Too many enterprise risk management programmes produce large registers that nobody consults. A framework is only useful if it informs decisions at the level where decisions are made — including the board.
Anchor risk to objectives. Risks mean nothing outside the objectives they threaten. A credible ERM framework starts from strategy and objectives, then identifies what could prevent their achievement.
Make ownership explicit. Every key risk needs a named owner with authority to act, and a defined escalation threshold. Registers without accountability create false assurance.
Consolidate, don't fragment. Clinical, operational, financial and reputational risks must roll up into a single enterprise view. Fragmented departmental registers hide concentration and contagion.
Report for decisions. Board-level risk reporting should answer three questions: What are our most significant exposures? Are they within appetite? What actions are underway? Monthly dashboards that answer these questions earn their place on the agenda.
Aligned with the COSO ERM framework, this approach turns risk management from a compliance exercise into a decision-support discipline.