What the governing body should ask about risk appetite, the register, acceptances, early-warning indicators, and board reporting

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

Each question below is paired with the evidence a strong answer produces, and routes to the corpus document that governs it. The evidence is the organization's own populated artifact (its approved statement, its register extract, its completed report), not the routed corpus template or standard, which is the governing schema rather than evidence of the organization's state. A governing body learns more from the evidence a control generates than from an assurance that the control exists; a described control the organization cannot evidence is not demonstrably operating. These questions are enterprise-risk-process-scoped, and complement the AI-inventory-scoped set in oversight-questions-ai-inventory-risk.md rather than repeating it.

Theme: appetite. Are we operating inside the tolerance this body set?

• For each material risk, are we inside the appetite this body approved, and where are we outside it? A strong answer reads the current exposure against the risk appetite statement, whose tolerance boundaries are the condition every in-appetite or out-of-appetite judgement is measured against. An answer with no appetite to measure against, or an exposure never compared to it, is the gap.

Theme: the register. Do we have one live record of our material risks, scored consistently?

• Is there a single live enterprise risk register, and is it scored on one consistent scale? A strong answer produces the enterprise risk register extract, not a summary of it, scored on the taxonomy and methodology the enterprise risk-management standard sets, with scores comparable across units.

Theme: acceptances and exceptions. What residual risk have we accepted, who approved it, and on what expiry or review terms?

• What residual risk have we formally accepted, with what owner, compensating controls, and expiry or event-based review trigger? A strong answer produces the acceptance records the risk-acceptance procedure requires, each an accepted residual that is documented, owned, and time-bound rather than unrecorded; and the exception records the exception and risk-acceptance management policy centrally tracks, each risk-assessed, time-bound, and approved.

Theme: early warning. Would we see a risk rising or a control degrading before it fails?

• What early-warning indicators do we watch, and what triggered escalation since we last met? A strong answer reads the key-risk-indicator register, its threshold monitoring and defined escalation, and names the breaches that escalated rather than asserting that monitoring exists.

Theme: board reporting and assurance. Does risk reach us on a cadence, and can we see where assurance has gaps?

• Does risk reach this body on a defined cadence, and where does assurance over our material risks have gaps? A strong answer is the completed board risk report delivered on its cadence, read alongside the assurance map, whose ratings show where assurance over a material risk is thin or absent.

A weak answer in any theme: an assurance in place of a record. "We are broadly within appetite" with no exposure comparison; "the register is maintained" with no extract; "risks are escalated when needed" with no indicator set or breach log.

• The approved risk appetite statement and the current exposure read against it.
• The enterprise risk-register extract, scored on the standard's consistent scale.
• The risk-acceptance records, each with owner, compensating controls, and an expiry or event-based review trigger; and the enterprise exception records, each time-bound with an owner and an expiry.
• The key-risk-indicator register and the breaches that triggered escalation since the last meeting.
• The latest board risk report and the actions and follow-ups it captured, and the current assurance-map ratings for the material risks.

This page is a non-normative executive narrative that creates no compliance by itself; the linked corpus documents govern, and where this page and a corpus document differ, the corpus document prevails. It routes to the corpus rather than reproducing its values: the appetite tolerance boundaries, the scoring-matrix bands, the register field schema, the indicator thresholds and escalation levels, the acceptance approval authorities, and the board-report cadence live in the linked documents and are not restated here. This page carries composite claims: the division of oversight it describes across the risk appetite, register, indicators, acceptance, exception, reporting, and assurance controls requires validation by the adopting organization against its own arrangements.