Organisations are living systems that proceed in their action across multiple dimensions on a day-to-day basis. Beyond compliance to codes or good practice and standards, boards of directors’ mission is centred on making the chosen future a reality. This implies going beyond mere compliance, not least because achieving the future is a matter of initiative, not optimisation or compromise. Therefore, the due governing bodies shall use the best of their skills and knowledge to achieve their organisations’ objectives while being constrained by the need for proper governance of the multiple risks, some more strategic, which have the power to collapse organisations.
The etymological origin of the word “risk” suggests semantics associated with “running into danger”. On the other hand, the word “governance”, of older origin, was originally related to the art of steering or setting the course of a ship. From the Latin gubernare, to set a course or guide, or from the Greek kybernan, to steer or command a ship. Therefore, risk governance can be defined as the art and science of steering an organisation towards the intended direction while keeping it away from potential dangers, however diverse they may be. There are risks, perhaps more dangerous than the strictly financial ones, and which require special attention from those responsible for corporate governance in order to avoid blind spots. It is also clear that in recent decades, Force Majeure and Acts of God events are occurring more frequently and with increasing impact. However, when compared to the financial costs of catastrophes caused by human behaviour, they often fall short.
Risk governance can be defined as the art and science of steering an organisation towards the intended direction while keeping it away from potential dangers, however diverse they may be.
There have been considerable efforts to better understand and govern risk. From the development of the ISO 31000 standard, to spending hundreds of millions on Enterprise Risk Management (ERM) systems, in some cases with results that fell short of initial expectations. ERM systems tend
