management owns risk, specialist functions provide support and challenge, and internal audit provides independent assurance.

Risk appetite expresses the amount and type of risk the organisation is willing to pursue or retain. Tolerance defines acceptable variation, limits translate boundaries into operational rules, and capacity identifies the maximum sustainable exposure. Effective governance requires active board oversight, an appropriate risk culture, well-designed controls, reliable reporting and a CRO with authority and independence. Frameworks support judgement but cannot replace it; their value depends on behaviour, information quality, accountability and continual improvement.

Key Terms

Risk governance: Allocation of authority, responsibility and accountability for overseeing uncertainty.

Enterprise risk management: Coordinated management of risks in relation to organisational objectives.

ISO 31000: International guideline providing principles, a framework and a risk-management process.

COSO ERM: Framework integrating risk with governance, strategy, performance and reporting.

Three Lines Model: Model distinguishing management ownership, second-line support and challenge, and independent internal audit assurance.

Risk appetite: Amount and type of risk an organisation is willing to pursue or retain.

Risk tolerance: Acceptable variation around an objective or risk outcome.

Risk limit: Operational boundary established to control exposure.

Risk capacity: Maximum risk an organisation can absorb without threatening viability or obligations.

Risk owner: Person accountable for managing and reporting a particular risk.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls and responses.

Key risk indicator: Measure that signals changing exposure or control performance.

Risk culture: Shared values, attitudes and behaviours concerning risk.

Chief risk officer: Senior executive responsible for coordinating and challenging enterprise risk management.

Risk treatment: Action selected to modify, share, avoid, accept or pursue risk.

Internal control: Policies and activities providing reasonable assurance over objectives.

Risk aggregation: Combining exposures to understand total or concentrated risk.

Review Questions

Short Answer Questions

1. What is the difference between risk governance and risk management?
2. Identify the main stages of the ISO 31000 risk-management process.
3. Define risk appetite, risk tolerance and risk limits.
4. What is the primary assurance role of internal audit in the Three Lines Model?
5. Why is risk culture important even when formal controls exist?

Long Answer Questions

1. Compare ISO 31000 and COSO ERM in terms of purpose, structure and application.
2. Explain the responsibilities of the board, management, second-line functions and internal audit.
3. Discuss how an organisation can translate board-approved risk appetite into operational limits.
4. Evaluate the conditions required for a CRO to operate effectively and independently.
5. Explain how risk reporting can support better strategic and operational decisions.

Analytical / Application Questions

1. A bank’s lending division repeatedly exceeds its concentration limit, but management reports the breaches only at year-end. Analyse the governance failures and recommend actions using the Three Lines Model.
2. A manufacturing company has a low appetite for safety risk but offers bonuses based solely on production volume. Evaluate the likely cultural and control consequences and propose improvements.
3. A technology company estimates that a cyber incident has a 2% annual probability and a direct financial consequence of $2 million. Calculate the simplified expected loss using Expected loss = Probability × Consequence, then explain why the result should not be the sole basis for deciding the control budget.

Multiple Choice Questions with Answers

Question 1

Which statement best describes risk appetite?

A. The maximum loss that an organisation can survive

B. The amount and type of risk an organisation is willing to pursue or retain

C. The number of controls required for each process

D. The amount of risk remaining after controls

Correct Answer: B. The amount and type of risk an organisation is willing to pursue or retain

Question 2

Under the Three Lines Model, who owns and manages operational risk?

A. The board only

B. Internal audit

C. First-line management and operations

D. External auditors

Correct Answer: C. First-line management and operations

Question 3

Which ISO 31000 activity involves defining objectives, context and decision criteria?

A. Risk treatment

B. Scope, context and criteria

C. Internal audit

D. Control remediation

Correct Answer: B. Scope, context and criteria

Question 4

What is the primary role of internal audit in the Three Lines Model?

A. To own all enterprise risks

B. To approve every operational decision

C. To provide independent and objective assurance

D. To set business-unit sales targets

Correct Answer: C. To provide independent and objective assurance

Question 5

A risk has a probability of 0.04 and a financial consequence of $500,000. What is its simplified expected loss?

A. $2,000

B. $12,500

C. $20,000

D. $200,000

Correct Answer: C. $20,000

Question 6

Which COSO ERM component most directly connects risk with strategic alternatives and objectives?

A. Strategy and objective-setting

B. Review and revision

C. Information security

D. External assurance

Correct Answer: A. Strategy and objective-setting

Question 7

Which statement about a risk owner is correct?

A. The owner is accountable for ensuring that the risk is managed and reported

B. The owner must always be the CRO

C. The owner cannot delegate any tasks

D. The owner is responsible only after an incident occurs

Correct Answer: A. The owner is accountable for ensuring that the risk is managed and reported

Question 8

Which feature most improves the usefulness of a key risk indicator?

A. It has no defined threshold

B. It is reported only after losses occur

C. It has an owner, data source, frequency and escalation response

D. It replaces all qualitative judgement

Correct Answer: C. It has an owner, data source, frequency and escalation response

Question 9

Why should a CRO have direct access to the board or a board committee?

A. To eliminate management accountability

B. To support independent escalation and challenge of material risks

C. To approve employee holiday schedules

D. To perform all internal-audit work

Correct Answer: B. To support independent escalation and challenge of material risks

Question 10

Which statement best describes residual risk?

A. Risk before any controls are considered

B. Risk remaining after controls and responses

C. The organisation’s total risk capacity

D. A risk that has been legally transferred

Correct Answer: B. Risk remaining after controls and responses