risk
Inadequate board and management oversight of risk and control
Because board and management oversight of risk and control is weak - unclear tone at the top, ineffective board composition or independence, poor committee structure, and limited senior-management commitment - control priorities are not enforced and resources are withheld, so risks accumulate unmanaged and control failures go uncorrected across the entity.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- strategic
- domain
- Governance, Policy & Oversight
- Compliance, Audit & Assurance
- taxonomy
- coso-erm-risk
- iso-27005-vulnerability
- inherent_rating
- high
Details
- risk_id
- gov-oversight-failure
- category
- strategic
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- coso-erm-risk
- iso-27005-vulnerability
Source
No record-specific source URL is provided.
Connections
- UC-AUDIT-19 — Operate an audit quality assurance and improvement program mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Reporting QAIP results and performance measures to the board lets it oversee audit quality.
- UC-AUDIT-18 — Communicate with stakeholders on assurance matters mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Regular CAE-to-board communication on control and assurance matters gives the board information it needs to oversee risk and control.
- UC-AUDIT-09 — Develop a risk-based internal audit strategy and plan mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- A board-approved risk-based plan directs independent assurance to the key risks the board must oversee.
- UC-GOV-05 — Ensure board-level oversight of risk and internal control mitigates Inadequate board and management oversight of risk and control
- strength
- primary
- rationale
- Board independence, expertise, and oversight of the control and risk program is the direct control against inadequate board oversight.
- UC-GOV-04 — Set tone at the top: integrity, ethics, and risk-aware culture mitigates Inadequate board and management oversight of risk and control
- strength
- primary
- rationale
- Leadership demonstrating integrity and a risk-aware culture directly addresses the unclear tone at the top driving oversight failure.
- UC-GOV-01 — Establish and maintain the enterprise governance framework mitigates Inadequate board and management oversight of risk and control
- strength
- primary
- rationale
- Establishing governance decision rights, accountability, and direction-setting is the operative defense against weak board/management oversight.
- UC-AUDIT-22 — Review risk strategy and performance with leadership mitigates Inadequate board and management oversight of risk and control
- strength
- primary
- rationale
- Leadership periodically reviewing risk/cyber strategy and program performance against metrics and adjusting direction is the operative oversight mechanism.
- UC-AUDIT-01 — Maintain an independent internal audit function mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- CAE functional reporting and unrestricted board access give the board independent assurance, supporting effective oversight of risk and control.
- UC-AUDIT-17 — Follow up on findings and escalate risk acceptance mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Escalating risk acceptance beyond appetite to senior management and the board is a governance safeguard supporting oversight.
- UC-AUDIT-03 — Ensure board oversight and support of internal audit mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Board oversight of the CAE, plan, and budget through executive sessions is core machinery strengthening board oversight of risk and control.
- UC-AUDIT-16 — Communicate final engagement results to stakeholders mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Delivering engagement conclusions and findings to the board and management is a direct information input to risk and control oversight.
- UC-AUDIT-10 — Manage internal audit financial, human, and technology resources mitigates Inadequate board and management oversight of risk and control
- strength
- related
- rationale
- Communicating the impact of resource constraints on audit coverage to the board informs its oversight of assurance gaps.