Fundamentals of Risk Management

Risk governance
350
A good organizational structure supports the effective management of risk. The structure 
should be appropriate to the organization but typically would provide for three levels of 
governance with respect to risk:
●
●
direct responsibility for the management and control of risk (that is, staff and management 
working within or managing operational business units and the board);
●
●
co-ordination, facilitation and oversight of the effectiveness and integrity of the risk 
management framework (for example, the risk committee and risk management function);
●
●
provision of independent assurance and challenge across all business functions in 
respect of the integrity and effectiveness of the risk management framework (that is, 
internal and external audit).
Governance structure

---

29
stakeholder 
expectations
Range of stakeholders
Organizations will have a wide range of stakeholders, some of whom may indeed be 
unwanted as far as the organization is concerned. For example, if a distribution 
company wishes to build an extension to its depot, local residents may want to
object to it. The local residents are stakeholders in the operation of the company, 
even though the owner of the company may not wish to acknowledge that fact.
ISO Guide 83 suggests that the term ‘interested party’ is preferred, but stakeholder is 
an acceptable alternative. ISO Guide 73 defines a stakeholder as a ‘person or group 
concerned with, affected by, or perceiving themselves to be affected by an organization’.
There will be a wide range of stakeholders in a typical organization that can be 
summarized as CSFSRS, as follows:
●
●
customers;
●
●
staff;
●
●
financiers;
●
●
suppliers;
●
●
regulators;
●
●
society.
Stakeholders may have contradictory expectations of the organization. For example, 
staff at a sports club will seek pay that is as high as possible. This would be in
opposition to the requirements of financiers, who want the club to be as profitable 
as possible. It is part of the role of management to balance the conflicting interests
of different stakeholders and implement actions that provide the best balance
between conflicting stakeholder expectations.
For organizations in different sectors, the range of stakeholders will be different. 
For government agencies, the general public will be a major stakeholder. Specific 
groups within the general public will be stakeholders in different agencies, depend-
ing on the purpose of each particular agency. For organizations that have significant 
environmental interests or exposures, a different range of stakeholders would need 
to be considered. For some energy companies, environmental pressure groups are