Risk & Resilience Perspectives Across Governance Layers
Illustrative data- Board
- Control & Assurance
- C-suite
- GOVERN
Scores shown on a 0–5 scale.Swipe to explore
The Risk & Resilience Compass© – a pillar of the GOVERN360° Toolkit, developed by experts for experts – gives the Board and senior management a single, evidence-based reading of how risk, cybersecurity, business continuity and compliance are governed in your organisation. Built on international standards including ISO and COSO and adapted for regulated financial institutions with Basel, IAIS, IOSCO, FATF and other standards, the Compass is the first methodology comprehensively addressing corporate resilience in the face of mounting risks.
Structured in 10 domains and over 59 specific KPIs – depending on the sector – the Compass measures both board and senior management readiness to effectively confront financial, operational, technology and other critical risks facing your organisation. The tool reconciles the views of the board and its Risk Committee with technical inputs from the C-suite and the control functions, spotlighting challenging areas between board and senior management perceptions, towards a prioritised roadmap.
The challenge
Different floors, different appreciation of risk
The three-lines-of-defence model exists on paper in all large organisations. Whether it functions independently in practice is a different question. The ability of the second line to genuinely challenge the first, and the third to test both, is where organisations face challenges.
While 50% of CEOs feel very confident about balancing growth and risk, only 30% of boards feel the same.
While 76% of board members believe their company would respond effectively to a crisis, 49% of those companies have actually taken steps to be crisis ready.
83% of CISOs say they engage with the board regularly, yet only 29% of boards include a director with cybersecurity expertise.
Unique value add
The typical approach
01Separate risk, cyber, continuity and compliance reports, each credible on its own terms, with no common scale to compare them.
02A generic risk-maturity tool designed for one sector and adapted to others, with limited consideration of sector-specific needs.
03GRC software that tracks incident data, assuming the underlying governance structure is already sound.
04A single blended risk score that obfuscates differences in board and management perceptions.
Our approach
01One methodology for the Risk Committee to immediately detect areas requiring urgent attention.
02KPIs tailored to banks, insurers and other regulated firms, reflecting their specific risks and operating context.
03A structured maturity diagnostic to detect the functionality and independence of the 3 lines of defence.
04Board and management scores are analysed separately, flagging all areas of divergence.
The solution
A single outlook on risk, cyber, continuity and compliance
The Risk & Resilience Compass© is a proprietary tool enabling the creation of a common denominator between the Board, its Risk Committee, the Control and Assurance Functions, and the wider C-suite. Whether you are a bank, an insurer, or a listed company, the tool can be tailored to your unique parameters, including risk maturity, sector and regulatory obligations.
Board survey
Directors complete a structured questionnaire across all 10 domains, gauging general board-level confidence in risk, cyber, continuity and compliance and reporting from the Risk Committee.
Anonymous or attributed
You choose how responses are reported back — anonymised to protect candour or attributed where individual accountability is required. Either way, the results provide a basis for a tangible corporate roadmap.
Management surveys
The CRO, the CCO, the CIA, Head of BC and CISO gauge how well the processes are actually governed, allowing a meaningful contrast with board and other management views.
Internal or verified
Beyond the core control functions, C-suite members each provide inputs on how they oversee critical risks — surfacing whether risk considerations integrate into day-to-day operations.
The methodology
10 domains and 59 KPIs, rooted in globally recognised standards
The Risk & Resilience Compass© draws on the world's leading frameworks for risk management, cybersecurity, business continuity and regulatory compliance to create a robust assessment methodology to gauge overall organisational resilience.
01
Governance & Oversight
02
Risk Management Framework
03
Cybersecurity Framework
04
Compliance & Regulatory Risk
05
Assurance & Audit
06
Risk Culture & Resilience
07
Third-Party & Supply Chain
08
Continuity & Crisis Management
09
Risk Categories
10
Strategy and Risk Appetite
Risk & Resilience dashboards
4 perspectives providing a granular view of organisational resilience
Board, Risk Committee, Control and Assurance Functions, and wider C-suite inputs are systematically tracked and analysed for adherence to best practice, surfacing any variances in perceptions.
Risk & Resilience Maturity Profile.
Illustrative data- Board
- C-suite
- GOVERN
Scores shown on a 0–5 scale.Swipe to explore
Consensus across risk domains
Illustrative dataBoard Consensus Across Risk Domains
28% Divergence
Management Consensus Across Risk Domains
42% Divergence
Consensus and divergence total 100% for each group.Swipe to explore
The execution
A structured evaluation facilitating ongoing monitoring
We move at your pace. The assessment can be run as a rapid baseline execution with a roadmap, as a customised process tailored to your sector (particularly relevant for regulated financial institutions), or as a verified process where our experts also review documentation and conduct interviews.
BASELINE
Level 1
Board and management complete questionnaires, with responses informing a dashboard, report and a roadmap.
Report in ~4 weeks.
- Survey-based, board and management in parallel
- Maturity reading across every domain
- Report and roadmap in as little as a month
CUSTOMISED
Level 2
The assessment is tailored to your organisation - additional questions and framing adapted to your size, country and sector.
Report in ~5 weeks.
- Inclusion of regulatory requirements
- Customised questionnaires for each role
- A reading that reflects your reality
VERIFIED
Level 3
A customised assessment (level 2), with supporting evidence independently verified by our senior experts to validate findings and identify gaps.
Report in ~6 weeks.
- Review of all relevant policies
- The most objective result
- Provides the strongest level of assurance
Navigate risk with 360° confidence
The assessment will result in a comprehensive prioritised roadmap, allowing monitoring by the C-suite and the board. Our experts stand ready to support you in addressing priorities revealed by the assessment exercise. The assessment findings provide a foundation for strengthening your organisation's risk management and resilience framework, informing strategic decisions and supporting ongoing monitoring.
01
A comprehensive report
presenting a maturity assessment across all ten domains and highlighting any divergences of priority to the board and senior management.
02
A future roadmap
concrete, sequenced actions with owners and deadlines, prioritised by domain weight so the highest-stakes gaps are addressed first.
03
A company presentation
delivered by a senior GOVERN team member to the Board or C-suite directly.
04
Continuous engagement
regular interaction with your board and C-suite that builds trust and a cohesive approach to common challenges.
Framework
Four tools: one integrated view of governance
The Risk & Resilience Compass© can be combined with other tools of the GOVERN360˚ Toolkit or implemented on a standalone basis. Collectively, the 4 tools provide boards and executives with a practical reading across shareholder rights, disclosure and transparency, management and board effectiveness, the robustness of the three lines of defence, and emerging areas such as AI and technology governance.
Governance Compass
A detailed outlook on the corporate governance framework, culture, policies and implementation.
AI Compass
A shared reading of how AI and related technologies are overseen in your organisation.
Risk & Resilience Compass
A single, evidence-based view of how risk, cybersecurity, business continuity and compliance are overseen.
Board Effectiveness Compass
A thorough, evidence-based perspective on both board and committee effectiveness.