The Global Risks Forum (GRF)
Risk governance asks who decides which risks are acceptable, on what evidence, and how those choices are answered for when outcomes are uncertain. It covers the identification, assessment, ownership, treatment and communication of risk across organizations and governments, and the accountability that follows. Compounding and cascading risks strain this system because they cross mandates. This page sets out how risk governance fails, how its quality can be read, and which decisions belong to cabinets, legislatures, boards and regulators.
GRF · Established · service level R0
Risk governance is the set of institutions, rules and processes through which an organization or government decides which risks are acceptable, on what evidence, and how those choices are answered for under uncertainty. It covers identification, assessment, ownership, treatment and communication of risk, and the accountability around them.
For risk governance, in GRF's situational-awareness reading, the map opens on population density, flood water and night lights, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
People and hazards, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For risk governance, in GRF's situational-awareness reading, the map opens on population density, flood water and night lights, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Risk governance · Council A · Meeting 8
| Risk appetite statement | P-363 | Approve | None | Discussing |
| New member admission | P-276 | Approve | Declared | Next |
| Safeguards annual review | P-119 | Note | None | Next |
| Data charter | P-792 | Consult | None | Done |
in place, of 12
Accountable choices under uncertainty. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Systemic risks cross sectors, borders and levels of government. Each agency governs its own part, no one owns the interaction, and the interdependencies that drive the largest losses sit outside every risk register.
Where risk appetite and tolerance are never stated, they are set by default through budgets, delays and precedent. Trade-offs are made without being recorded, and accountability after an event has nothing to measure against.
When those who assess a risk also manage it or benefit from accepting it, findings bend toward the preferred option. Separating appraisal from evaluation, and independent review, protect the evidence base.
Risks are often identified and documented before they materialise. Failure lies in escalation, ownership and funding: the warning sits in a register, the decision is deferred, and preparedness lags the assessment.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Risk management | Coordinated activities to direct and control an organization with regard to risk, in ISO 31000 terms. |
| IRGC risk governance framework | A framework that adds pre-assessment, concern assessment and stakeholder involvement to classic risk management. |
| Systemic risk | Risk arising from interconnections, where failure in one part can cascade through a whole system. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| National risk assessment published | yes, partial or no; date of last review | per review cycle | Government publications and OECD survey responses | OFFICIAL |
| Designated lead body for critical risk coordination | named institution and legal basis | per change | Legislation and government orders | OFFICIAL |
| Risk appetite statement approved by the governing body | yes or no, with approval level | annual | Governance statements and public body reports | DECLARED |
| Sendai Framework reporting status | reporting status by target | annual | Sendai Framework Monitor | REPORTED |
| Implementation of audit recommendations on risk management | share of recommendations implemented by their due date | annual | Supreme audit institution follow-up reports | OFFICIAL |
| Post-event review published | published, unpublished or not undertaken, per major event | per event | Inquiry and after-action reports | OFFICIAL |
| Government effectiveness estimate | standardised score with standard error | annual | Worldwide Governance Indicators composite | ESTIMATED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| OECD survey on the governance of critical risks | Country responses on risk assessment, coordination, preparedness and resilience financing | Free and open, attribution (OECD terms) |
| Sendai Framework Monitor | National reporting against Sendai targets and indicators, including national and local strategies | Free, attribution and UNDRR terms |
| World Bank Worldwide Governance Indicators | Composite estimates of government effectiveness, regulatory quality and four other dimensions, with standard errors | Free and open, CC BY 4.0 |
| INFORM Risk Index | Composite of hazard, vulnerability and lack of coping capacity, including institutional components | Free and open, attribution (European Commission JRC) |
| Supreme audit institution performance audits | Audits of risk management, preparedness and emergency spending by national audit offices | Public records, terms per audit institution |
| Public inquiry and after-action reports | Reconstructions of how risks were assessed, escalated and handled before and during events | Public records, terms per publisher |
Governance Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Cabinets and centres of government | Which body leads on each critical risk, and how cross-sector risks are coordinated and funded | Risk ownership maps, OECD Recommendation benchmarks, comparative coordination arrangements |
| Legislatures and their committees | Whether risk mandates, reporting duties and budgets are adequate, and how the executive answers for them | Audit findings, published national risk assessments, post-event reviews |
| Boards and risk committees | What risk appetite to set, and when a risk must be escalated, accepted or treated | Appetite statements, escalation paths, cases of comparable failures |
| Supreme audit institutions | Which risk management arrangements to audit and what to recommend | Recommendation follow-up records, gaps in risk ownership, prior audit coverage |
Risk governance frameworks separate several functions: pre-assessment and framing, scientific assessment, evaluation of acceptability, management and communication. Separating assessment from decision protects the integrity of evidence while keeping value choices with accountable decision-makers. Problems arise when assessment is shaped to support a preferred decision, or when decision-makers hide behind experts for choices that are really about values.
Risks differ in character. Simple risks with clear cause and effect can be managed through routine procedures. Complex risks with many interacting causes need integrated expertise. Uncertain risks, where knowledge is limited, call for precaution and resilience. Ambiguous risks, where people disagree about what matters, need broad deliberation. Applying the wrong process, such as treating an ambiguous risk as a technical one, is a common cause of controversy and failure.
Learning is part of governance. Institutions that record near misses, investigate failures without blame and revise their practices show better long-run performance than those that treat incidents as individual errors.
Communication runs through every stage. How a risk is described, and by whom, shapes public responses and trust, and communication that hides uncertainty or disagreement tends to backfire when events contradict it.
Decision analysis makes objectives, options and trade-offs explicit; it cannot settle value conflicts on its own.
Structured engagement with affected groups; quality depends on design and power balance.
Learning from events; findings depend on independence and candour.
Limits: frameworks describe good process, but institutions operate under political and resource pressures that frameworks cannot remove. Evidence that a process was followed is not evidence that the decision was right.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.