Enterprise risk management is useful when it helps leaders decide what to do about uncertainty affecting their objectives.
For governing bodies and executives, we recommend linking each material exposure to a decision, an accountable owner and evidence about current controls. The objective-to-decision matrix below is a proposed working tool for making those links explicit.
Aligning international guidance with institutional decision-making
ISO’s 2018 explanatory brochure describes integrating risk-based decisions into governance, planning, management and reporting. It also states that ISO 31000 is guidance and is not intended for certification. The matrix and reflection prompts below are our proposed practice, not ISO-prescribed templates.
To move beyond static risk registers, we propose structuring risk evaluations around concrete decisions rather than passive listings. A decision-focused framework establishes clear operational context by defining ten proposed elements:
- Strategic Objective: The primary organisational goal being pursued.
- Uncertainty: The potential events or changing conditions that could alter outcomes.
- Consequence: The plausible operational or institutional impacts if the uncertainty materialises.
- Risk Owner: The executive accountable for managing the overarching exposure.
- Current Controls: Existing measures and protocols designed to modify risk.
- Control Evidence: Records and observations used to assess whether controls operate.
- Response Options: Practicable management choices to accept, mitigate, or redirect activity.
- Decision Authority: The designated leader or committee with rights to authorise choices.
- Escalation Trigger: Predefined thresholds requiring escalation under the organisation’s approved arrangements.
- Review Date: Scheduled intervals to refresh context, assumptions, and evidence.
Crucially, organisations must separate inherent exposure (the underlying uncertainty of an activity) from control weakness (the failure or absence of protective mechanisms). Furthermore, clear governance requires distinguishing key roles: the risk owner holds overarching accountability for the objective, the action owner is responsible for executing specific response options, and the evidence reviewer reviews the evidence of control operation.
Connecting strategic objectives to operational decisions
We recommend an objective-to-decision matrix. The entries below are hypothetical illustrations. Confirm the decision authority, escalation thresholds and review frequency against the organisation’s actual governance arrangements; the role titles do not assign legal authority.
| Strategic Objective | Uncertainty & Consequence | Key Decision & Authority | Response Options & Escalation Trigger | Control Evidence & Review Mechanism |
|---|---|---|---|---|
| Expand digital service delivery across regional hubs. | Infrastructure instability leading to service outages and public dissatisfaction. | Proceed with deployment or defer pending capacity testing. Authority: Chief Executive Officer. | Consider a phased rollout, temporary resource allocation, or vendor intervention. Trigger: Unresolved network latency exceeding agreed targets. | Technical load testing reports and third-party uptime logs. Mechanism: Monthly executive committee review, reviewed by the designated evidence reviewer. |
| Modernise core technology infrastructure. | Implementation delays causing budget overruns and operational disruption. | Implement additional operational controls or reallocate capital budget. Authority: Investment Committee. | Consider re-scoping project deliverable phases or procuring external specialist support. Trigger: Delay exceeding the project’s agreed escalation threshold. | Independent project assurance audits and milestone completion sign-offs. Mechanism: Fortnightly steering committee review, verified by independent project assurance lead. |
| Maintain regulatory compliance and data privacy standards. | Unintentional data breach resulting in reputational harm and regulatory penalties. | Authorise additional security monitoring tools or restrict external data access. Authority: Chief Information Officer. | Consider mandating access restrictions, accelerating patch deployment, or escalating to the board. Trigger: Critical vulnerability identified in core systems. | Automated vulnerability scan logs and quarterly internal control assessment reports. Mechanism: Quarterly risk and audit sub-committee review, verified by internal audit. |
| Ensure supply chain continuity for critical operations. | Vendor insolvency disrupting operational delivery and service agreements. | Terminate vendor contract, switch to secondary supplier, or absorb cost increase. Authority: Chief Operating Officer. | Consider activating alternative supplier agreements or renegotiating contract terms. Trigger: Financial distress indicators detected in key vendor assessments. | Vendor financial health assessments and contract performance metrics. Mechanism: Periodic procurement committee review, verified by financial risk analyst. |
Navigating interconnected risks in operational context
To understand how operational uncertainties compound into broader strategic impacts, consider the following illustrative/hypothetical scenario.
A public institution sets a strategic objective to automate its core service delivery. During implementation, unexpected legacy software incompatibilities emerge (an operational uncertainty). Unaddressed, this delay strains system capacity, forcing staff to adopt manual workarounds. In this scenario, the manual workarounds increase error rates in customer records, leading to widespread public dissatisfaction and legal challenges. In this hypothetical situation, an initial localised technical vulnerability cascaded into systemic operational and strategic disruption.
When evaluating such interconnected risks, tools like heat maps can inform prioritisation. However, executive leadership should view heat maps strictly as visual communication tools accompanied by explicit descriptions of underlying assumptions, dependencies, and plausible impacts, rather than as precise probability calculations. Decision-makers must rely on human judgement, explicit trade-offs, and empirical evidence when weighing strategic options under uncertainty.
Prompts for executive reflection and maturity discussion
Governing bodies, executive leadership, and assurance functions in South Africa can consider the following open-ended prompts to guide internal discussion and maturity reflection. These questions are proposed strictly as qualitative prompts for executive dialogue, not as a formal benchmark, scoring grid, or validated audit metric:
- Objective-Centric Focus: To what extent are our risk management evaluations structured around strategic objectives and concrete operational decisions, rather than static lists of risks?
- Quality of Evidence: What verifiable empirical evidence do we require before concluding that critical controls are operating effectively in practice?
- Role Clarity: Are the distinctions between risk owners (accountable for strategic context), action owners (executing responses), and evidence reviewers (verifying control performance) clearly defined across key operations?
- Assurance Independence: How clearly is the boundary maintained between management’s operational ownership of risk and internal audit’s independent assurance remit?
- Escalation Triggers: Do operational teams have clear, explicit thresholds that trigger mandatory escalation to executive leadership and governing bodies?
Frequently Asked Questions
How should organisations treat heat map scoring when evaluating risk severity?
Heat maps are useful visual tools to inform prioritisation, but their scores should not be treated as precise mathematical calculations of probability. Organisations should ensure heat map placements are always accompanied by detailed descriptions of underlying context, assumptions, operational dependencies, and plausible impacts.
What is the role of software and spreadsheets in managing enterprise risk?
No software application or spreadsheet guarantees that internal controls operate effectively. While spreadsheets are not inherently inadequate for recording information, enterprise risk management must focus primarily on decision processes, governance oversight, human judgement, and verifiable control evidence rather than the tool used to store data.
How does internal audit's role differ from management's risk ownership?
Management maintains operational ownership of risk, which includes designing, executing, and monitoring controls and response actions. The IIA describes independent assurance and advice, with appropriate safeguards for independence. Confirm responsibilities and safeguards within the organisation’s governance arrangements.
Can an enterprise risk management framework guarantee business resilience or specific audit outcomes?
No risk management framework can guarantee absolute business resilience, financial performance, or positive audit outcomes. An enterprise risk management framework is designed to improve decision-making under uncertainty by making trade-offs, assumptions, and control evidence explicit across the organisation.
How should risk appetite thresholds be established across different operational units?
There are no universal risk appetite thresholds or standardised financial loss models that apply to all institutions. Oversight rights, decision boundaries, and risk criteria must be established based on the specific governance arrangements, operational context, and mandate of each individual organisation.