What components are included in formal risk management governance?

• A. All of the above (risk policies, assigned responsibilities to committees, monitoring and reporting)
• B. Only risk policies
• C. Only committee assignments
• D. Only monitoring and reporting

Answer: (D)

Formal risk management governance rests on three linked elements: risk policies, assigned responsibilities to committees, and monitoring and reporting. Risk policies lay out the standards, risk appetite, and expectations that guide how risk is identified, assessed, and managed across the organization. Assigning responsibilities to committees creates clear accountability and authority for risk decisions, ensuring there is designated oversight at the appropriate level. Monitoring and reporting provide ongoing visibility into actual risk exposure and performance against policies, enabling timely actions and informed decisions by management and the board. When these parts work together, governance is complete: policies set the rules, committees enforce and oversee them, and reporting keeps leadership informed. So, the comprehensive approach includes all three components, not just any single one.