Riskikomiteed

Riskikomiteed are formal governance bodies established within many organizations to oversee risk management. The term is used in Estonian corporate governance and in other contexts to refer to committees that monitor, review, and challenge the organization’s risk exposure and risk management practices. They typically sit on or report to the board of directors and focus on enterprise risk management as a whole.

The committee’s primary responsibility is to supervise the organization’s risk governance framework, set or approve risk appetite, oversee major policy areas such as strategic, financial, operational, compliance, cyber, and environmental risks, review risk assessments and mitigation plans, and ensure that risk information is integrated into strategic decision-making. It may also approve risk-related reports to the board and regulators.

Composition and operations commonly include independent directors and senior executives such as the chief risk officer, chief financial officer, and head of internal audit. The chair is often an independent director. Meetings occur quarterly or more frequently during periods of heightened risk, and the committee relies on dashboards, risk registers, and assurance from internal audit to inform its oversight.

Relation to governance emphasizes coordination with the audit committee, compliance function, and executive management. It aligns risk management with strategy and oversees risk culture. International frameworks such as COSO and ISO 31000 provide guidance; banks and regulated entities may also face specific regulatory duties governing risk committees.

In practice, risk committees are common in banks and large corporations but can be found in other organizations as well. Their effectiveness depends on a clear charter, access to timely information, and independence from day-to-day management; they do not replace the organization’s broader risk management function.