Building an enterprise risk framework the board actually uses

Most organisations we assess have a risk register. Considerably fewer have enterprise risk management. The distinction is practical: a register lists risks; a framework changes decisions.

Here is what separates the two.

Define appetite in numbers the business recognises

"We have a low appetite for regulatory risk" is not an appetite statement — it constrains nothing. A usable statement is quantified and bounded: the maximum acceptable single-customer credit concentration, the tolerable unplanned downtime for a core platform per quarter, the loss level at which a product line is reviewed, the currency exposure permitted before hedging is mandatory.

Once appetite is numeric, breaches become observable events with defined responses rather than matters of interpretation.

Quantify exposure rather than colouring it

Heat maps compress judgement into three colours and hide the reasoning. Where possible, express material risks as a range of financial impact against a likelihood, with the assumptions stated. Even rough quantification forces the underlying discussion: what exactly happens, over what period, and who absorbs it.

For a small number of severe risks, run scenarios rather than point estimates — a currency movement of a given size, the loss of the largest customer, a two-week outage of a core system, a regulatory sanction of a stated magnitude. Scenarios reveal correlations that registers hide.

Assign risks to people, not to departments

A risk owned by "Operations" is unowned. Each material risk needs a named executive accountable for the control environment, the monitoring indicators and the escalation. Where a risk crosses functions, split it into components with distinct owners rather than assigning joint accountability.

Choose indicators that move before the event

Lagging indicators tell you what happened. Leading indicators give you time. For each material risk, select two or three metrics that shift ahead of loss: staff turnover in a critical team, aged unresolved system alerts, growth in exception approvals, delays in regulatory submissions, concentration creeping toward a threshold.

Set trigger levels in advance and specify the action that occurs when a level is reached. An indicator without a defined response is a chart.

Make escalation unambiguous

Define, in writing, what must reach the executive committee within a week, what must reach the board committee, and what may be handled locally. Ambiguity here is why bad news travels slowly. Include a route that bypasses the line manager where the manager is implicated.

Integrate risk into decisions, not into a meeting

Risk management becomes real when it is embedded in the processes where commitments are made: capital approvals include a risk assessment; new products pass a defined approval gate; material contracts are reviewed against appetite; strategic plans state the risks accepted to achieve them.

Where risk is discussed only in the quarterly risk meeting, it is a reporting exercise regardless of the quality of the documentation.

Assurance should be mapped, not duplicated

Map each material risk against the three lines: who manages it, who oversees it, and who independently assures it. The map typically reveals both duplication — several functions reviewing the same well-controlled area — and gaps, usually in emerging areas such as third-party dependency, data protection and technology change.

Report to the board in one page

An effective board risk report contains: risks outside appetite and the action being taken; movement in the top exposures since the last meeting; indicator breaches; emerging risks not yet in the register; and overdue mitigation actions with owners. Everything else is an appendix.

A twelve-week starting point

Weeks 1–3: interview executives and rebuild the risk inventory from strategy and process, not from the previous register. Weeks 4–6: quantify the top ten exposures and draft appetite statements. Weeks 7–9: assign owners, define indicators and triggers, and map assurance. Weeks 10–12: redesign reporting and run the first cycle through an actual decision.

The output is modest in volume — a set of appetite statements, ten quantified exposures with owners, an indicator set and a one-page report format. Its usefulness comes from being short enough to be used.

Our risk, compliance and governance practice supports enterprise risk framework design, compliance programmes, governance reviews and board effectiveness work.