Risk Management: Roles and Responsibilities

Line management and Risk Owners — First Line

Line management is accountable for risks arising from activities within its established responsibilities. It ensures risks are identified, assigned, assessed and managed, and takes decisions within its delegated authority.

A Risk Owner is the named individual responsible for maintaining and managing a specific risk within that accountability structure. This includes maintaining a decision-relevant assessment, understanding controls and assurance, proposing or coordinating treatment, monitoring change and escalating when necessary.

Delegating tasks does not transfer management accountability or the Risk Owner’s responsibility for managing and escalating the risk. For shared risks, coordination does not remove the responsibilities of contributing managers.

Framework and specialist functions — Second Line

OSI-ICS is responsible for the Risk Management process. Its Risk Management Lead is responsible for establishing, implementing and continuously improving CERN’s common risk-management framework. The mandate includes maintaining methodology and governance documentation, coordinating implementation and calibration, consolidating risk information, monitoring framework quality and supporting governance reporting.

Specialist Second Line functions are performed by existing CERN services within their established mandates—for example, services responsible for Safety, legal matters, financial controls and computer security. These responsibilities do not imply the creation of additional posts or a separate team. The services provide standards, advice, oversight, monitoring, challenge or assurance within their areas of responsibility, maintain domain requirements and criteria, and escalate through their established authority.

Second Line functions do not assume operational risk ownership or replace Internal Audit’s independent assurance.

Management and governance bodies

Management may approve treatment, commit resources and accept exposure only within its delegated authority.

The Site Operations Board reviews significant cross-departmental and enterprise-level risk matters, addresses dependencies and priorities, and decides within its formally delegated mandate. Matters requiring higher authority are referred to the Director-General or Executive Board, as applicable.

The Executive Board approves CERN’s appetite and governance principles, reviews CERN-wide exposure, sets priorities and decides matters requiring executive authority.

The Director-General retains ultimate responsibility for CERN risk management within the organisational resilience framework.

Governance decisions do not transfer operational risk ownership.

Internal Audit — Third Line

Internal Audit provides independent assurance on governance, risk management and internal control, without management responsibility.