Risk governance for regulated sectors

By Ari Magalhaes FGIA GAICD, Founder and Principal - OmniStrategic

Risk governance connects organisational strategy to the risks accepted in pursuing it and the oversight required. Advice draws on economics and board and committee chair experience.

Risk appetite drives decisions across the whole organisation. It shapes what the board approves, and it also shapes how executives allocate budgets, how managers price services and how frontline teams escalate problems. Ari works with boards and executives to set appetite for each category of risk, connect it to strategy and the financial plan, and cascade it into delegations, policies and reporting so people use it day to day. The free Risk Appetite Toolkit sets out the method.

Assessment examines how risk is identified, reported and acted on across the organisation. The free Risk Management Maturity assessment provides an initial view of current practices.

The risk framework connects to the budget and funding outlook, including any growth or turnaround program. Reporting makes exposures and their implications for delivery visible to directors and management.

Common questions

What should happen when a tolerance is exceeded?

Follow the agreed escalation process, identify the cause and assess the effect on strategic objectives. Record the response and accountable owner, including any decision requiring board approval.

When should risk tolerances be revisited?

Revisit tolerances when strategy or operating conditions change materially, and during scheduled reviews. Test whether current thresholds still provide useful warning and support timely decisions.

How long does a risk appetite engagement take?

Usually four to eight weeks, depending on how many workshops the board wants.