Start with scope
Adapt this workflow to the organisation’s size, powers, constitution and applicable governance requirements.
Start with the decision
Identify the questions the board or accountable owner must resolve. Specify reporting period, entities, material objectives and limits of the evidence.
Working output: A short list of decisions requested.
Present risk with context
Show material risks and what changed. Explain why a risk exceeds appetite, how dependencies interact and what management proposes.
Show uncertainty and potential consequences alongside any scores. Avoid replacing meaningful explanation with a traffic-light chart.
Working output: A material risk and exception summary.
Explain what the controls show
Identify the controls that matter, their owners, test coverage and results. Separate designed, implemented, tested and independently assured states.
Show gaps, untested periods, exceptions and claimed remediation that is awaiting verification.
Working output: An assurance map and prioritised action record.
Record challenge and follow-through
Record evidence considered, important challenge, interests or conflicts, decisions, authority and reasons. Apply the actual record-retention rules relevant to the organisation.
Assign actions, owners and review dates. Revisit open issues and changed assumptions at the next appropriate review.
Working output: A decision record that connects to owned actions.
Guidance and underlying sources
- Record a board decision that can be explained — includes the primary sources and applicability limits.
- From a control list to board assurance — includes the primary sources and applicability limits.
- Set risk appetite people can actually use — includes the primary sources and applicability limits.