Governance, Risk Management, and Control: The Three Domains in One Frame
Governance
Governance is the set of processes by which the board directs, oversees, and holds management accountable: setting strategy and risk appetite, establishing tone at the top, approving the code of conduct, enabling whistleblowing channels, and delegating authority clearly. The Three Lines Model places operational management as the first line owning and managing risk, risk and compliance functions as the second line providing expertise, monitoring, and challenge, and internal audit as the third line giving independent assurance to the governing body. External audit sits outside this structure.
Risk
Risk is the effect of uncertainty on objectives, commonly scored as likelihood times impact. Inherent risk exists before controls; residual risk remains after controls operate. Risk appetite is the amount of risk the organization is willing to accept; risk tolerance is acceptable variation around that appetite. COSO ERM broadens internal control to strategy, risk appetite, and a portfolio view across the enterprise.
Control
COSO's five components are control environment (the foundation: integrity, board oversight, competence), risk assessment, control activities, information and communication, and monitoring activities. Controls may be preventive, detective, corrective, or directive; manual or automated; hard or soft. Segregation of duties is a preventive control; reconciliation is detective.
Traps and rule of thumb
Traps: residual risk is never zero; a weak control environment undermines every other component; monitoring includes both ongoing and separate evaluations, and internal audit assurance is a separate evaluation. Rule of thumb: to judge any control ask three questions - which risk does it address, does it operate as designed, and who reviews its output?