Risk, responsibility & governance

The statement “there are risks” does not explain what should be checked or what is being accepted. A change in price, an interrupted process, inconsistent explanations and an unclear responsible party call for different responses. Begin by describing a possible event separately from the people, assets or processes it could affect.

Governance here concerns the practical organisation of proposals, checks, decisions and records. Clarifying those roles helps people share the conditions under which a decision would change. Regardless of the size of an organisation or the number of people involved, a traceable account of who checked what provides a practical starting point for discussing the next action.

• Event: What possibility is causing concern?
• Impact: Could it affect money, timing, rights, information or another relevant objective?
• Observation: What evidence would reveal a change in the situation?
• Response: Who is responsible for preparation and for action after an event?
• Decision: What condition requires escalation, postponement or a stop?

The person making a proposal, the person checking its basis, the person deciding and the person recording the outcome perform different tasks. Naming those tasks helps expose assumptions that “someone must have checked”. One person may fill several roles in a small organisation, so the actual scope of a check matters more than the job title.

• Record both the decision-maker and the person responsible for an unresolved enquiry.
• Identify remuneration or interests that could influence a proposal.
• Distinguish assignment of a task from evidence that the task has been completed.

Consider a proposed document-sharing service. One person tests its functionality while another examines the terms and handling of information. This is a hypothetical illustration. Even if the trial works, uncertainty about retrieving data when the contract ends remains a separate unresolved question. A successful demonstration does not answer it.

Instead of proceeding solely because the service is convenient, set a time for the outstanding answer and identify an alternative if it is not obtained. A stop condition need not express distrust of the provider. It describes the conditions on which a decision can be made, and prevents a useful test from being treated as approval of every aspect of the arrangement.

The OECD corporate governance principles address risk oversight, conflicts of interest and accountability as organisational concerns. They should be read separately from local legal requirements and evidence about the practices of any particular company. A record of past checks is not, on its own, evidence that present conditions remain acceptable.

Alongside scheduled reviews, identify events that require a new check: a change in responsible personnel, a material change of terms or an unexpected interruption. Updating the record should preserve the earlier reasoning and show what changed. That is different from silently replacing a previous decision and losing the link between evidence, responsibility and action.