Work it through: Putting Governance in Place
Governance is my day job, so this is the order I build it in for real clients: settle who owns risk and who checks it, pin decision rights to named people, take the same discipline down to task level, then give the whole structure a live risk register to manage.
Seven steps, in the order the playbook gives them. Your work stays in this browser until you save it to a file.
Your ducks
Start with what the people believe, what the paperwork says and what actually happens. The issues where your ducks disagree are the ones to carry into the homework.
You have not filled in the ducks sheet yet.
The homework
What has to be found before any of the four frameworks is worth running. Put a name and a date against each one, and tick it when you have it in your hands.
The ducks
For Three Lines of Defence
For RAPID Decision Roles
For RACI Matrix
For Risk Matrix
Step 1 of 4: Three Lines of Defence
Start with roles, because in a growing organisation risk work is happening everywhere and nobody can say who owns which control and who checks it. The three lines are roles rather than departments. In a small business one person can hold a first-line and a second-line role at once, provided the hats are named and never worn simultaneously for the same control. When I map this with clients, the first draft nearly always shows the board taking comfort from assurance that is really management marking its own homework. Finding that out on paper is cheap.
Watch forTreating the model as an organisation chart to be staffed, then hiring three departments a business of your size does not need.
0 of 5 steps filled · 0 of 4 inputs in hand
What comes out, and how to read it
A documented allocation of risk roles across the three lines and the governing body: who owns each principal risk and its controls, who oversees and challenges, who assures independently, and what each line reports to the board.
- Read the model as roles rather than departments. One person can wear first-line and second-line hats in a small organisation, provided the hats are named and never worn simultaneously for the same control.
- Test independence at the reporting line. Whoever the third line reports to is whoever it cannot credibly audit.
- Treat blurring as a finding. Wherever the second line is operating controls or the third line is designing them, the map has told you where assurance is weakest.
Step 2 of 4: RAPID Decision Roles
Risk ownership can be beautifully mapped while decisions still stall, get made twice at different levels, or unravel in delivery. RAPID exists for that gap. For each decision that matters, one named person holds the D, one recommends, a short list gives input, and only genuine legal or financial sign-offs earn an Agree. Count the roles when you are done. More than one D, or a long Agree list, means you have documented the ambiguity instead of removing it. Put the D where the information lives, which is often below the most senior person in the room.
Watch forGiving the D to a committee, or to two people jointly, restores exactly the ambiguity the tool exists to remove.
0 of 5 steps filled · 0 of 4 inputs in hand
What comes out, and how to read it
A decision chart: for each critical decision, one named D, one Recommend, a short list of Inputs, any genuine Agrees, and the Performers, plus the changes to meetings and escalation routes needed to make the chart real.
- Read the chart by role, not by letter order. RAPID is a mnemonic rather than a sequence; the working order is Input, Recommend, Agree, Decide, Perform, and the D owns the call.
- Count the roles. More than one D, more than one Recommend, or a long Agree list means the ambiguity has been documented rather than removed.
- Check the D sits where the information is. A D placed high for status reasons will either bottleneck or rubber-stamp.
Step 3 of 4: RACI Matrix
Now take the same discipline down to the level where work actually gets dropped. Tasks fall into the gaps at handovers, and each side sincerely believes the dropped task belonged to the other. A RACI grid forces those arguments in week zero, on paper, rather than in month three, in an incident review. Hold the one rule that gives the tool its teeth: exactly one Accountable name per row. Every argument the chart provokes is the chart working, because the disagreement already existed and you have simply made it discussable.
Watch forConsultation inflation, C's handed out to avoid offence, until every task waits on five opinions and none of them can say what their input changes.
0 of 4 blocks filled
Step 4 of 4: Risk Matrix
The structure now needs something to manage. Put every identified risk on the likelihood and impact grid, give each one a response posture and an owner, and let the top-right corner set the agenda. The matrix is triage rather than measurement, and its real job here is to connect the machinery you have just built: each significant risk gets an owner in the first line, oversight in the second, and a place on the board's assurance map. A risk register with no names attached is just a list of worries.
Watch forA register reviewed annually and returning the same picture every time is recording effort rather than managing anything.
0 of 4 blocks filled
The review date
Set the date you will come back and ask whether it worked. Put it in your diary; this site will not remind you.
Your work stays in this browser until you save it. The file is yours; load it here on any machine.