A risk framework is an architectural structure linking institutional objectives to exposures, control responses, operational owners, and verifiable evidence.
Establishing this architecture enables South African public institutions and corporate bodies to connect strategic goals directly to routine operational oversight.
Linking institutional objectives to risk exposures and framework architecture
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Building a robust risk framework requires connecting organisational objectives directly to identified risk exposures and management responses. Governing bodies and executive management establish strategic goals across service delivery, financial stewardship, and statutory compliance.
Risks represent uncertainty surrounding the achievement of these objectives. An effective risk architecture avoids viewing risks as standalone items in a static register, structuring each exposure around its root operational drivers and potential impacts.
Under global internal audit standards, the chief audit executive must develop a thorough understanding of how the organisation identifies exposures and selects control processes. Historical public sector guidance similarly emphasises that controls must be evaluated against established risk levels to determine their suitability.
This architectural alignment makes the relationship between exposure and response reviewable; it also exposes unaddressed risks and explicitly accepted residual exposure. The framework functions as an operational blueprint rather than a maturity rating scheme.
Delineating management control ownership from internal audit oversight
A foundational principle of risk architecture is maintaining a clear division between management control ownership and internal audit oversight. Operational line managers hold primary responsibility for operating internal control systems and managing routine risks.
Management designs, implements, and maintains control activities to reduce risk exposures to acceptable levels. Line management retains full ownership of operational controls regardless of external or internal reviews.
The internal audit function evaluates governance, risk management, and control processes to inform its audit strategy and deliver objective assurance. Internal auditors do not possess management design authority or assume operational control duties.
Standard 9.1 mandates that internal auditors understand risk and control processes to prioritise audit coverage, not to dictate operational management choices. Preserving this functional boundary protects auditor objectivity and enforces management accountability.
Constructing the verifiable evidence chain across operational workflows
To move beyond paper-based risk registers, a risk framework must map a verifiable evidence chain demonstrating that controls operate in daily practice. Identify the evidence available for each activity and the implications of missing records. Some controls may be assessed through observation or re-performance; a blank evidence field is a limitation to investigate, not an automatic finding of failure.
Control activities comprise directive, preventive, detective, and corrective mechanisms. It is crucial to recognise that the absence of a written policy or automated software lock does not automatically signal control failure. Unwritten or manual practices may still provide effective risk mitigation if supported by reliable evidence.
Evidence chains link control execution directly to underlying transaction records, supervisory review logs, or reconciliation sheets. Maintaining verifiable audit trails enables management to monitor operational performance and allows auditors to evaluate control effectiveness.
To ensure risk architecture remains operationalised across business units, management should establish several key practical framework routines:
- Map specific controls directly to named position titles responsible for execution.
- Define explicit physical or digital evidence references generated during routine work.
- Integrate preventive authorisation limits with detective reconciliations for balanced coverage.
- Establish formal review schedules to verify that evidence files remain current.
Establishing review mechanisms, escalation pathways, and ongoing monitoring
A static risk register provides little protection against evolving operational threats unless supported by active review and escalation pathways. Executive leadership must establish ongoing monitoring mechanisms to verify that controls continue operating as intended.
Supervisory reviews, routine reconciliations, and periodic operational reports provide continuous feedback on control adequacy. When monitoring identifies control breakdowns or emerging exposures, established escalation protocols ensure that concerns reach senior leadership promptly.
Escalation mechanisms allow executive management and audit committees to evaluate unmitigated risks and allocate corrective resources effectively. Internal audit uses risk and control information to update its risk-based audit plan and focus testing on high-exposure areas.
When internal audit identifies significant control weaknesses during evaluations, management must formulate corrective action plans to restore control integrity. Internal audit follows its risk-based methodology to confirm implementation and record unresolved actions or accepted exposure.
Annotated four-column risk architecture matrix
The four-column matrix below illustrates a practical risk architecture artefact, mapping qualitative hypothetical risk exposures against management controls, designated operational owners, and verifiable evidence.
| Architecture link | Exposure and response | Accountable relationship | Evidence and review decision |
|---|---|---|---|
| Objective to exposure | A service objective depends on a critical supplier; identify the dependency and consequence before choosing a response. | The objective owner validates the exposure with the contract owner. | Link the objective, dependency record and risk entry; record disputed assumptions. |
| Exposure to controls | A reporting risk is addressed by preparation, reconciliation and review activities that may sit in different teams. | Each control has an operating owner; the risk owner considers whether the combined response is adequate. | Link the control descriptions and retained evidence; identify gaps rather than invent an assurance rating. |
| Controls to residual exposure | Evidence indicates that a proposed response has only partly operated within the reviewed period. | Management decides the response within actual approval and escalation arrangements. | Record what was examined, its period, the limitation and the resulting action or authorised risk acceptance. |
| Change to review | A system or service change may invalidate an existing assumption or evidence link. | The change owner notifies the relevant risk and control owners. | Version the affected links and record the review decision; earlier evidence is not automatically current. |
The matrix is a qualitative illustration of relationships, not a report of an actual institution. Give each objective, exposure, control and evidence record a stable reference in the institution's own system. A shared control can address several exposures, so its reference should be reused rather than copied into contradictory descriptions. This is a way to maintain lineage, not a prescribed software architecture.
When a link changes, record the reason and its effect on the chain. A different control owner may require an updated evidence location, review responsibility or escalation route. An expired evidence record does not justify silently retaining an earlier conclusion. The reviewer should be able to trace which version informed each management decision.
Sources
- Historical Treasury guidance, second edition March2009 — National Treasury
- IIA2024 standards issued2024-01-09 effective2025-01-09 — Institute of Internal Auditors
Frequently Asked Questions
Does a risk framework prescribe numerical risk appetite thresholds or statutory compliance ratings?
This proposed architecture does not prescribe a numerical scale. The institution must identify its applicable requirements and approved appetite arrangements rather than infer a rating from this example.
Who holds ultimate responsibility for designing and operating internal controls?
Line management holds primary operational ownership for designing and operating internal controls, whereas internal audit evaluates process effectiveness to inform audit strategy.
How do the 2024 Global Internal Audit Standards approach risk processes compared to 2009 Treasury guidance?
The 2024 Standards establish current global mandatory requirements under Standard 9.1 for understanding risk processes, while the 2009 Treasury Framework provides historical public sector context under PFMA guidance.
What distinguishes mandatory standard requirements from advisory implementation guidance?
Under the Global Internal Audit Standards, mandatory requirements use the term "must" to specify unconditional obligations, whereas implementation considerations use "should" or "may" to present non-mandatory advice.
Does the absence of a formal written policy automatically indicate a control failure?
A missing document does not, by itself, prove that a control never operated. Evaluate operation and separately assess any applicable documentation requirement; a functioning informal control does not excuse a binding policy obligation.
For wider context, read the enterprise and strategic risk overview.