Structure for shared decisions
Federating risk decisions does not mean leaving each team to work out its own approach. A program needs a framework that defines roles and responsibilities, sets up governance and decision-making, and provides policies and guidelines for working together.
The framework should fit the organization's needs and culture. Seven components make it up.
| Component | What to settle |
|---|---|
| Risk ownership and accountability | Who owns which risks, whether they understand the role, and how issues are communicated and escalated |
| Governance structure | Executive sponsorship, a steering committee and working groups that provide oversight and keep the program aligned with the organization's objectives |
| Risk assessment methodology | One standard way to identify, analyze, evaluate, prioritize and treat risk, flexible enough for different units |
| Risk appetite and tolerance | How much risk the organization is willing to accept, stated clearly and understood by everyone making decisions |
| Communication and collaboration channels | Regular meetings, workshops and shared platforms for exchanging information and good practice |
| Metrics and reporting | Indicators of whether the program is working, and a regular cadence for reporting them |
| Integration with existing processes | How the program connects with incident response, business continuity and compliance management |
Ownership comes first
Everything else rests on clear ownership. Each resource has an owner who is responsible for its risk decisions and knows it. Lines of communication and escalation are defined, so a team knows where to turn when a decision is beyond it.
Appetite and tolerance guide the decisions
Teams making their own risk decisions need to know what the organization considers acceptable. A stated risk appetite and tolerance gives them that guide. It also gives leadership confidence that decisions made across the organization are consistent with it.
Consistency and flexibility
The hard part is balance. Without a common structure, each unit adopts its own approach and the results cannot be compared. With too rigid a structure, units with different needs cannot use it.
The aim is a single method and a single set of expectations, with room for a unit to reflect its own circumstances.
Connect to what already exists
The program should strengthen what the organization already does. Connecting it to incident response, business continuity planning and compliance management avoids duplicated effort.
The risk assessment methodology is the largest piece of this framework. Defining the Operating Model covers it in detail.