What is the purpose of risk governance in an organization?

• A. To focus only on financial risk.
• B. To remove risk from all processes.
• C. To assign blame after incidents.
• D. To provide oversight, define roles, ensure alignment with strategy, and integrate risk management across functions.

Answer: (D)

Risk governance establishes the framework for overseeing risk across the organization. It defines who is responsible for risk, how risk decisions are made, and how risk management activities align with the organization’s strategy. By creating clear roles, responsibilities, and reporting lines, it ensures accountability and consistent practices across all functions, so risk is identified, assessed, monitored, and addressed in a coordinated way. It also links risk management to strategic objectives, setting risk appetite and policies and ensuring ongoing oversight by leadership.

This holistic approach is why the option describing oversight, defined roles, alignment with strategy, and cross-functional integration best captures the purpose. It isn’t about focusing only on financial risk, removing risk from all processes, or assigning blame after incidents—these don’t reflect the broad, proactive, and collaborative nature of risk governance.