GCRI · Rêveberiya xetera pergalî
Rêveberiya xetereyê û iştaha xetereyê
Rêveberiya xeterê decides who owns each risk, how much of it an institution is willing to carry, and how that position is challenged and reported. Appetite statements and tolerances only matter if they shape decisions on strategy, investment and operations. This page sets out how governance arrangements work, where they fail for interconnected risks, and what evidence boards, ministers and supervisors need to set and review an appetite they can defend.
Risk governance and appetite in seven parts.
- 01The questionRisk governance and appetite: how the risk develops
- 02Li seranserê qadanRisk appetite set in one sector constrains the others
- 03NîşanderWhat is measured, and how well
- 04ÇavkanîWhere the evidence comes from
- 05BiryarWho decides, and what the evidence serves
- 06Core questionsWhat governance experts ask
- 07MechanismsWhy governance fails
Risk governance and appetite: how the risk develops.
Authority, objectives and acceptable exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Ownership fragments across silos
Risks that cross departments, sectors or jurisdictions often have no single owner. Each unit manages its share, and the combined exposure, which sits between them, is reported by nobody.
Appetite is set without measures
An appetite statement written in qualitative terms cannot be checked against exposure. Without tolerances tied to indicators, breaches are noticed late or argued away.
Short horizons crowd out slow risks
Reporting cycles reward attention to near-term, familiar risks. Slow-building and low-frequency risks, such as dependency concentration or climate exposure, receive less scrutiny until they materialise.
Challenge weakens over time
Independent risk functions and non-executive members lose influence when information is filtered, incentives align with growth, or dissent is costly. Governance then confirms decisions rather than testing them.
Risk register.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Tomara xetereyê
Risk governance and appetite · Enterprise A · Review cycle Q1
Xetera mayî
îhtîmal × bandor, xetere ji bo her şaneyê
Hejmara xetereyan ji bo her şaneyê. Siyahî li gorî bandên iştahê ye.
Ji iştahê zêdetir
| Berhevbûna peydakaran | Kirîn | Bilind | ▲ 1 |
| Lehiya navenda daneyê | Xebitandin | Bilind | ▼ 0 |
| Xeletiya modelê di bihakirinê de | Fînans | Navîn | ▲ 0 |
| Windakirina karmendên sereke | Mirov | Navîn | ▼ 1 |
Pêvajoya rêveberiya xetereyê, li gorî standarda navneteweyî
- Çarçove, kontekst, pîvankomek
- Nas biketaksonomî
- Analîz bikeîhtîmal · bandor
- Binirxîneli hember iştahê
- Derman bikeplan
- Çavdêrî û nirxandinKRI
- Tomar bike û rapor bikelijne
Çalakiyên dermankirinê
- T-11Pêkhateya krîtîk ji du çavkaniyanXwediyê wê: kirîn · dereng14 d dereng
- T-14Cihê yedekê ji jorê asta lehiyê bilind bikeXwediyê wê: operasyonmohlet 18 r
- T-17Rastandina modelê ya serbixweXwediyê wê: fînansmohlet 15 r
Risk appetite set in one sector constrains the others.
- AvGirêdanUtility boards set service reliability targets that fix how much drought and outage risk customers carry.What to watchStated levels of service for supply interruptions
- EnerjîGirêdanReserve margins and stockholding obligations express a government’s appetite for supply risk.What to watchReserve margin policy and stock cover
- TenduristîGirêdanSurge capacity decisions set how much shock a health system can absorb.What to watchFunded surge beds and staff
Governance findings are designed for the rêzeya Xetera û Berxwedana Pergalên Gerdûnî. Risk appetite statements are decisions of boards and governments; the page describes how they are made and documented, following ISO 31000 and COSO, and sets none.
- Published risk appetite statements from public bodies, with dates.
- Cases where an appetite set in one sector moved risk to another.
Stok, herik, dereng û sînorê guherînê.
Du stok, zext û kapasîteya adaptasyonê, bi xelekeyeke mezinbûnê ya xurtker, bersiveke hevsengiyê ya dereng û zirarê dema ku zext ji kapasîteyê derbas dibe têne girêdan; li derveyî sînor pergal dikare biguhere. Modela fêrkirinê bi nirxên nimûneyî yên diyarkirî, ne pêşbînî.
Kontrol
- Zêdebûna zextê
- 6.0% salê
- Bandora kapasîteyê di kêmkirina zextê de
- 4.0% salê
- Bersiva veberhênanê li hember zextê ya hatî dîtin
- 20%
- Derengiya têgihîştinê
- 4.0 sal
- Sînorê guherînê yê zextê
- 60 indeks
- Zêdebûn li derveyî sînor
- 2.0 carî
- Salên simulekirî
- 50 sal
Xwendin
- Zexta herî bilind
- 113 nîşander
- Kapasîte di dawiyê de
- 186 indeks
- Salên li ser sînor
- 15.8 sal
Jimar, rêbaz û çavkanî
| Sal | Zextê | Kapasîte | Hatî dîtin |
|---|---|---|---|
| 0 | 20.0 | 50.0 | 20.0 |
| 4 | 23.3 | 44.9 | 21.2 |
| 8 | 27.2 | 42.2 | 24.0 |
| 12 | 31.7 | 42.3 | 27.7 |
| 16 | 36.8 | 45.5 | 32.2 |
| 20 | 42.3 | 51.5 | 37.2 |
| 24 | 47.9 | 60.3 | 42.6 |
| 28 | 53.2 | 71.3 | 48.0 |
| 32 | 57.8 | 84.3 | 53.1 |
| 36 | 66.4 | 98.4 | 58.4 |
| 40 | 82.7 | 115.9 | 69.7 |
| 44 | 97.8 | 139.7 | 83.8 |
| 48 | 109.1 | 169.4 | 97.3 |
Rêbaz
- Dînamîkên pergalê Forrester (1961), Industrial Dynamics, MIT Press; Sterman (2000), Business Dynamics
- Veguherînên krîtîk û xalên guherînê Scheffer and others (2009), Early-warning signals for critical transitions, Nature 461
- Diagrama xelekeya sedemî Sterman (2000), Business Dynamics, McGraw-Hill
- Pankeya nediyarîyê (Monte Carlo ya parametreyan) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- Hesasiyeta yek-yek (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Dane
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme’s own evidence.
Li seranserê şeş stûnan, bi pêşengiya Nexus Consortium
- Ceribandin Labs
- Hatiye avakirin di Rêveberiya xetera pergalî li Foundry
- Tê ceribandin li Rêveberiya xetera pergalî li Universe
- Hatiye kodkirin di Xeterên pergalî di Standards de
- Hatiye weşandin di Rêveberiya xetera pergalî li Reports
- Tê de tê dayîn Fakulteya Zanista xetereyê û Rêbazan di Academy de
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Nîşan |
|---|---|---|---|---|
| Risks with a named owner | percent of register entries | quarterly | Tomara xetereyê | REPORTED |
| Exposure against tolerance | ratio of measured exposure to stated tolerance | per reporting cycle | Risk reporting to the board or cabinet | REPORTED |
| Tolerance breaches escalated on time | percent of breaches escalated within the defined period | quarterly | Escalation logs | REPORTED |
| Cross-cutting risks with joint ownership | count of risks with a cross-unit owner | annual | Rêveberiya xeterê charters | DECLARED |
| Board time on principal risks | share of agenda time | annual | Board minutes and committee records | REPORTED |
| Open audit findings on risk governance | count by age band | quarterly | Internal audit tracking | REPORTED |
How risk governance and appetite is modelled, measured and tested.
Model, texmînên wî, daneyên wî û nediyariya wî, bi şeweyê ku zanyar an endezyar kontrol bike. Avahî rêbazên weşandî dişopînin. Nirxên hatine xêzkirin nimûneyî ne, ne encam in.
Model, hevkêşe û texmîn
The model structure used for risk governance and appetite, the assumptions it makes and how each is tested.
Ri = f(Hi, Ei, Vi, Ci)metirsî, rûbirûbûn, lawazî û kapasîteya serederiyêEAL = ∑k pk · Lkli ser bûyerên k bi îhtîmala salane pkxt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| Texmîn | Çima tê çêkirin | Çawa tê ceribandin |
|---|---|---|
| Metirsî û rûbirûbûn di nav bûyerekê de serbixwe ne | Entegrala windahiyê ji hesabkirinê re maqûl dihêle | Bi lihevhatineke copula li ser tomarên hevbeş re bidin ber hev |
| Girêdan li nêzî xala xebatê xêzik in | Dihêle şok di A de belav bibin | Ji derveyî rêza xêzik tevlihev bike û bide ber hev |
| Xêzên lawaziyê di navbera cihan de têne veguhastin | Xêzikên herêmî kêm tên dîtin | Li hember windahiyên çavdêrîkirî erê bike li cihê ku hene |
- Têketin
- danehevên bi guhertoyan û çavkaniyê
- Derketin
- belavkirin, tu carî jimarên tenê
- Kod
- bi qerta modelê û ceribandinan re hat weşandin
- Zêdebûn
- heman dane, kod, jîngeh û tov
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Çavkanî | What it gives | Licence class |
|---|---|---|
| ISO 31000 and its handbook | Principles and framework language for governance, roles and integration | Licensed standard, purchase required |
| COSO Enterprise Risk Management framework | Components and principles on governance, culture and appetite | Licensed publication, purchase required |
| OECD Recommendation on the Governance of Critical Risks and its implementation reports | Country practice on national rêveberiya xeterê and coordination | Public, OECD terms of use |
| Published annual reports and principal risk disclosures | How organisations describe their risks, appetite and governance | Public records, terms per publisher |
| National audit office reports on risk management in government | Independent findings on how public bodies govern risk | Public records, licence per office (to check) |
Who decides, and what the evidence serves.
xetera pergalî Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Kî biryarê dide | The question | Evidence this page serves |
|---|---|---|
| Boards and risk committees | What level of each principal risk the organisation accepts, and when a breach triggers action | Appetite templates; exposure against tolerance; ownership gaps |
| Cabinet offices and centres of government | Who coordinates national risks that cross ministries | Ownership maps of cross-cutting risks; peer country governance practice |
| Supervisors and regulators | Whether a regulated entity’s rêveberiya xeterê is adequate for its exposures | Governance reviews against named principles; escalation records |
| Internal audit functions | Which risk governance processes to examine next | Open findings; areas with weak ownership or untested tolerances |
Outputs this topic produces
- Risk ownership maps that show cross-cutting exposures and their gaps
- Appetite and tolerance templates linked to measurable indicators
- Governance reviews framed against ISO 31000 and COSO principles
- Briefing notes for boards and cabinet committees on systemic exposures
What governance experts ask.
- Who has authority to accept a given risk, and is that authority clear before a crisis rather than improvised during one?
- Is the stated îştaha xetereyê connected to real limits, budgets and decisions, or is it a statement no one uses?
- How are risks that the organisation shares with others, or imposes on others, reflected in its appetite?
- How does the board or council learn when exposure is drifting beyond what it agreed?
Why governance fails.
Post-event reviews of major failures repeatedly find that warning signs existed inside the organisation. The failure was not a lack of information but of authority, incentives and channels that would have carried that information to someone able and willing to act.
Diffuse ownership
Risks that cross departments or organisations have no single owner, so no one is accountable when they materialise.
Short horizons
Rewards for near-term performance can favour risks whose costs arrive later or fall on others.
Filtered reporting
Bad news is softened as it moves upward, so leaders see a calmer picture than staff do.
How governance and appetite are designed and tested.
- 01
Appetite frameworks
Statements of appetite translated into tolerances and limits for specific risk types. They work best where risks can be measured and worst for novel or shared risks.
- 02
Lines of defence
Separation of risk-taking, risk oversight and independent assurance. The model clarifies roles but can encourage box-ticking if not used thoughtfully.
- 03
Analîza biryarê
Analîza biryarê di bin nediyarî de makes trade-offs and values explicit. It depends on honest elicitation of preferences.
- 04
Governance reviews
Post-event and periodic reviews test whether governance worked as designed. They are only as useful as the willingness to act on them.
How it is studied, and what the methods cannot say.
- 01Analîza biryarê di bin nediyarî deMulti-criteria treatment choice · Decision trees for contingent plansApplied here
- 02Pîvandina nediyariyê û rastandina modelêPropagating input uncertainty · Separating kinds of uncertainty · Deep uncertainty framingApplied here
- 03Îhtîmal û statîstîkFrequency and severity modelling · Dependence between risks · Combining data and judgementApplied here
Where this page’s references lead.
Sazî û belgeyên ku ev rûpel li hember wan tê xwendin. Rewş û çap diguherin; her girêdan diçe ba saziya derxistinê.
Pirs û bersiv.
What is risk appetite?
How is risk tolerance different from appetite?
Who should own a systemic risk?
Is a risk appetite statement required?
Can an organisation have appetite for systemic risk?
Does the platform review organisations’ governance?
Ji vê rûpelê delîl bidin.
rêzeya Pergalên Stratejîk is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- E-nameDergeh GW-GCRIJi vê rûpelê bişîninDelîl, rastkirin, doz, rêbaz, nirxandin, wergerandin an têketina profîlê. Bi nîşana vê rûpelê digihîje, ji ber vê yekê edîtorê xwediyê wê wê bistîne.
- ZenodoDepoya vekirîWê razînin û ji civakê re bişîninTomara xwe li Zenodo bi ORCID iD ya xwe biweşînin, paşê wê li wir ji civaka Reports re bişînin. Kurator wê vedikolin; DOI ya we dimîne.
- rêzeya Pergalên StratejîkGCRIHemû rêyên beşdariyê bibîneCureyên beşdariyê, her yek çawa tê nirxandin, tu çi navlêkirinê distînî, lîsans û tiştê ku qet nayê qebûlkirin.
Tu carî daneyên şexsî, hûrgiliyên binesaza hesas an tiştekî ku mafê we yê parvekirinê tune ne neşînin. Beşdarî berî bikaranînê tê nirxandin; şandina wê nivîskarî an mafên edîtorî nade û sponsorî tu carî encamekê nakire.
Rêbazek, danehevek an pirsek bîne.
Agahî û pirs îro vekirî ne. Pirsek referansekê distîne û gava piştî wê dide nasîn; serlêdan, drav, veqetandina hesabkirinê û tomarkirin tenê dema ku tîm, mercên wê û kapasîteya vekolînê hebin vedibin.
Belgeyên hiqûqî.
Nexşe, dane û jimarên vê malperê ji bo çarçoveyê û agahiyên giştî têne nîşandan. Ew ne şîret, ne pêşbînî û ne hişyarî ne; sînorên agahiyê di Daxuyaniyên Berpirsiyariyê û Daxuyaniyên Daneyê de hatine diyarkirin.