Boards are not expected to manage risk day to day. They are expected to make sure that someone does, and that the organisation is taking the risks it has chosen to take and no others. That oversight role is easier said than done. Risk reports can be long, technical and backwards-looking, and directors can come away feeling informed but not reassured.
The five questions below are designed for directors, trustees and members of audit and risk committees. They work for a bank, a university, a SACCO or an NGO, and they help turn a risk report into a real conversation.
1. What are our top risks, and how do they connect to our strategy?
A risk register with seventy items is a compliance document. A board needs the handful of risks that could stop the organisation achieving its strategy. Ask management to link each top risk to a strategic objective and to explain what would happen if it materialised. If a risk cannot be linked to the strategy, ask why it is on the list. If a strategic objective has no associated risks, ask whether anyone has thought hard enough about it.
2. What is our risk appetite, and are we operating within it?
Risk appetite is the amount and type of risk the organisation is willing to accept in pursuit of its objectives. It should be set by the board and expressed in terms people can use, for example limits on credit concentration, tolerance for service interruption or zero tolerance for fraud and safeguarding breaches. It is then monitored through key risk indicators. If the board has never discussed appetite, management is guessing on its behalf.
3. How do we know our controls work?
Policies describe what should happen. Controls make it happen. Boards need assurance that the key controls operate in practice. Many organisations use the “three lines” model: operational managers own and manage risk, risk and compliance functions provide oversight and challenge, and internal audit provides independent assurance.
Ask which of your top risks have been independently tested, when and with what result. Ask also whether internal audit has the independence, resources and direct access to the audit committee that it needs to do its job.
4. What emerging risks are we watching?
Today’s risk register is a picture of yesterday’s concerns. Climate-related risks, cyber security, regulatory change, data protection, supply chain disruption and reputational exposure through social media are examples of risks that can move from the background to the boardroom quickly. Ask management how emerging risks are identified, who is responsible for watching them and what triggers escalation to the board.
5. How quickly would we hear bad news?
In organisations where bad news travels slowly, small problems become crises. Test the escalation routes. Is there a clear incident-reporting process? Are whistleblowing channels trusted and independent of the people they might concern? How many reports were received last year and what happened to them? A very low number may signal good conduct, or it may signal that people do not trust the system.
Making the answers usable
A good risk register records, for each risk, an owner, a description of cause and consequence, an assessment of likelihood and impact, existing controls, further actions with dates and key risk indicators. It is reviewed on a set cadence, with changes explained rather than silently updated.
The board itself should see a concise dashboard rather than the full register: the top risks, movements since the last meeting, indicators that are outside tolerance and overdue actions, in one or two pages.
|
Board paper element |
What good looks like |
|
Top risks |
Five to ten risks, each linked to a strategic objective and a named owner |
|
Movement |
Clear indication of which risks have increased, decreased or are new since the last meeting |
|
Indicators |
Key risk indicators shown against agreed tolerances, with exceptions explained |
|
Actions |
Overdue actions highlighted, with revised dates and reasons |
|
Assurance |
Summary of recent audit, review or testing results on the key controls |
A practical annual calendar for the board
Risk oversight works best when it follows a predictable rhythm rather than being triggered by incidents. A simple calendar is enough to start:
- Review the risk dashboard, key risk indicators and overdue actions at the audit and risk committee, with a short report to the full board.
- Twice a year. Receive internal audit’s summary of control testing and track the closure of audit findings.
- Confirm risk appetite, review the top risks against the refreshed strategy and test the incident-response and business-continuity plans.
Internal control reviews and compliance mapping
Periodic internal control reviews, focused on the processes where risk is highest, such as procurement, payments, payroll or data management, help boards see whether controls are well designed and working. Compliance mapping, which lists the laws, regulations and contractual obligations that apply and who is responsible for each, supports directors who must satisfy themselves that obligations are being met, including those under the Data Protection Act, tax laws and sector regulations.
How Melanel can help
Melanel’s governance and risk advisory covers governance assessments, preparation of risk registers, internal control reviews, compliance advisory and board governance support. We work with boards and executive teams to design risk reporting that is short, honest and useful, and to build the internal capacity to keep it that way.
