Understanding & Repairing Misalignments on Risk

Risk misalignment is a pervasive but often unrecognised challenge in public sector governance. It occurs when there is a disconnect between an organisation's formally stated risk appetite, the level of risk it actually takes in practice, and the expectations of its stakeholders regarding acceptable risk levels. These misalignments can lead to serious governance failures: organisations may take risks their stakeholders would not accept, or conversely, may be so risk-averse that they fail to innovate or deliver services effectively. Auditors are uniquely positioned to identify these misalignments and help organisations bring their risk management into better alignment with their objectives and stakeholder expectations.

Understanding risk misalignment requires auditors to examine multiple layers of an organisation's risk management framework. At the formal level, they assess whether risk appetite statements and risk management policies are clear, comprehensive, and aligned with strategic objectives. At the operational level, they evaluate whether actual decision-making behaviour reflects the stated risk appetite, or whether there are systematic departures that indicate the formal framework does not accurately describe how the organisation actually approaches risk. At the stakeholder level, they consider whether the organisation's risk-taking is consistent with what its oversight bodies, funders, and service users would consider acceptable.

The OECD Auditors Alliance has explored the challenge of risk misalignment through dedicated working groups and thematic discussions. These conversations have revealed that misalignments are common across public sector organisations in all member countries and arise from a variety of causes. Cultural factors, such as institutional risk aversion or the normalisation of risk-taking in certain programme areas, are often as significant as formal governance weaknesses. Leadership transitions, organisational restructuring, and external shocks can all disrupt previously effective risk management arrangements and create new misalignments.

Repairing risk misalignments is not simply a matter of updating risk management documents. It requires genuine organisational change, including adjustments to governance structures, decision-making processes, incentive systems, and communication practices. Auditors can support this process by providing clear, evidence-based assessments of where misalignments exist, why they have arisen, and what practical steps organisations can take to bring their risk management into better alignment.