Training Course: Public Sector Board Governance: Risk Oversight and Assurance

Public sector board governance is the system by which the boards and committees of government bodies direct, oversee and hold management to account for risk, compliance and results. This ten-day course is for board members, committee chairs and senior executives who serve public bodies, and it ends with a board governance improvement plan containing committee charter outlines, a risk appetite statement and an assurance map.

Introduction

Three references frame the course. The OECD Guidelines on Corporate Governance of State-Owned Enterprises set principles for how public owners and boards should behave. COSO Enterprise Risk Management, Integrating with Strategy and Performance, links risk oversight to objectives. The IIA Three Lines Model divides responsibility between management, risk and compliance functions and internal audit. The level is advanced and builds on a foundation in governance and risk. Compared with the five-day edition, the extended format adds committee design, risk appetite setting, assurance mapping and board evaluation exercises, delivered through case studies and facilitated board discussions.

Course Objectives

• Distinguish governance from management and define which decisions a public board should reserve.
• Compare standing and ad hoc committees and select a committee structure that avoids overlapping authority.
• Apply the COSO ERM framework to set board-level oversight of strategic and operational risk.
• Distinguish risk appetite from risk tolerance and draft both for a public body.
• Interpret internal audit and compliance reports and map assurance across the three lines.
• Justify a governance improvement plan based on a structured evaluation of the board and its committees.

Target Audience

• Board members of authorities, agencies and publicly owned companies who decide what the board should oversee directly.
• Audit, risk and nominations committee chairs who judge whether their mandate and membership are fit for purpose.
• Chief executives and directors general who decide how information and authority flow between management and the board.
• Board secretaries and governance officers who judge how charters, agendas and evaluations are run.
• Heads of risk, compliance and internal audit who decide how assurance is reported to the board.

Course Outline

Day 1: Advanced GRC Concepts for Boards

• Governance vs Management: Board Oversight Against Executive Running of Operations
• Integrated GRC: Linking Governance, Risk and Compliance Into One Oversight System
• Fundamental Governance Principles Revisited: Accountability, Transparency, Fairness and Responsibility
• Oversight Issue Analysis: Diagnosing Recurrent Governance, Risk and Compliance Failures
• OECD Guidelines on State-Owned Enterprises: Principles for Public Ownership and Boards

Day 2: Board Structure and Powers

• Board Roles vs Executive Roles: Division of Authority and Delegation Limits
• Board Composition: Skills Matrix, Independent Members and Term Length Choices
• Reserved Powers: Decisions Kept by the Board and Those Delegated
• Board and Executive Relationship: Information Flow, Constructive Challenge and Support
• Board Secretariat Role: Agendas, Board Papers, Minutes and Decision Tracking

Day 3: Leading Governance in Government Bodies

• Ownership Oversight vs Board Autonomy: Shareholder Function Against Operational Independence
• Public Sector Governance Models: Departments, Agencies, Authorities and Owned Companies Compared
• Public Sector Governance Challenges: Political Cycles, Multiple Stakeholders and Public Accountability
• Inter-Entity Relationships: Coordination Between Departments, Agencies and Their Boards
• Public Value Lens: Judging Board Decisions by Service and Citizen Outcomes

Day 4: Committee Design

• Standing vs Ad Hoc Committees: Permanent Oversight Against Time-Limited Tasks
• Audit, Risk and Nominations Committees: Mandates, Membership and Reporting Lines
• Committee Charters: Purpose, Delegated Authority, Quorum and Reporting Requirements Drafted
• Committee Lifecycle: Establishment, Operation, Annual Review and Dissolution Stages
• Distribution of Authority: Avoiding Overlap Between Board and Committee Decisions

Day 5: Enterprise Risk Oversight

• COSO ERM Framework: Integrating Risk With Strategy and Performance at Board Level
• Risk Identification and Classification: Strategic, Operational, Financial and Compliance Categories
• Risk Measurement Tools: Heat Maps, Key Risk Indicators and Scenario Analysis
• Inherent vs Residual Risk: Exposure Before and After Controls Take Effect
• Board Risk Oversight Mechanisms: Risk Reports, Deep Dives and Escalation Rules

Day 6: Risk Appetite Setting

• Risk Appetite vs Risk Tolerance: Broad Willingness Against Measurable Limits
• Risk Appetite Statement Drafting: Qualitative Wording and Quantitative Thresholds per Category
• Appetite Cascading: Translating Board Limits Into Departmental Risk Limits
• Breach Reporting: Escalation When Indicators Move Outside Agreed Appetite
• Strategic Risk Case: Setting Appetite for a Public Infrastructure Investment

Day 7: Compliance and Ethical Oversight

• Rules-Based vs Principles-Based Compliance: Checklists Against Judgement of Intent
• Institutional Compliance Policies: Scope, Ownership, Training and Breach Handling Rules
• Governance Laws and Regulations: Mapping Legal Duties That Apply to Boards
• Compliance Monitoring Reports: Content, Frequency and Board Review Questions
• Ethical Oversight: Codes of Conduct, Conflicts of Interest and Whistleblowing Channels

Day 8: Internal Control, Audit and Assurance Mapping

• IIA Three Lines Model: Management, Risk Functions and Internal Audit Roles
• COSO Internal Control Integrated Framework: Five Components Reviewed by Audit Committees
• Internal Audit vs External Audit: Assurance to the Board Against Statutory Opinion
• Audit Plan Review: Risk-Based Coverage, Resources and Follow-Up of Findings
• Assurance Mapping: Showing Which Line Covers Each Key Risk and Where Gaps Remain

Day 9: Strategic Oversight and Governance Technology

• Strategic Oversight vs Operational Monitoring: Direction Setting Against Activity Tracking
• Strategic Performance Oversight: Indicators Linking Plans to Service Results
• BI Dashboards for Boards: Institutional Performance Indicators Presented for Oversight
• Digital Oversight Tools: Board Portals, Evaluation Software and Data Analytics
• Artificial Intelligence in Governance: Uses, Risks and Board Questions for Executives

Day 10: Board Evaluation and the Governance Improvement Plan

• Self-Evaluation vs External Board Review: Internal Questionnaires Against Independent Assessment
• Committee Evaluation Exercise: Rating Charter Fulfilment and Meeting Effectiveness
• Governance Readiness Indicators: Assessing Maturity Across Structure, Risk and Compliance
• Assurance and Appetite Integration: Combining Earlier Outputs Into One Board View
• Board Governance Improvement Plan: Charters, Appetite Statement and Assurance Map Finalised

Skills You Will Gain

• Reserved powers schedule
• Committee charter drafting
• Board skills matrix
• Key risk indicators
• Risk appetite statement
• Three lines assurance mapping
• Board effectiveness review

Why Attend This Course

• From boards that approve whatever management brings to boards that reserve and track their own decisions.
• From committees with unclear mandates to charters that set authority, quorum and reporting.
• From risk registers read once a year to an appetite statement with limits and escalation rules.
• From scattered assurance reports to a board governance improvement plan built on an assurance map and evaluation results.

Conclusion

Board governance in public bodies is about direction and challenge: deciding what matters, asking for the right evidence and holding management to account for it. The course clarifies the line between oversight and management, between appetite and tolerance, and between the three lines of assurance. It suits experienced board members and senior officials who have covered governance basics and now need committee, risk appetite and evaluation tools across an extended ten-day format.

Course FAQs

What is public sector board governance?

It is the arrangement through which boards and committees of public bodies set direction, approve key decisions, oversee risk and compliance and hold executives accountable for services and public funds.

What is the difference between risk appetite and risk tolerance in public sector board governance?

Risk appetite is the broad amount and type of risk a board is willing to accept in pursuit of objectives. Risk tolerance sets measurable limits around that appetite, which trigger escalation when crossed.

Which frameworks does a public sector board governance course follow?

It draws on the OECD Guidelines on Corporate Governance of State-Owned Enterprises, COSO Enterprise Risk Management and COSO Internal Control, and the IIA Three Lines Model for assurance.

Is a public sector board governance course right for an audit committee chair?

Yes, for a chair who must review audit plans, judge assurance coverage and report to the full board, and who wants practice in charter design and committee evaluation.

What does a delegate produce in a public sector board governance course?

Each delegate builds a board governance improvement plan containing outline committee charters, a draft risk appetite statement and an assurance map, prioritised using the results of a board evaluation.