Enterprise Risk Management
Inherent and residual risk on a live heat-map.
An enterprise risk register and heat-map plotting every risk by inherent and residual likelihood × impact, filterable by category and directorate, aligned to ISO 31000 and King IV.
What you get
- Risk register
- Heat-map
- Escalation
Why it matters
Live risk on a heat-map, not a once-a-year ritual.
Enterprise risk management is the governing body's early-warning system. King IV Principle 11 and the PFMA require the Accounting Officer to maintain effective risk management, and the discipline is straightforward in principle: identify what could stop you achieving your objectives, rate it before and after controls, and treat what sits above tolerance. The 5×5 likelihood-and-impact matrix and the inherent-versus-residual distinction are how that judgement is made consistent and comparable.
When risk is managed on a once-a-year spreadsheet, it stops being a management tool and becomes a compliance artefact. Risks have no live owner, control effectiveness is never re-assessed, residual scores drift out of date, and the register no longer reflects reality — so the board governs on a stale picture and AGSA finds the risk-management system wanting under its internal-control assessment.
A live register and heat-map keep risk honest. Every risk has an owner who updates control effectiveness, inherent and residual scores plot on the matrix, risks above tolerance escalate to the right committee, and the register links to the combined-assurance heat-map so coverage and risk are read together. Aligned to ISO 31000 and King IV, it is the basis for genuine risk governance rather than an annual ritual.
Capabilities
What Enterprise Risk Management does.
Risk register
A live register with owners, ratings and treatment plans.
Heat-map
Inherent and residual risk plotted by likelihood and impact.
Escalation
Risks above tolerance escalate to the right committee.
Outcomes
What changes for your team.
Tangible improvements an entity sees once Enterprise Risk Management replaces the spreadsheet.
How it works
From data to defensible signal.
Want to see Enterprise Risk Managementrunning on your entity's own data?
Enquire nowWho it's for
- Chief Risk Officer and Risk Committee
- Audit Committee
- Risk Owners across directorates
- Internal audit annual-planning team
Legislative basis
- King IV Principle 11 — risk governance
- PFMA s.38(1)(a)(i) & s.51 — systems of risk management and internal control
- Treasury Regulation 27.2 — risk-based oversight
- ISO 31000:2018 — risk-management framework
FAQ
Questions teams ask before they sign up.
How does this satisfy AGSA's view of our risk management?
AGSA assesses whether risk management is effective and current. A live register with owners, re-assessed control effectiveness and residual scores aligned to ISO 31000 and King IV demonstrates an operating system, not a dormant document.
Does it connect risk to assurance coverage?
Yes. The register links to the combined-assurance heat-map, so you can see whether each significant risk is actually assured and feed gaps into the audit plan.
How are risks above tolerance handled?
Residual scores above tolerance trigger additional treatment and escalate to the appropriate committee, so the board's attention goes to what genuinely exceeds appetite.
Want to know more about Enterprise Risk Management?
Tell us about your entity and we'll be in touch with a walkthrough, pricing and next steps — everything you see is traceable to source.