Why Governance Accountability Matters
An ERM framework can identify risks and define processes yet still fail if it is unclear who is answerable for decisions. Governance accountability makes the division of work explicit: those with oversight set direction and monitor its application; management makes and carries out operational decisions within delegated authority; assurance provides an independent evaluation of whether important arrangements are designed and working as intended.
These roles interact, but they are not interchangeable. Oversight is not day-to-day management, and assurance is not a substitute for either. The distinction matters when a risk limit is breached, a decision requires escalation, or a report gives confidence that controls are effective. In each case, the organization needs to know who decided, who acted, who monitored, and who evaluated the evidence.
Three Distinct Contributions to Accountability
A useful starting point is to ask what kind of contribution a role makes. The same risk topic may appear in an oversight discussion, a management decision, and an assurance review, but each activity has a different purpose.
| Contribution | Core question | Typical accountability |
|---|---|---|
| Set direction and boundaries | What objectives and risk boundaries should guide the organization? | Approve or establish direction and ensure that delegated authority is clear. |
| Make and implement decisions | What action should be taken within the approved direction? | Assess the choice, act within authority, operate processes, and escalate exceptions. |
| Monitor and challenge | Is management’s approach consistent with the agreed direction, and are material issues visible? | Seek relevant information, question significant judgments, and follow up on concerns. |
| Provide assurance | Does sufficient evidence support confidence in the framework or controls? | Evaluate and communicate findings without taking over the activity being evaluated. |
An individual may participate in more than one kind of discussion, but the capacity in which that person acts should be clear. For example, a manager presenting a risk assessment to an oversight group remains responsible for the assessment and any management action. The group’s challenge does not transfer the manager’s execution responsibility to the group.
How to Assign Accountability in a Decision
A practical accountability map follows the decision from its origin to its review. First identify who established the relevant objective or boundary. Then identify who had authority to make the specific choice, who carried it out, and who was expected to monitor results. Finally, identify who evaluated the evidence and whether that evaluation remained separate from operating the activity.
State the relevant objective, appetite, policy, or delegated limit and identify who established or approved it.
Determine who was authorized to choose the action. A person who recommends a decision is not necessarily the person authorized to approve it.
Identify who implemented the decision, maintained the relevant processes, monitored outcomes, and was required to escalate exceptions.
Determine who evaluated the design or operation and what evidence supported the conclusion. The evaluator should not be treated as the owner of the decision or control.
Ask whether a decision lacks an authorized owner, whether monitoring is unclear, or whether the person providing assurance is also responsible for the activity being evaluated.
This sequence is a reasoning aid, not a substitute for the organization’s formal delegations. Accountability must be assigned in the context of actual authority, reporting arrangements, and the decision at issue.
Worked Examples
Worked Example: A Proposed Expansion Exceeds a Risk Boundary
A hypothetical insurer’s governing body has approved a policy limiting the combined stress loss from a proposed product expansion and existing activities to 8% of available capital. Management estimates that the expansion alone would contribute 6.7%, while existing activities contribute 2.4% under the same stress measure. The business manager proposes proceeding without changing the policy. Identify the exceedance and assign the relevant accountabilities.
Method. Compare the combined estimate with the stated boundary; do not compare the expansion’s contribution alone with the limit.
First calculate the combined estimate: 6.7% + 2.4% = 9.1% of available capital. The excess is 9.1% − 8.0% = 1.1 percentage points. The proposal therefore exceeds the approved boundary by 1.1 percentage points.
Management accountability. Management is responsible for preparing a decision using the combined estimate, identifying the exception, and taking the matter through the required escalation route. The business manager cannot treat the expansion’s 6.7% estimate as the only relevant amount when the boundary applies to combined exposure.
Oversight accountability. The governing body or authorized oversight structure is accountable for the boundary and for considering any request that requires a change to it, according to the organization’s authority arrangements. Oversight should not silently convert the 8% limit into 9.1% by allowing management to proceed outside the approved boundary.
Assurance accountability. An assurance provider may evaluate whether the combined estimate and escalation process are supported by evidence. That review does not make the provider the decision-maker or the owner of management’s estimate.
Check. 9.1% is greater than 8.0% by 1.1 percentage points, so the proposed action cannot be described as within the stated boundary. The common mistake is to compare 6.7% alone with 8.0%, overlooking that the policy applies to the combined amount.
Worked Example: A Control Action and a Later Review
In a hypothetical insurer, an operational exposure is subject to a management trigger of $12.0 million. A monthly report shows $14.5 million. The responsible manager implements a mitigation expected to reduce the exposure by $3.2 million. The next report shows $11.3 million. A separate reviewer is asked to assess whether the reporting and mitigation evidence support the conclusion that the trigger is being monitored. Explain the calculations and role assignments.
Method. Calculate the amount above the trigger, the expected post-mitigation amount, and the reported change. Then distinguish action ownership from evaluation.
The initial excess is $14.5 million − $12.0 million = $2.5 million. The expected exposure after mitigation is $14.5 million − $3.2 million = $11.3 million. The subsequent report is also $11.3 million, so the reported reduction is $14.5 million − $11.3 million = $3.2 million.
The manager remains accountable for deciding on and implementing the mitigation within delegated authority, maintaining evidence of the action, and reporting the exposure. The oversight role is to monitor whether material exposure and exceptions are visible and to challenge the response where appropriate. The separate reviewer evaluates whether the reporting and mitigation evidence support the stated conclusion; the reviewer does not implement the mitigation or assume the manager’s responsibility.
Check. The exposure moves from $2.5 million above the trigger to $0.7 million below it: $12.0 million − $11.3 million = $0.7 million. The numbers reconcile because the reported reduction matches the stated $3.2 million mitigation. The common mistake is to treat the favorable post-action report as proof, by itself, that the control and reporting process are reliable. That conclusion requires evaluation of evidence, not merely subtraction.
Worked Example: A Decision Above Delegated Authority
A hypothetical insurer has delegated authority for a technology purchase up to $4.0 million. A proposed system costs $4.6 million and is expected to improve the monitoring of a material risk. Management estimates that the purchase would reduce a specified annual exposure measure from $10.0 million to $8.8 million. The organization’s policy requires decisions above the delegated purchase limit to be submitted to the authorized approval level. Determine the reduction, the authority issue, and the accountability of each role.
Method. Separate the benefit calculation from the approval test; a favorable risk estimate does not change the stated limit.
The estimated reduction is $10.0 million − $8.8 million = $1.2 million. The purchase cost exceeds delegated authority by $4.6 million − $4.0 million = $0.6 million. Thus the proposal has an estimated $1.2 million reduction in the specified exposure measure, but its $4.6 million cost is $0.6 million above the manager’s approval limit.
Management is accountable for assessing the proposal, documenting its assumptions, and submitting it for the required approval rather than approving it under the $4.0 million delegation. The authorized oversight or approval level is accountable for deciding whether to approve the exception under the organization’s rules. If approved, management remains accountable for implementation and monitoring. An assurance provider could later evaluate whether the approval and benefit reporting are supported by evidence, but should not be described as approving or operating the purchase.
Check. The risk benefit does not erase the authority shortfall: $4.6 million is greater than $4.0 million. The common mistake is to infer that a decision is authorized because its expected risk benefit exceeds its cost, even though the organization’s approval rule is based on the purchase amount.
Why the Separation Works
The separation of roles follows from the different questions each role must answer. If management both makes a decision and is accountable for carrying it out, it can respond to results and correct execution. If oversight sets boundaries and monitors management, it can challenge choices without directing every operational action. If assurance evaluates the evidence without owning the activity, its conclusion can inform both management and oversight without replacing their judgments.
This can be stated as a simple accountability chain: direction establishes the standard; management acts within it and reports results; oversight compares results and decisions with the standard; assurance evaluates whether the information and processes supporting those judgments are credible. Combining these functions without clear boundaries can leave the organization unable to tell who should correct a failure or who can independently assess it.
Common Governance Traps
- Calling every risk discussion “oversight.” Reviewing a dashboard is not enough by itself. Oversight also requires clear direction, meaningful challenge, and follow-up on significant issues.
- Assuming approval transfers execution accountability. Approval of a proposal does not make the approving group responsible for every management action that follows. Management remains responsible for implementation within its remit.
- Treating a recommendation as a decision. A specialist may analyze or recommend an action while an authorized manager or governing authority makes the decision. Record who actually held the authority.
- Using assurance as a substitute for management control. An independent evaluation can identify weaknesses, but management remains responsible for correcting them and operating its processes.
- Assigning accountability without matching authority. It is not reasonable to hold a person accountable for an outcome while withholding the authority or information needed to influence it. Clarify the delegation, reporting route, and escalation expectation.
- Confusing a favorable outcome with good governance. A decision may turn out well despite unclear authority or weak evidence. Assess whether the process and accountability were sound, not only whether the outcome was favorable.
Check Your Understanding
For each hypothetical situation, identify the relevant accountability and check whether the stated action is within the described boundary.
- A governing body sets a maximum annual risk budget of $18 million. Two business units report estimated exposures of $7.5 million and $11.2 million. What is the combined amount, by how much does it exceed or fall below the budget, and who should prepare and escalate the combined view? (Answer: $18.7 million combined, $0.7 million above the budget; management prepares and escalates the combined view, while the authorized oversight level addresses any required exception.)
- A manager may approve vendor commitments up to $2.5 million. A proposal costs $2.2 million, and management estimates it will reduce a risk measure from $6.4 million to $5.1 million. What is the estimated reduction, and is the cost within the stated delegation? (Answer: The estimated reduction is $1.3 million; the $2.2 million cost is within the $2.5 million delegation.)
- A reported exposure falls from $9.8 million to $8.6 million after a management action. The approved boundary is $9.0 million. Calculate the reported reduction and the amount below the boundary; state whether the improved report alone proves that the monitoring process is effective. (Answer: The reduction is $1.2 million and the final exposure is $0.4 million below the boundary; no, the report alone does not prove the process is effective.)
- A hypothetical decision costs $5.3 million, while delegated authority is $5.0 million. Its estimated annual benefit is $0.8 million. Calculate the authority excess and identify the correct next step. (Answer: The cost exceeds delegated authority by $0.3 million; management should submit it to the authorized approval level rather than approve it under the stated delegation.)
- A manager both operates a control and is assigned to provide independent assurance over that same control. What is the governance concern, and what should be clarified? (Answer: The assurance role may lack independence because the manager owns the activity being evaluated; separate the evaluation from operation or otherwise establish an appropriately independent evaluator and clear accountability.)