Risk Management: Practical Questions

Risk management remains part of normal management responsibility. The approved principles clarify accountability, risk-taking, escalation and decision authority while respecting existing CERN mandates, rules and mandatory requirements.

Detailed methods, workflows and role mappings are governed through separate, controlled supporting documents. Their status should be checked before use.

Risk appetite expresses the amount and type of risk CERN is generally willing to pursue or retain in achieving its objectives.

Risk tolerance defines the boundary within which an authorised management level may retain residual risk without further escalation. Residual risk is the exposure remaining after considering existing controls.

Appetite guides judgement; it does not determine a decision automatically. Credible consequences, uncertainty, assurance, dependencies and combined exposure also matter.

The approved principles identify the following triggers:

• Residual exposure exceeds tolerance or the decision-maker’s mandate.
• A credible severe consequence requires explicit assurance, even where the assessed risk position would not otherwise require escalation.
• Treatment requires resources or trade-offs beyond the Risk Owner’s authority.
• Cross-organisational dependencies, combined exposure or conflicting objectives require a broader management decision.
• Significant uncertainty or change affects applicable obligations, key assumptions or control effectiveness.

Escalation enables a decision at the appropriate level and is a positive oversight action.

Decisions must follow the applicable mandate and delegated authority. The Appetite Principles identify the Executive Board as the default authority for escalated exposure, with provision for formal delegation. Significant cross-departmental and enterprise-level matters are addressed through the Site Operations Board within its delegated mandate.

Only an authority empowered to accept the exposure may do so. Acceptance above the approved tolerance boundary requires explicit authority and a recorded justification, conditions and review arrangements.

Acceptance does not transfer ownership, remove the duty to maintain controls or prevent later escalation. Risk appetite never authorises non-compliance with mandatory obligations.

Risks internal to a scientific collaboration remain the responsibility of its own governance structure. CERN’s framework applies to risks arising from collaborations that could significantly affect CERN’s objectives, activities, obligations, resources, infrastructure or institutional position.