Governance and Risk Management
Governance and Risk Management tests how security is directed and financed at the top of the organisation, and whether risk is managed as a documented, owned, repeatable process. Questions usually probe the split between accountability and responsibility, the meaning of risk appetite, and how a risk register becomes a decision.
Governance architecture
- The board or equivalent owns oversight; a named executive is accountable; the security function is responsible for delivery. Accountability cannot be delegated away.
- A cross-functional security steering committee (operations, IT, legal, HR, procurement, finance, security) sets priorities, approves treatment and resolves conflicts between service levels and control.
- Policy hierarchy: policy, standards, procedures, work instructions, records. Higher documents are stable; lower ones change often.
- Risk appetite states how much risk the organisation will accept in pursuit of objectives; risk tolerance sets numeric thresholds. Without them, every security request becomes a personal opinion.
- Three lines model: operations own the risk; risk, compliance and security functions monitor it; internal audit provides independent assurance.
Risk management core
- ISO 31000 sequence: establish scope and context, identify, analyse, evaluate, treat, monitor and review, with communication and consultation throughout.
- Risk is a function of threat, vulnerability and consequence. Distinguish inherent risk before controls from residual risk after them.
- Treatment options: avoid, reduce, transfer, accept. Transfer by insurance or contract does not remove operational exposure.
- Every register line needs an owner, a rating method, a treatment plan, a due date and a review date.
Contractual governance
Flow obligations down the chain: required standards, right to audit, incident notification windows, subcontractor approval and termination for non-compliance. Procurement signatures are governance events, not paperwork.
Worked example
A carrier reports a 400,000 loss at a hub. History shows one such loss every two years, so annualised loss expectancy is roughly 200,000. Escorted transport costs 90,000 a year and is estimated to cut frequency by 70%, leaving about 60,000 expected loss - 150,000 total against a 200,000 baseline, a saving near 50,000. The recommendation is escort, provided the frequency data is trustworthy. If the CFO prefers to accept the risk, record the acceptance, the amount, the authority and the review date.
Traps
A register with no owners or review dates; treating insurance as a control; undocumented risk acceptance; confusing enterprise risk with physical security risk; and governance documents that nobody operates against.