Is Your Risk Management Framework Fit for Purpose?

What a framework is for

A Risk Management Framework sets out how an organisation identifies, assesses, manages, monitors and reports its risks, and who is responsible for each part of that process.

Its purpose is not to produce documents. It is to help leadership teams and boards make informed decisions, understand the risks they are taking and know when those risks are changing.

A framework that meets this purpose is a practical management tool. One that does not can create a false sense of assurance.

Signs that a framework may not be working

Some warning signs are common across organisations of different sizes and sectors:

• Risk ratings remain unchanged over successive reporting periods, with little explanation.
• Risk appetite statements have been approved but do not influence decisions.
• Ownership of significant risks is unclear, or rests with people who cannot act on them.
• Board risk reports are long but do not show what has changed or what requires attention.
• Emerging risks, such as those arising from new technology, third parties or changes in the business, are not captured.
• The framework has not been reviewed since the organisation last changed significantly.

None of these necessarily means the framework has failed. Each is a reason to look more closely.

The key elements of an effective framework

While every framework should be proportionate to the organisation, effective frameworks tend to share the same elements:

• Governance and accountability: Clear roles for the board, management and risk owners, with defined escalation routes.
• Risk appetite: A practical statement of the level of risk the organisation is willing to accept, with limits or indicators that can be monitored.
• Risk identification and assessment: A consistent methodology that is applied in practice and revisited as circumstances change.
• Controls and actions: Controls linked to the risks they are intended to manage, with owners and evidence that they operate.
• Monitoring and reporting: Information that shows change, explains it and supports decisions at the right level.
• Review and improvement: Regular review of whether the framework itself remains appropriate.

Recognised standards and frameworks, such as ISO 31000 and the COSO Enterprise Risk Management framework, provide useful principles. The task is to apply them in a way that suits the organisation.

Expectations in South Africa and the United Kingdom

Governance expectations in both countries place weight on how boards oversee risk.

In South Africa, the King V Code on Corporate Governance applies to financial years beginning on or after 1 January 2026. It is a voluntary, principles-based code, but it is widely regarded as the benchmark for good governance, including the oversight of risk by the governing body.

In the United Kingdom, the UK Corporate Governance Code 2024 applies to listed companies within its scope on a comply or explain basis. Under Provision 29, for financial years beginning on or after 1 January 2026, boards are expected to monitor the risk management and internal control framework, review its effectiveness at least annually and report on the effectiveness of material controls.

Many organisations that are not formally subject to either code use them as a reference point for good practice. Regulated organisations will also have sector-specific requirements.

Proportionality matters

A fit-for-purpose framework for a growing business will look different from one designed for a large financial institution.

The objective is not complexity. It is a framework that the organisation understands, uses and maintains, and that gives the board a clear view of its most significant risks.

Five questions to test your framework

1. When did our risk information last change a decision? If it rarely does, the framework may not be informing the business.
2. Does every significant risk have a clear owner? Owners should have the authority and information to act.
3. Does our board reporting show change and explain it? Unchanged ratings should be supported by analysis, not habit.
4. Is our risk appetite used, or only approved? Appetite should be reflected in decisions, limits and escalation.
5. When was the framework last reviewed against the business as it is today? Growth, new products, new markets and new technology may all change the risk profile.

The bottom line

A Risk Management Framework is fit for purpose when it helps the organisation make better decisions and gives the board confidence that significant risks are understood and managed.

Reviewing an existing framework does not always mean starting again. Often, the priority is strengthening what is already in place so that it works as intended.