The Global Centre for Risk and Innovation (GCRI)
Risk governance decides who owns each risk, how much of it an institution is willing to carry, and how that position is challenged and reported. Appetite statements and tolerances only matter if they shape decisions on strategy, investment and operations. This page sets out how governance arrangements work, where they fail for interconnected risks, and what evidence boards, ministers and supervisors need to set and review an appetite they can defend.
GCRI · In development · service level R0
Risk governance is the set of structures, roles and processes that decide who owns each risk, how much of it an institution accepts and how that position is challenged and reported. Appetite statements matter only when tolerances tie them to measures. Cross-cutting risks need named joint owners, or their combined exposure goes unreported.
For risk governance and appetite, in GCRI's spatial-intelligence reading, the map opens on population density, true-colour imagery and night lights with true colour from NASA GIBS, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
People and hazards, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For risk governance and appetite, in GCRI's spatial-intelligence reading, the map opens on population density, true-colour imagery and night lights with true colour from NASA GIBS, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Risk governance and appetite · Enterprise A · Review cycle Q1
likelihood × impact, risks per cell
Counts of risks per cell. Shading follows the appetite bands.
| Supplier concentration | Procurement | High | ▲ 1 |
| Data centre flooding | Operations | High | ▼ 0 |
| Model error in pricing | Finance | Medium | ▲ 0 |
| Key staff loss | People | Medium | ▼ 1 |
Authority, objectives and acceptable exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Risks that cross departments, sectors or jurisdictions often have no single owner. Each unit manages its share, and the combined exposure, which sits between them, is reported by nobody.
An appetite statement written in qualitative terms cannot be checked against exposure. Without tolerances tied to indicators, breaches are noticed late or argued away.
Reporting cycles reward attention to near-term, familiar risks. Slow-building and low-frequency risks, such as dependency concentration or climate exposure, receive less scrutiny until they materialise.
Independent risk functions and non-executive members lose influence when information is filtered, incentives align with growth, or dissent is costly. Governance then confirms decisions rather than testing them.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Risk tolerance | The acceptable variation in performance around a specific objective or measure, which makes an appetite statement checkable. |
| Risk owner | The person or entity with the accountability and authority to manage a risk. |
| Escalation | The defined route and timing by which a breach of tolerance is reported to a higher level of authority. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Risks with a named owner | percent of register entries | quarterly | Risk register | REPORTED |
| Exposure against tolerance | ratio of measured exposure to stated tolerance | per reporting cycle | Risk reporting to the board or cabinet | REPORTED |
| Tolerance breaches escalated on time | percent of breaches escalated within the defined period | quarterly | Escalation logs | REPORTED |
| Cross-cutting risks with joint ownership | count of risks with a cross-unit owner | annual | Risk governance charters | DECLARED |
| Board time on principal risks | share of agenda time | annual | Board minutes and committee records | REPORTED |
| Open audit findings on risk governance | count by age band | quarterly | Internal audit tracking | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ISO 31000 and its handbook | Principles and framework language for governance, roles and integration | Licensed standard, purchase required |
| COSO Enterprise Risk Management framework | Components and principles on governance, culture and appetite | Licensed publication, purchase required |
| OECD Recommendation on the Governance of Critical Risks and its implementation reports | Country practice on national risk governance and coordination | Public, OECD terms of use |
| Published annual reports and principal risk disclosures | How organizations describe their risks, appetite and governance | Public records, terms per publisher |
| National audit office reports on risk management in government | Independent findings on how public bodies govern risk | Public records, licence per office (to check) |
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and risk committees | What level of each principal risk the organization accepts, and when a breach triggers action | Appetite templates; exposure against tolerance; ownership gaps |
| Cabinet offices and centres of government | Who coordinates national risks that cross ministries | Ownership maps of cross-cutting risks; peer country governance practice |
| Supervisors and regulators | Whether a regulated entity's risk governance is adequate for its exposures | Governance reviews against named principles; escalation records |
| Internal audit functions | Which risk governance processes to examine next | Open findings; areas with weak ownership or untested tolerances |
Post-event reviews of major failures repeatedly find that warning signs existed inside the organization. The failure was not a lack of information but of authority, incentives and channels that would have carried that information to someone able and willing to act.
Risks that cross departments or organizations have no single owner, so no one is accountable when they materialize.
Rewards for near-term performance can favour risks whose costs arrive later or fall on others.
Bad news is softened as it moves upward, so leaders see a calmer picture than staff do.
Statements of appetite translated into tolerances and limits for specific risk types. They work best where risks can be measured and worst for novel or shared risks.
Separation of risk-taking, risk oversight and independent assurance. The model clarifies roles but can encourage box-ticking if not used thoughtfully.
Decision analysis under uncertainty makes trade-offs and values explicit. It depends on honest elicitation of preferences.
Post-event and periodic reviews test whether governance worked as designed. They are only as useful as the willingness to act on them.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.