“Just do it!”: Partially self-organising governance structures for NFR frameworks

Christoph Reitze

Previously, non-financial risk management often resulted in positioning existing risk management functions – compliance, operational risk, anti-financial crime, reputational risk, information and communications technology (ICT) risk, etc – into a common reporting line. The starting point for this journey would lie in external expectations, as legislators, regulators and auditors require adequate, transparent and joined up definitions of roles and responsibilities. In an orderly world, it always needs to be clear who is in charge and why. A lack of clarity, in turn, is regularly seen as a sin – ie, a system failure that results in liability risk at the board level. At the same time, compliance, the epitome of adherence to rules and regulations, probably represents the most important non-financial risk (NFR) with regard to reputational aspects, possible sanctions and fines. However, proving adherence to such requirements requires testable standards as well as clear roles and responsibilities that leave little room for interpretation.

THE CHALLENGE OF SETTING UP CAPABLE FRAMEWORKS

At first glance, this does not look like an opportunity to test innovative approaches and think