Risk governance
Risk governance is how institutions decide who acts on a shared risk, on what evidence, under whose authority and with what accountability. The Global Risks Forum (GRF) works on the part that most often fails: the space between mandates, where a heatwave, a pandemic or a cyber incident crosses ministries, operators and borders faster than responsibilities are agreed. This section sets out the framework GRF uses to convene that work, and the subject areas where it applies. Decisions always stay with the competent authorities that hold them.
- 01In briefThe short answer
- 02Why it mattersSystemic risk outruns the institutions that must govern it
- 03The frameRisk governance is a chain of authority, evidence and accountability
- 04Where it failsFour failure modes that dialogue can surface early
- 05Across the ConsortiumEvidence, deliberation and capital as separate steps
- 06The frameworkSeven steps from a shared risk to an accountable response
- 07Subject areasWhere the framework is applied
GRF · Institution · service level R0
The short answer.
Risk governance is how institutions decide who acts on a shared risk, on what evidence, under whose authority and with what accountability. GRF works on the part that most often fails, the space between mandates, and sets out a seven-step framework from a shared risk to an accountable response, applied to each subject area.
Climate and hazard exposure in World.
Coastal exposure, deserts, deltas and glaciers across the region, in World.
Systemic risk outruns the institutions that must govern it.
No single owner
River basins, power grids, supply corridors and digital systems cross jurisdictions. Gaps between mandates are where failures spread.
Roles agreed too late
Decision rights and data-sharing are often settled only after an emergency begins, when weaknesses are hardest to fix.
Dialogue without a record
Statements are made, but agreements, dissent and follow-up are rarely recorded, so the same questions return every year.
Risk governance is a chain of authority, evidence and accountability.
The International Risk Governance Council describes risk governance as the totality of actors, rules, conventions and processes through which risk information is collected, analysed and communicated and decisions are taken. Its framework separates pre-assessment, appraisal, characterisation and evaluation, and management, with communication running through all of them. The OECD Recommendation on the Governance of Critical Risks adds a whole-of-society expectation: governments name a lead for critical risks, map their interdependencies and test the arrangements before a shock arrives.
GRF works on the joints of that chain, where one institution's output becomes another's input. A hazard model held by a meteorological service, a dam operating rule held by a utility and an evacuation order held by a municipality only form a system if someone has agreed who passes what to whom, and when.
Four failure modes that dialogue can surface early.
| Failure mode | What it looks like | What a forum can produce |
|---|---|---|
| Orphaned risk | A cascading risk with no lead institution, such as a power outage that disables water treatment | A responsibility map naming a proposed lead and the escalation route |
| Mandate collision | Two authorities both believe they hold the decision, or both believe the other does | A record of the overlap and the options each authority will take back to its own process |
| Evidence that never arrives | A warning exists but has no agreed channel to the decision holder | An information-flow diagram with owners, triggers and formats |
| Untested arrangement | A memorandum signed but never exercised | A proposal for a controlled exercise in the annual programme |
Each output is a record for the institutions concerned to use under their own authority. The decision-rights method and all-hazards duties pages describe the tools in more detail.
Evidence, deliberation and capital as separate steps.
Evidence is assembled by GCRI with its labels intact, deliberation and the dialogue record sit with GRF, and the financial reading of the same risk belongs to the Global Risks Alliance. Keeping the three apart lets a reader see which claim rests on data, which on agreement among institutions and which on a financial judgement, and stops any one of them being presented as the others.
Seven steps from a shared risk to an accountable response.
The framework is designed to be applied to any subject area below. Each step has an owner, and work moves on only when the record of the previous step exists.
- 01
State the question and its owner
A governance question with an accountable institution that wants it answered, framed in the question stage of the Nexus cycle.
- 02
Map mandates and decision rights
Who holds which authority, where responsibilities overlap and where they fall between institutions; see decision rights and responsibilities.
- 03
Bring evidence with its limits
Evidence and methods are led by The Global Centre for Risk and Innovation (GCRI), which states what is observed, modelled, unknown and worth testing.
- 04
Deliberate and record
Structured institutional dialogues record what was agreed, who committed to what and where participants disagreed.
- 05
Test under controlled conditions
Selected arrangements are exercised in Nexus Universe, the annual programme GRF governs, before a crisis tests them.
- 06
Decide under the competent authority
Governments, operators and licensed institutions decide and act under their own authority. GRF prepares the ground and never takes the decision.
- 07
Publish, correct and renew
Reviewed findings are published with their limits, corrections are recorded, and lessons reset the next annual agenda.
Where the framework is applied.
- All-hazards governanceThe governance questionInstitutional duties that hold across different hazards and cascading shocks
- Disaster and crisis governanceThe governance questionPublic authority roles, coordination and recovery
- Climate and nature governanceThe governance questionAdaptation, nature and transboundary environmental priorities
- Health security governanceThe governance questionCross-border and public health responsibilities
- Digital and AI governanceThe governance questionHuman oversight, accountability and rights
- Information and public trustThe governance questionTransparency, communication and societal confidence
- Future generations and anticipationThe governance questionLong-horizon consequences and foresight
- Governance case studiesThe governance questionSource-backed examples with lessons and limits
GRF does not regulate, finance, procure or certify. Its risk governance work produces records, options and test results for competent institutions to use under their own authority.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Risk governance | The institutions, rules and processes through which risks are identified, assessed, managed and communicated, as the IRGC framework sets out. |
| IRGC risk governance framework | A framework that adds pre-assessment, concern assessment and stakeholder involvement to classic risk management. |
| Decision rights matrix | A table showing which body proposes, approves, executes and oversees each decision. |
| Systemic risk | Risk arising from interconnections, where failure in one part can cascade through a whole system. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Pages in Risk governance.
Questions and answers.
Is this a risk management standard?
Who supplies the evidence?
Can my institution bring a risk to GRF?
How does this relate to the GRF programmes?
Around GRF.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.