Risk Context, Governance and the Risk Management Framework
Context and governance
Risk context has external elements (market, regulatory, political, economic, technological, environmental) and internal elements (objectives, culture, capability, stakeholders, constraints). Establishing context sets the scope, boundaries and criteria against which risks will be assessed. Governance defines who owns risk, who decides, who escalates, and how risk is reported. A risk management framework typically includes: policy and objectives, accountabilities (risk owner, risk actionee), processes, communication and consultation, and monitoring and review.
Roles
- Risk owner – accountable for managing a specific risk and its response (not the same as the project manager).
- Risk actionee – carries out the response action; can be delegated.
- Sponsor/board – sets appetite and tolerance and receives escalations.
- Risk champion/facilitator – supports the process, not the decision.
Escalation and thresholds
Risks exceeding tolerance are escalated; those within tolerance are managed at the appropriate level. Governance also covers the risk management plan (approach, methodology, roles, budget, timing, reporting formats) and the risk register (the live record of identified risks, owners, assessments and responses).
Traps
- Assuming the project manager is automatically the risk owner for every risk.
- Confusing the risk management plan (how risk will be managed) with the risk register (the risks themselves).
- Ignoring external context when assessing exposure.
Worked example
A regulatory change increases compliance exposure beyond the sponsor's stated tolerance. Governance requires the risk to be recorded, assessed, and escalated to the sponsor with a recommended response; the project manager cannot simply accept it alone.
Rule of thumb
Every significant risk must have a named owner with authority to act; no owner, no control.