Which statement best reflects the role of risk management in governance?

• A. Risk management is primarily about regulatory compliance and not decision-making.
• B. Risk management has no impact on board oversight.
• C. Risk management identifies, assesses, and mitigates risks to the organization, shaping governance decisions.
• D. Risk management is optional for mature boards.

Answer: (C)

Risk management in governance is about creating a disciplined process to spot uncertainties that could affect the organization’s ability to achieve its objectives. It involves identifying risks across operations, strategy, finance, and the external environment; assessing how likely each risk is and the potential impact; and then deciding on actions to mitigate or tolerate those risks. With this information, management and the board shape governance decisions—setting risk appetite, prioritizing resources, approving controls, and monitoring performance to keep risks within acceptable levels. The ongoing cycle of identification, assessment, mitigation, and monitoring keeps governance responsive to changing conditions and ensures accountability for risk-related outcomes.

This approach matters because governance isn’t just about compliance; it relies on risk insights to guide strategy, resource allocation, and decision-making. Risk reporting supports board oversight by highlighting where there are gaps or emerging threats, enabling proactive management rather than reactive responses. And risk management isn’t optional for mature boards—it’s a fundamental, ongoing discipline that underpins effective governance.