Risk, oversight and decision-making
What the exam tests
You must explain how the governing body oversees risk and makes or supports decisions under uncertainty. The focus is oversight and decision quality, not technical risk-register maintenance.
Core rules
- Risk is the effect of uncertainty on objectives. It includes opportunity as well as threat.
- The governing body sets risk appetite or tolerance, ensures risk information reaches decision-makers, and challenges whether risk is being accepted knowingly.
- Oversight means asking about exposure, likelihood, impact, controls, owners and escalation-not managing every risk itself.
- Decision-making should use timely, relevant information, documented rationale, clear authority and consideration of stakeholder and ethical impacts.
- Risk management is integrated into strategy and performance, not a separate register exercise.
- Escalation criteria should make clear which risks must reach the governing body.
Worked example
A board considers entering a new market. Management presents only the revenue case. Reasoning: the board should require downside scenarios, legal and reputational risk, risk appetite fit, mitigation owners and a stop/go trigger. If the board approves without these, it has not overseen risk; it has merely endorsed optimism.
Traps
Treating risk as only financial or only negative; accepting a risk register as evidence of oversight; leaving risk appetite vague; making decisions without recorded rationale; allowing groupthink or unchallenged management assumptions.