Risk, compliance and operational policies · 01
Risk management policy and framework
Sets the organisation’s risk appetite and the process by which risks are identified, rated, treated and reported.
Sets the organisation’s risk appetite and the process by which risks are identified, rated, treated and reported.
Cover governance of risk and the board’s role; the risk appetite and tolerance statement; the methodology: categories, likelihood and impact scales, inherent and residual rating; the risk register and its owner; the treatment options and the control owner for each; the assurance map; the reporting cycle to the audit and risk committee; and emerging-risk review.
A risk register with no named control owner and no review date is a list, not a control. And an appetite statement that says the organisation has no appetite for any risk tells the board nothing and licenses everything; express appetite differently for different categories.
The law it sits under
What governs this instrument.
Section 51(1)(a)(i) of the Public Finance Management Act 1 of 1999 requires an accounting authority to maintain effective, efficient and transparent systems of financial and risk management and internal control. King V treats risk governance as a board responsibility to be disclosed on an apply-and-explain basis for financial years beginning on or after 1 January 2026.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.