What Does "Enough" Risk Governance Look Like?

Discussions about improving risk governance may conclude, perhaps too quickly, that the answer is a more capable system. At the top of that ladder sits enterprise risk management, presented as the mature destination every serious organisation should aspire to. But first, it is perhaps worth asking a simpler question.

What does enough risk governance actually look like?

Most risk governance arrangements start life with good intentions. After all, organisations want better visibility of its risks, clearer accountability, and confidence that significant threats are being identified, understood, and managed. So the framework is developed, governance arrangements are defined, the registers are put in place, and risk reporting resumes.

At first the benefits are obvious. Information that was previously fragmented becomes more visible, risks that were once local concerns become organisational discussions, and leaders gain greater confidence that they understand the exposures their organisations face.

Then a subtle shift begins. A new report is introduced to provide greater assurance, a review stage is added to strengthen oversight, further categories are created to improve analysis, escalation processes become more formal, and governance forums become more structured. None of these is unreasonable; in isolation, indeed they may appear eminently sensible. The problem is that they accumulate.

Over time, risk governance tends to evolve towards greater sophistication. More information is collected, more process is introduced, and more effort is required to maintain the system. At first this looks like maturity, but something else may be happening as the effort to sustain the model outpaces the perceived value it provides.

Managers start to spend more time maintaining risk information than using it. Risk reviews become focused on updating records rather than discussing uncertainty. Risk ownership becomes an administrative responsibility rather than a management discipline. The registers remain active, but engagement starts to decay.

Risk is not always taken seriously until something serious is missed. A foreseeable risk that goes unseen, or is ignored, or simply is not acted upon materialises, with reputational damage as the result. This is the point at which organisations tend to misdiagnose the problem. The instinct after a very public failure is to be seen to act, and the most visible response is sometimes technology: registers found too limiting, reporting found to be insufficient, or workflows found to be inadequate.

The conclusion follows that a more capable platform is the answer. And that conclusion may point towards enterprise risk management, with the cost, procurement, implementation, maintenance, and supplier dependency that it carries, to be adopted in the belief that it will provide the capability perceived to be missing.

But perceived technology deficit alone does not explain what more likely happened. Risk registers don’t become stale just for want of function or connection. They became stale because the organisation gradually stopped treating them as a tool to support strategic decision-making.  

People maintain information when they need it and they stop when it becomes more of a chore, or obligation without perceived benefit. Bigger platforms alone do not change that, indeed they can deepen it, because now there is more to maintain to feed the same decisions.

This is why risk registers lapse, often in remarkably similar ways. Over time, through neglect and disuse. The risks are still open, the scores are still visible, but the updates increasingly lack insight or weight, until risk registers survive largely because governance processes require them to.

The irony is difficult to ignore. The pursuit of stronger governance can inadvertently create arrangements that are harder to sustain. More oversight creates more administration, more administration reduces engagement, reduced engagement degrades the quality of information, and degraded information weakens the governance it was designed to support.

Which returns us to the question: what does enough risk governance look like?

Principally two things sit behind that question. First is the governance discipline itself: keeping risk information current, ownership clear, significant risks visible, and leaders using the information to inform good decision making. The second is the overheads that attend the system that supports it: procurement, ongoing costs, implementation effort, added administration, and supplier dependency. Governance sufficiency is measured by the first. Relative value is measured by the relationship between the two: how much improved governance those additional overheads actually return.

Seen in that context, enhanced capability is not an enemy. Systems that do more are welcome, particularly where they elevate function and visibility whilst lowering the cost of keeping risk information current. What no system delivers though is the discipline to continue using it. Risk registers stay alive because people rely on them, not because of the containers that were bought to host them.

So enough, a sufficiency, is not defined by framework sophistication, the number of governance forums, or platform capability. Enough is reached when risk information is always current, ownership is always clear, significant risks always remain visible, and leaders rely on that information to inform decisions, at a level of effort the organisation can carry year on year. Beyond that, additional capability may not strengthen governance at all. It may simply add to the burden that has to be sustained.

The most effective arrangements, then, may not be those that capture the greatest amount of information, or run on the most capable platform. They may be the ones an organisation can realistically sustain, without losing the focus, ownership, and discipline upon which enduring risk governance ultimately depends. For many organisations, enough is, perhaps, less than they would be sold.