Part 4, Governance, Roles & Cadence
Who reviews what, how often, and when to escalate
A risk framework only works if someone is accountable for running it. Keep the structure small and the cadence fixed, because an elaborate committee that meets irregularly manages risk no better than no committee at all.
- Steering committee, the sponsor, the risk owner, and the technical lead. Reviews the risk register at every stage gate and monthly between them.
- RACI, Responsible: the project and workstream leads. Accountable: the sponsor. Consulted: legal and compliance, data owners, affected teams. Informed: the wider organisation.
- Escalation, any risk scoring 15 or above goes to the sponsor within 48 hours, with a documented response before the next milestone.
- Leading indicators to track, data quality score, model accuracy and drift trend, user adoption rate, number of open critical risks, and time-to-resolution on flagged issues.
- Review cadence, weekly at the workstream level during build, monthly at steering level, and a full pre-mortem repeated at every major stage gate: pilot, scale, full rollout.
None of this needs a dedicated risk function. It needs three named people and a recurring meeting that actually happens.