Governance and Risk Management
Board oversight, risk appetite, and the three lines
Governance is the system by which the board and management direct and control the organization. In healthcare, the audit committee oversees financial reporting and internal audit, the compliance committee oversees the compliance program, and the quality committee oversees clinical outcomes. Candidates should be able to trace where a risk issue is escalated, who owns the response, and what evidence demonstrates board engagement.
Enterprise risk management, per the COSO framework, has five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting. Questions often test the distinction between risk appetite (the amount of risk the organization is willing to accept in pursuit of strategy) and risk tolerance (the measurable variance permitted around a specific objective). A risk register records risks with owners, likelihood, impact, and mitigation; a heat map visualizes the same data.
The Three Lines Model: the first line is operational management, which owns and manages risk; the second line is risk, compliance, quality, and finance functions, which provide expertise, monitoring, and challenge; the third line is internal audit, which provides independent assurance to the board. A frequent trap is placing internal audit in the second line or describing it as management oversight. Another is confusing risk appetite with a risk statement or a mission statement.
Worked example: leadership states low tolerance for billing errors. Translating appetite into tolerance means setting a threshold such as a coding error rate below two percent, with monthly measurement and a defined escalation trigger. A statement with no measurable threshold is not a tolerance.