**F R A M E W O R K · C O M P A N I O N · V 1 . 0** # **Risk vocabulary for the board** _Bridging inherited governance language and what the framework actually produces_ Bearing north · Fifth piece · PDCA+ v2.0 · Public Review _The board's risk vocabulary is mature for what it was developed for. The framework produces capabilities the vocabulary does not naturally accommodate — tension monitoring, second-order observation, strategic compliance posture, substrate-based visibility, structural authority observability. This piece develops the bridge between inherited language and the new governance territory the framework opens._ **A U T H O R** **Joacim Brandell** > Written for board members, audit and risk committees, and those who prepare board materials · respects inherited governance practice · develops the new oversight territory rather than dismissing the old _The board's risk vocabulary_ PDCA+ v2.0 ## **Why this piece exists** Boards have inherited a substantial body of risk-governance vocabulary developed across decades of corporate governance practice. Enterprise Risk Management frameworks, auditcommittee conventions, regulatory expectations, and risk-committee charters together provide a mature language for thinking about risk at the governance level. The vocabulary is good. It works for what it was developed for. Most of what boards currently do in risk governance, they do reasonably well within the constraints of the apparatus available. The framework produces capabilities that do not map cleanly into this inherited vocabulary. Tension monitoring is not risk monitoring — the two are categorically different, as the tensions piece in this series established. Second-order observation has no counterpart in conventional risk practice; the framework's observation of its own observing produces information that previous frameworks did not produce. Strategic compliance posture is a category most boards have not been asked to govern; previous frameworks treated compliance as a function rather than as a posture. Substrate-based visibility produces a quality and continuity of information about the organisation that the periodic-reporting cadence of conventional governance was not designed to receive. Structural authority observability lets the board see how its own delegated authorities are actually being exercised, in ways that conventional reporting cannot produce. This piece develops the bridge between inherited governance language and the new oversight territory the framework opens. The bridge is not a replacement. The inherited vocabulary remains useful for what it was developed for; the new capabilities extend the territory the board can govern; the practice that follows will combine both for the foreseeable future. What the piece offers is a way to hold the new capabilities in language that boards can use to govern them, while preserving the inherited vocabulary's value for the governance questions it continues to answer well. The audience is board members, audit-committee members, risk-committee members, board secretaries, general counsel, and anyone who prepares materials for the board. The piece does not prescribe specific committee structures, charter language, or oversight protocols — those decisions belong with each board operating in its own jurisdictional, sectoral, and corporate context. What the piece does is describe the new territory in language a board can engage with, and identify what kinds of capabilities boards will need to develop to govern that territory well. ## **The inherited vocabulary, on its own terms** Before naming what the framework adds, it is worth being honest about what the inherited vocabulary already provides. Boards that govern with the current apparatus are not failing Joacim Brandell 2 / 12 _The board's risk vocabulary_ PDCA+ v2.0 — they are doing what the available language and tooling support. The conversation that follows is constructive only if it begins from respect for the current practice. ### **What the inherited vocabulary supplies** The vocabulary boards have today provides several substantial governance capabilities. Risk appetite frameworks let boards articulate the kinds and levels of risk the organisation will accept in pursuit of its objectives; the articulation is usually high-level but it provides a reference point against which specific decisions can be assessed. Risk registers and key risk indicators give boards a window into the operational risks management is tracking; the windows are typically lagging and aggregated, but they are visibility nonetheless. The threelines-of-defence model gives boards a structural understanding of how oversight is distributed across the organisation; the model has well-known limitations but it is a coherent organising principle. Audit-committee oversight of internal controls, with its specific legal vocabulary around material weakness and significant deficiency, gives boards a particular form of assurance about the reliability of financial reporting. Regulatory reporting requirements, when applicable, provide a forcing function for documentation and attestation that improves discipline. None of this is wrong. None of it should be abandoned. The framework's contribution is not to replace this apparatus but to extend the territory the board can govern. The inherited vocabulary continues to serve the questions it was designed for, and those questions remain important. What changes is that several additional governance questions become askable that the inherited vocabulary did not naturally accommodate. ### **What the inherited vocabulary does not naturally produce** Despite its substantial coverage, the inherited vocabulary leaves several governance territories underdeveloped. These are the territories the framework's capabilities map into. The vocabulary treats risk as the dominant category of governance concern, which works well for things that genuinely are risks but fails for things that are not — particularly the standing structural conditions the tensions piece named. Cultural difficulties, role conflicts, operatingmodel strains, tensions between competing legitimate concerns: these surface as governance topics but the vocabulary does not naturally accommodate them as their own category, so they tend to be misclassified as risks and addressed through risk apparatus that produces partial responses. The vocabulary treats reporting as periodic, with information flowing from management to board on cycles set by statute, regulation, or convention. Quarterly board meetings, annual risk reviews, audit cycles: each provides a snapshot of state at a moment in time, with the periods between dark to the board. The vocabulary does not naturally accommodate continuous information flow, even though continuous flow is what the framework's substrate operation makes available. Joacim Brandell 3 / 12 _The board's risk vocabulary_ PDCA+ v2.0 The vocabulary treats the framework itself — the risk-management apparatus, the internal control structure, the compliance programme — as a given. The board may revise the framework periodically, but the assumption is that the framework operates more or less correctly between revisions. The vocabulary does not naturally accommodate observation of the framework itself for drift, inadequacy, or structural failure — even though such observation is exactly what second-order observability provides. The vocabulary treats authority as something granted through formal charters and exercised within them. The vocabulary does not naturally accommodate observation of how authority is actually being exercised across many decisions over time, whether the exercise is staying within scope, whether scope is being expanded informally — even though such observation is what the substrate's authority records and change history make possible. Each of these underdeveloped territories has a corresponding framework capability. The next section names them. **T H E I N H E R I T E D V O C A B U L A R Y , I N O N E S E N T E N C E** _Boards have inherited mature governance language that works well for what it was developed for; the framework does not replace it but extends the territory the board can govern, into areas the inherited vocabulary did not naturally accommodate — tensions distinct from risks, continuous flow instead of periodic snapshots, observation of the framework itself, and observation of how authority is actually being exercised._ ## **What the framework produces that the vocabulary does not accommodate** Five capabilities of the framework produce information or oversight territory that the inherited vocabulary does not naturally accommodate. Each is named here for what it is structurally, with attention to why the inherited vocabulary does not contain it. ### **Tension monitoring as its own category** The tensions piece in this series established that cultural and structural concerns that present as governance topics are often tensions rather than risks. Tensions have different properties — they are standing conditions rather than uncertain future events, they have no single likelihood or impact, they are addressed through monitoring and characterisation rather than through mitigation. The framework's substrate makes tension monitoring tractable in ways the inherited vocabulary does not anticipate. For boards, this means a category of governance concern that has previously had no good vocabulary now becomes characterisable, observable, and governable as its own thing. Joacim Brandell 4 / 12 _The board's risk vocabulary_ PDCA+ v2.0 ### **Second-order observation** The framework observes its own observing apparatus — detects when classifications are drifting from the reality they classify, when authority is being invoked outside its granted scope, when the chain from regime intent to evidence is developing structural gaps. None of this is detectable through first-order observation of operational state; it requires the framework to observe itself. The information this produces is qualitatively different from anything conventional risk reporting can produce, because conventional reporting cannot examine the apparatus that produces it. ### **Strategic compliance posture as a managed variable** The regime piece in this series established three modes of compliance — check, continuous, strategic — and the appendix on the three modes developed strategic compliance specifically. For boards, strategic compliance posture means treating the organisation's compliance state as something the board characterises, governs, and deliberately shifts. This is different from "compliance with applicable regulations" as a constraint to be satisfied; it is compliance as a strategic variable the board governs in the same sense that it governs capital structure or product portfolio. ### **Substrate-based continuous visibility** Under substrate operation, the organisation's compliance state, risk posture, control inventory, and governance health are all queryable continuously rather than reportable periodically. For boards, this changes what information becomes available between meetings — and changes the standard against which the board's oversight is judged. A board that could previously rely on quarterly reports cannot rely on quarterly reports in the same way once the underlying state is available continuously. This is both a capability extension and a responsibility extension. ### **Structural authority observability** The substrate's identity-authority-accountability records and the substrate change records together make visible how authority is actually being exercised across the organisation. The board's delegated authorities — typically granted through resolutions, policies, and management appointments — become observable in their exercise. Which authorities have been invoked, by whom, under what scope, with what frequency, against what decisions: each of these becomes a queryable property rather than a periodic reporting category. For boards, this is a new oversight territory because it has not previously been available. **T H E F R A M E W O R K ' S C O N T R I B U T I O N S , I N O N E S E N T E N C E** _Five capabilities the inherited vocabulary does not accommodate: tension monitoring as its own category distinct from risk, second-order observation of the framework apparatus itself,_ Joacim Brandell 5 / 12 _The board's risk vocabulary_ PDCA+ v2.0 _strategic compliance posture as a managed variable, substrate-based continuous visibility into operational reality, and structural authority observability that lets the board see how its own delegated authorities are actually exercised._ ## **The translations: bridging inherited and new** Five specific translations link inherited governance vocabulary to the framework's capabilities. Each translation extends the inherited concept rather than replacing it. A board adopting the framework's capabilities does not stop talking about risk appetite or risk registers or three lines of defence; it adds new dimensions to those conversations and develops oversight of new territory that the inherited vocabulary did not address. **1 . I N H E R I T E D · F R A M E W O R K C A P A B I L I T Y → Risk appetite (abstract statement) Risk appetite as substrate posture** The board's risk-appetite statement remains, but under substrate operation it attaches to specific Control Objective Records and propagates through the chain to specific obligations, controls, and residual postures. The board can see how its abstract appetite translates into specific posture across the organisation — and can shift the appetite deliberately with traceable consequences. The translation extends the concept from declaration to managed state. **2 . I N H E R I T E D · F R A M E W O R K C A P A B I L I T Y → Risk register (artefact of management) Chain entities and conjunction findings** The risk register continues to exist as an operational artefact. Under substrate operation, it is supplemented by chain queries (where do registered risks attach to control objectives? what evidence underwrites the controls that mitigate them?) and by conjunction findings (what is the substrate surfacing that would not appear in the register because the register only contains what management has identified?). The board's view of risk shifts from "what is in the register" to "what does the substrate show." **3 . I N H E R I T E D · F R A M E W O R K C A P A B I L I T Y → Three lines of defence Substrate stewardship and second-order observation** The three-lines model continues, but each line is doing different work under substrate operation. The operational line uses the substrate as its operating reality. The risk function and compliance function steward substrate content. Internal audit, the third line, verifies substrate integrity and examines whether the framework is observing itself adequately. The structural model is preserved; the work each line does is more leveraged and more substantively distinct. Joacim Brandell 6 / 12 _The board's risk vocabulary_ PDCA+ v2.0 **4 . I N H E R I T E D · F R A M E W O R K C A P A B I L I T Y → Key Risk Indicators (KRIs) Drift detection and second-order patterns** KRIs continue to provide aggregated operational signals. Under substrate operation, they are joined by drift detection (operational, rule, and reality drift, each with specific attribution and propagation) and second-order patterns (structural inadequacies that aggregate metrics could not catch). The board's risk-information diet shifts from aggregated indicators to a combination of aggregates and structural signals. The combination is more substantive than either alone. |**5 . I N H E R I T E D ·**|**F R A M E W O R K C A P A B I L I T Y →**| |---|---| |**Material weakness / significant deficiency**|**Second-order observation of governance**
**health**| The audit committee's vocabulary for control failures retains its legal weight; nothing about the framework displaces this language for financial-reporting-control purposes. Under substrate operation, however, the conjunction observes patterns the established categories do not — authority drift, governance maturity, substrate-change patterns — that produce information the audit committee has not previously had. The committee's oversight extends beyond its traditional remit into the governance health of the framework apparatus itself. Each translation is a bridge. The inherited concept remains useful for what it was developed for; the framework capability extends what the board can govern; the combination produces an oversight practice richer than either component could produce alone. Boards developing facility with these translations acquire governance capabilities their predecessor boards did not have access to. This is what makes the territory genuinely new — not that the inherited vocabulary becomes obsolete, but that the new vocabulary extends what can be governed in addition to what already could be. #### **T H E T R A N S L A T I O N S , I N O N E S E N T E N C E** _Five bridges between inherited governance vocabulary and framework capabilities — risk appetite as managed posture, risk register supplemented by chain and findings, three lines of defence preserved but more leveraged, KRIs joined by drift detection and second-order patterns, material-weakness vocabulary extended by governance-health observation. Each translation extends rather than replaces what the board already knows how to do._ ## **What boards now need to govern** The framework's capabilities open a new oversight territory. This section names what that territory contains, honest about the demands it places on board members' time, attention, and developed capabilities. **Strategic compliance posture as a board-level conversation** Joacim Brandell 7 / 12 _The board's risk vocabulary_ PDCA+ v2.0 Boards currently address compliance through the audit committee or the risk committee, depending on charter. The conversation typically focuses on regulatory adherence — are we meeting our obligations, are there findings, are remediation efforts on track. Under substrate operation, compliance posture becomes a strategic variable the board may need to engage with directly. Which regimes the organisation chooses to operate under, which risk acceptances the board endorses at the strategic level, how compliance posture should shift in response to environmental changes — these become board-level conversations that may not fit cleanly into existing committee charters. Boards have several options for handling this. Some will expand the risk committee's scope to include strategic compliance. Some will expand the audit committee's scope. Some will establish a new committee — sometimes called a technology committee, sometimes a compliance committee, sometimes a governance committee — with explicit responsibility for the new territory. The specific structure is the board's decision; what matters is that the conversation has a defined home and that the home has the capacity and authority to hold the conversation substantively. ### **Substrate health as a continuing oversight concern** Under substrate operation, the substrate itself becomes something the board has to govern the health of. Is the substrate being stewarded adequately? Are its bindings current with regime evolution? Is its authority structure being maintained? Are conjunction findings being addressed? Is governance of substrate changes operating as intended? These are not questions any committee currently has explicit responsibility for, because the substrate did not exist to be governed. The board needs to assign this responsibility somewhere, give it the necessary access to substrate state, and ensure it has the capability to do the oversight substantively. ### **Authority exercise patterns** The board grants authorities — to the CEO, to other named executives, to committees, to specific roles. Under substrate operation, the exercise of those authorities becomes observable as a pattern over time. This produces a new oversight question: are the authorities the board has granted being exercised within their scope, with appropriate frequency, in directions the board would endorse? This is a more substantive form of oversight than the conventional vehicle (management representations and audit findings) supports. It is also more demanding: the board has to look at the actual exercise patterns, form judgements about them, and act on those judgements when the patterns warrant action. ### **Tension governance** Cultural and structural tensions — the kind the tensions piece named — become observable and characterisable under substrate operation. For boards, this opens a new governance territory because the tensions are no longer invisible until they become incidents. The board Joacim Brandell 8 / 12 _The board's risk vocabulary_ PDCA+ v2.0 can observe which tensions exist in the organisation, how they are being monitored, what treatments are being applied, whether the treatments are working. The governance is not about solving the tensions; the tensions are by definition not solvable in the way risks are. The governance is about ensuring the organisation has substantive engagement with the tensions rather than ceremonial response to them. ### **Continuous information flow** Board meetings have historically been periodic events where management presents and the board reviews. Under substrate operation, the underlying information is continuous, and the board's relationship to that information needs deliberate design. Some boards will choose to keep periodic reporting as the primary information flow, with substrate access available between meetings as needed. Some will develop more continuous engagement, with substrate-based dashboards visible to directors between meetings. Some will design hybrid arrangements appropriate to their sector and corporate culture. The specific design is the board's choice; what is required is that the design be deliberate rather than defaulting to historical patterns that may not serve the new information environment. **T H E N E W O V E R S I G H T T E R R I T O R Y , I N O N E S E N T E N C E** _Five new dimensions for board governance: strategic compliance posture as a managed variable, substrate health as continuing oversight, authority exercise patterns as observable phenomena, tension governance as substantive rather than ceremonial engagement, and continuous information flow as a design problem the board has to deliberately address rather than default to historical reporting cadences._ ## **The audit committee's particular role** The audit committee's role shifts in specific ways under substrate operation, beyond what the general translations in §3 capture. Naming the shifts helps the committee anticipate them and develop the capacity to discharge its responsibilities substantively. ### **Oversight of substrate integrity** The audit committee's traditional oversight of internal controls extends naturally into oversight of substrate integrity. Is the substrate change record complete and reliable? Are substrate changes being made under appropriate authority? Is the substrate's audit trail itself auditable? These are questions in the audit committee's natural remit, extended into the new territory the substrate creates. Most audit committees can take this on without dramatic charter changes, but they may need new tools (substrate access, second-order observation reports) and possibly new committee members or advisors with substrate-specific expertise. Joacim Brandell 9 / 12 _The board's risk vocabulary_ PDCA+ v2.0 ### **Engagement with second-order findings** The framework's second-order observations produce findings that are different in kind from traditional audit findings. Conventional findings reflect operational deficiencies — controls not operating, evidence missing, exceptions noted. Second-order findings reflect structural patterns — authority drift, classification drift, regime-binding integrity issues. The audit committee needs to develop the capacity to engage with second-order findings substantively, which means understanding what they mean, how they were detected, what their materiality is, and how they should be addressed. This is a new diet of information for most audit committees, and developing facility with it takes deliberate effort. ### **The external-auditor relationship** The audit committee's relationship with the organisation's external auditors changes under substrate operation, as the auditors piece in the relational perspective described. Audits become inspections of substrate rather than reconstructions; findings shift in character; the cost and disruption of audits change; the value the audits produce changes. The audit committee needs to engage with these shifts in its external-auditor relationship, including possibly reconsidering audit firm selection or engagement structure to align with substratebased operation. ### **The honest-maturity-versus-aggressive-appetite oversight** The economics piece named that better risk visibility can support either honest maturity (deliberate risk-acceptance with full information) or aggressive risk appetite (deliberate edge-of-acceptable operation with sophisticated articulation). The audit committee has a particular role in observing which direction the organisation actually takes once the framework's visibility is available. This is a substantive oversight role that goes beyond verifying that controls operate; it includes forming judgements about whether the patterns of risk acceptance reflect a posture the committee endorses. The role is more demanding than substrate-free operation supports, and committees adopting substrate-based oversight need to develop their own capacity for this kind of substantive judgement. **T H E A U D I T C O M M I T T E E ' S S H I F T , I N O N E S E N T E N C E** _The audit committee's role extends from traditional internal-control oversight to substrateintegrity oversight, engagement with second-order findings, adapted external-auditor relationships, and the substantive oversight of whether the organisation uses substrate-based visibility for honest maturity or for aggressive risk appetite. The role is more demanding than substrate-free operation supports._ Joacim Brandell 10 / 12 _The board's risk vocabulary_ PDCA+ v2.0 ## **What this piece is not** Three honest framings before the next piece to this bearing picks up competitive positioning. First, the piece is not prescribing specific committee structures, charter language, or governance protocols. Each board operates in its own jurisdictional, sectoral, and corporate context, and the specific governance arrangements that work in one context may not work in another. The piece names new territory and identifies the capabilities boards will need to develop to govern it; the specific structures through which capabilities are housed are the board's decision. Second, the piece is not arguing that current board governance is failing. Boards governing with the inherited vocabulary are doing what the available apparatus supports, and most are doing it competently. The framework's contribution is not corrective; it is additive. The new territory extends what can be governed, and boards that engage with the new territory will govern more substantively than boards that do not. This is not a story of replacing inadequate governance; it is a story of acquiring governance capability that previously was not available. Third, the piece is not promising that adopting framework-based oversight reduces board workload. The opposite is closer to true: substrate operation creates more visible governance territory, which increases the substantive oversight the board needs to perform. Boards adopting the framework should expect their substantive oversight workload to grow, even as the periodic-reporting overhead may shrink. The trade-off is generally favourable because substantive oversight is what boards exist to provide, but the workload implication is real and should be acknowledged. ## **Closing** This piece has developed the bridge between inherited risk-governance vocabulary and the capabilities the framework produces. The inherited vocabulary continues to serve the questions it was developed for; the framework capabilities extend the territory the board can govern into areas the inherited vocabulary did not naturally accommodate. Five translations bridge the two; five new dimensions of oversight territory open up; the audit committee's role shifts substantively. None of this replaces what boards already do; all of it adds to what boards can do once the framework's capabilities are in place. The next piece in towards the North picks up competitive and market positioning. The framework's structural commitments produce strategic consequences in market terms — what becomes possible competitively, how positioning shifts relative to substrate-free competitors, what market opportunities open up and which become harder to defend. The positioning piece grounds the strategic narrative in the language of competitive strategy without slipping into advocacy. With the board's risk vocabulary developed in this piece, the positioning piece can build on a shared understanding of what the framework actually produces. Joacim Brandell 11 / 12 _The board's risk vocabulary_ PDCA+ v2.0 Together with the revelation that opened the bearing, the internal-perspective piece, the relational-perspective piece, the economics piece, and this board-vocabulary piece, the North bearing has now developed the case for engagement with the structural absence — diagnostically, internally, externally, financially, and at the governance level. Three pieces remain: competitive positioning, the leadership posture the framework requires, and the trust architecture that ties the bearing together at its close. Each builds on what the first five pieces have established. **W H A T T H I S P I E C E E S T A B L I S H E D , I N O N E S E N T E N C E** _The board's inherited risk-governance vocabulary remains useful for what it was developed for; the framework adds capabilities the inherited vocabulary does not naturally accommodate; five translations bridge the two; five new oversight dimensions open up; the audit committee's role extends in specific ways — and the combination produces governance practice substantively richer than either component could produce alone._ Joacim Brandell 12 / 12