Board Risk Committee Chair
SmartSuite for the Board Risk Committee Chair
The Board Risk Committee Chair leads the board committee that oversees risk appetite, the risk framework and management's handling of principal risks. They challenge the CRO and executive team, set the committee's agenda and report risk oversight to the full board.
Reports to:
What you own
The Board Risk Committee Chair leads the board committee that oversees risk appetite, the risk framework and management's handling of principal risks.
- Chair the board risk committee and set its agenda
- Approve the enterprise risk appetite statement and tolerance limits
- Oversee the adequacy of the risk management framework and second line
- Review principal and emerging risks and management's responses
- Challenge executive risk reporting and assumptions
- Report committee conclusions to the full board
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Board Risk Committee Chair: navy is owned, blue is touched, grey is depended on.
- First lineThe business and its control ownersRun the processes, own the controls, fix the issues
- Second lineRisk, compliance and the domain programmesSet the frameworks, assess, monitor and advise
- Third lineInternal auditIndependent assurance to the board and audit committee
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
Chief Executive Officer
See the roleAudit Committee Chair
See the roleChief Risk Officer
See the roleChief Compliance Officer
See the roleRisk Committee Member
See the roleHow SmartSuite supports the Board Risk Committee Chair
Leading the board risk committee means the board, shareholders and supervisors expect you to challenge the Chief Risk Officer on appetite, framework adequacy and principal risks. SmartSuite gives a Board Risk Committee Chair a read-only view of the register, appetite breaches, resilience test results and overdue actions, so the pack is current on the day.
Oversee risk appetite and principal risks directly
Tolerance thresholds sit on each risk with automated alerts for deviations, so you see which principal risks have moved outside appetite without waiting for management to raise it.
Risk Management suiteA read-only view of Enterprise Risk Management (ERM) shows top risks, heat maps and emerging issues as they stand, giving the committee the same picture the second line works from.
Risk Management suiteStructured scoring and scenario-based assessments let you ask what a different likelihood or impact would do to exposure, which gives your challenge of executive reporting a factual base.
Risk Management suiteChallenge the CRO and the executive team with evidence
Operational Resilience shows critical services, impact tolerances, dependencies and the last test results, so resilience oversight rests on what was exercised rather than on assurance statements.
Operational Resilience suiteEach principal risk carries an accountable owner and a treatment plan with dates in Issues Management, so when you challenge the Chief Executive Officer you can ask the named owner why a plan has not moved.
Risk Management suiteRisks link to the controls, incidents and audit findings behind them, so you and the Audit Committee Chair read the same records when a matter sits across both remits.
Risk Management suiteReport risk oversight to the full board
Board-ready views and trend summaries are produced from the register itself, and the AI Assistant in a SmartDoc field can draft the narrative, so the committee's report to the board is not a quarter-old compilation.
Risk Management suiteReadiness metrics, testing status and third-party dependency exposure for critical services appear beside enterprise risk, so the board sees one picture rather than two reports that disagree.
Operational Resilience suitePermissions, activity logs and version history show which records the committee reviewed and when, which matters when a supervisor later asks what the board knew.
Risk Management suiteRisk management. Gives committee members a read-only view of the live risk register, top risks and appetite breaches, so the pack is current on the day of the meeting.
Operational resilience. Shows important business services, impact tolerances and test results so resilience oversight is evidence-based.
Issues and actions. Shows which agreed management actions are overdue without asking for a status report.
Reporting. Delivers board-ready risk summaries and trends generated from source records.
Products this role uses most
Industry reference
The UK Corporate Governance Code (2024) makes the board responsible for risk management and internal control and expects a committee structure to oversee it. The Basel Committee's corporate governance principles (2015) require board committees, including a risk committee, at systemically important banks.
In the United States the Dodd-Frank Act and the Federal Reserve's Regulation YY require bank holding companies above the asset threshold to maintain a risk committee with at least one risk-management expert. Insurers describe their oversight under the NAIC's Corporate Governance Annual Disclosure, and NACD guidance frames the chair's duties for other sectors.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The Board Risk Committee Chair leads the board committee that oversees risk appetite, the adequacy of the risk management framework and second line, and management's handling of principal and emerging risks. They set the committee's agenda, approve the enterprise risk appetite statement and tolerance limits, challenge the executive team's risk reporting and assumptions and report the committee's conclusions to the full board.
SmartSuite gives committee members a read-only view of the live risk register in Enterprise Risk Management (ERM), including top risks and appetite breaches, so the pack is current on the day of the meeting rather than frozen when it was compiled. The chair can see which risks have moved against the appetite the committee approved, and ask the Chief Risk Officer about a change with the record in front of both of them.
Operational Resilience shows the committee the important business services, their impact tolerances and the results of tests against them, so resilience oversight rests on evidence rather than assurance by assertion. The chair can see which services have been tested, which failed to stay within tolerance and what management has committed to do, which is the basis for challenge when management reports that resilience is adequate.
Issues Management shows which agreed management actions are overdue without the committee having to ask for a status report. Each action carries an owner and a due date, and the chair can see slippage before the meeting rather than hearing about it in the room. That changes the quality of challenge: the question becomes why an action slipped and what has been done about it, not whether it slipped at all.
The chair reports to the full board with board-ready risk summaries and trends that SmartSuite generates from the source records, so the board's picture matches what the committee examined. The same records serve the chair's work with the Chief Risk Officer, who presents from them, with the Chief Executive Officer, who is accountable for the responses, and with the Audit Committee Chair, where risk and control findings overlap.
Committee members need read access to the risk register, resilience and action views, which the risk function configures; no member operates the system. The committee gets value as soon as the enterprise register, appetite limits and management actions are recorded; new customers can begin that recording in SmartSuite Onboarding, a guided four-week program around one or two priority workflows. Between meetings members see the same live data, so the chair sets the agenda around what has changed and the Risk Committee Members arrive prepared.