What you own
A Risk Committee Member sits on the executive or board risk committee and reviews the organization's principal risks, appetite breaches and treatment progress.
- Review principal and emerging risks presented to the committee
- Challenge risk assessments, scoring and treatment plans
- Approve risk acceptances and escalations within the committee's mandate
- Monitor key risk indicators against appetite
- Confirm that agreed actions are completed
- Represent their function's risk perspective in committee decisions
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
Risk management. Provides committee members with a live view of the risk register, KRIs and appetite breaches rather than a static pre-read.
Issues and actions. Shows treatment plan status and overdue actions for the risks the committee owns.
Reporting. Generates committee packs from current data with heat maps and trend views.
Products this role uses most
Industry reference
COSO ERM (2017) and ISO 31000:2018 describe what a risk committee reviews: appetite, emerging risks, key risk indicators and whether treatments are closing on time. The committee is the point where the second line's reporting meets executive and board decision-making.
Banking regulation prescribes the forum. The Basel Committee's corporate governance principles expect a board risk committee at large banks, and the Federal Reserve's Regulation YY sets membership rules for bank holding companies. Insurers evidence the same under Solvency II and the NAIC ORSA; public bodies follow OMB Circular A-123, which asks agencies to maintain an ERM governance body.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What is a Risk Committee Member expected to do?
A Risk Committee Member reviews the organization's principal and emerging risks, challenges the assessments, scoring and treatment plans presented to the committee, approves risk acceptances and escalations within the committee's mandate, monitors key risk indicators against appetite and confirms that agreed actions have been completed. Each member also brings their function's perspective to the decision. The committee is where the second line's reporting meets executive and board decision-making, and the member's job is to make that meeting count.
How does SmartSuite help a Risk Committee Member see risk between meetings?
Enterprise Risk Management (ERM) provides committee members with a live view of the risk register, key risk indicators and appetite breaches rather than a static pre-read, so a member can look at a principal risk, its current score and whether an indicator has crossed appetite at any point, not only in the week before the meeting. A breach that happens between meetings is visible when it happens. That changes the committee's questions from what happened to what is being done.
How does this role confirm that agreed actions were actually completed?
Issues Management shows treatment plan status and overdue actions for the risks the committee owns, so when the committee asks whether the action agreed last quarter was done, the answer is the record: who owned it, when it was due, whether it closed and what evidence closed it. The Risk Committee Member can see overdue actions before the meeting and direct the challenge to the Chief Risk Officer or the Operational Risk Manager with the specifics in hand.
How are committee packs produced and what do they contain?
SmartSuite generates committee packs from current data with heat maps and trend views, so the pack the Enterprise Risk Director sends is built from the register as it stands on the day, not reassembled by hand a week earlier. Heat maps show where principal risks sit against appetite, trend views show which direction they have moved over recent cycles, and the treatment status behind each risk is one step away. Operational Resilience contributes the important business services view where the committee's mandate covers resilience.
What does a board-level committee need to adopt a live risk view?
A register that the second line maintains in Enterprise Risk Management (ERM) and a decision about which risks, indicators and appetite thresholds the committee owns; the member's view is a reading of that register, so nothing is set up for the committee separately. Members need an account and a short orientation, after which the pack and the live view are the same data. Under the Basel corporate governance principles, Regulation YY or the ORSA, the minutes and the record then support each other.

See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.




