Govern
Who leads, what the organisation values, and who is allowed to do what. 5 components, chapter 15 of the book.
Purpose and principles
A written statement, approved by the governing body, that risk management exists to create and protect value. The risk management system is evaluated at least annually against the eight principles (integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, continual improvement), with evidence recorded per principle.
Source: ISO 31000:2018 clause 4 [1]
Governance and culture
The governing body oversees risk and its oversight is recorded. Culture is defined, measured in eight aspects on a stated cycle, and reported on the same page as risk and performance.
Source: COSO ERM component 1, principles 1 to 5 and 20 [2]; IRM Risk Culture, eight aspects [6]; Orange Book principle A [4]
Three lines and prohibitions
Management owns risks and controls; independent functions oversee; internal audit assures; a governing body is named as accountable for all three. Three prohibitions are written into policy: internal audit does not set appetite, does not choose responses, does not own policies. Whoever designed a control does not assure it for twelve months.
Source: IIA Global Internal Audit Standards 2024 and statements of position, July 2026 [18]
Govern first
Governance is a function with outcomes of its own, each with a current and a target state: context, risk strategy, roles, policy, oversight, supply chain. Appetite and tolerance statements are governance outcomes. Positive risks are characterized and decided in the same forum as threats.
Source: NIST CSF 2.0, Govern function, GV.RM-02 and GV.RM-07 [23]
Risk leadership
Every decision informed by a risk analysis names its decision authority, who is accountable for the decision; the analyst is accountable for the analysis. Decision authorities are named per tier. No decision is recorded without a named decider.
Source: NASA Risk Management Handbook v2.0, risk leadership and RIDM [11]