Corporate governance and risk management are not separate disciplines. They’re the same obligation viewed from different levels of the organisation. At the board level, governance means ensuring the right decisions are made, that accountability is clear, and that the organisation can demonstrate it has acted in the best interests of shareholders, employees, and stakeholders. At the operational level, that requires a structured, reliable process for identifying, assessing, and managing risk. A risk register is the mechanism that connects the two.
For a comprehensive guide to selecting the right GRC software for governance — covering evaluation criteria, vendor comparison, and Australian-specific requirements — see our complete GRC software buyer’s guide.
For Australian directors and governance professionals, the expectations around risk management are both legally grounded and increasingly scrutinised. This article explains how a well-maintained risk register supports corporate governance obligations, what boards should expect to see, and how Australian regulatory frameworks — including the Corporations Act 2001 and the ASX Corporate Governance Principles and Recommendations — shape those expectations.
Directors’ Duties and Risk Management Under Australian Law
Australian company directors operate under a clearly defined set of legal obligations. The Corporations Act 2001 (Cth) imposes duties on directors that are directly relevant to risk management.
Duty of care and diligence (s 180): Directors must exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would exercise. The business judgement rule (s 180(2)) provides a safe harbour for directors who make informed, good-faith business decisions — but “informed” is the operative word. Directors who cannot demonstrate they understood the material risks facing the organisation, and took reasonable steps to address them, will struggle to rely on this protection.
Duty of good faith (s 181): Directors must act in good faith in the best interests of the corporation. Risk management failures that damage the company — particularly foreseeable ones that were never documented or actioned — can expose directors to claims of bad faith where they knew of the risk and failed to act.
Insolvent trading obligations (s 588G): Directors have a positive duty to prevent the company from incurring debts when insolvent. Financial risk management — and specifically the identification and monitoring of financial risks in the register — is directly relevant to this obligation.
Beyond the Corporations Act, ASIC has made clear through enforcement action and regulatory guidance that it expects directors to have genuine oversight of material risks, not merely nominal governance structures on paper.
The ASX Corporate Governance Principles and Recommendations
For listed companies, the ASX Corporate Governance Council’s Corporate Governance Principles and Recommendations (4th edition) provide the most detailed framework for how boards should approach risk management. The “if not, why not” disclosure regime requires listed companies to either comply with the recommendations or explain their deviation.
Recommendation 7.1 states that the board or a committee should have a risk committee (or equivalent) responsible for oversight of the company’s risk management framework. Recommendation 7.2 requires that management designs and implements the risk management framework and reports to the board on whether material risks are being managed effectively. Recommendation 7.3 asks organisations to disclose whether they have an internal audit function and, if not, how the board satisfies itself that the risk management framework is operating effectively. Recommendation 7.4 recommends that companies disclose whether they have any material exposure to environmental or social risks, and if so, how they manage those risks.
Running through all of these recommendations is a common thread: the board must be able to demonstrate active, informed oversight of risk — not passive receipt of management assurances. A risk register is the primary instrument through which that oversight is exercised.
What a Risk Register Provides to the Board
It Makes Risk Visible and Comparable
Directors cannot govern risks they cannot see. A risk register surfaces the organisation’s material risks — strategic, operational, financial, compliance, reputational — in a structured, comparable format. The risk rating system allows the board to see at a glance which risks sit at critical or high levels, how those ratings have changed over time, and whether management’s risk reduction efforts are working. Without a risk register, the board is dependent on management’s verbal assurances. With one, those assurances are grounded in documented evidence the board can interrogate.
It Connects Risk to Accountability
The risk register assigns each risk to a named owner — an individual with responsibility for monitoring the risk, maintaining controls, and completing treatment actions. At the governance level, this creates a clear line between risk identification and management accountability. When the board reviews the register, it can see not just what risks exist but who is responsible for them and what actions are in progress. This is particularly important for directors managing their obligations under the Corporations Act. “We had a risk management process” is a weaker defence than “we had a documented register, each risk had a named owner, and the board reviewed treatment progress quarterly.”
It Supports Regulatory Reporting and Disclosure
Listed companies have continuous disclosure obligations under ASX Listing Rule 3.1: they must disclose information that a reasonable person would expect to have a material effect on the price or value of securities. A risk register that is regularly reviewed and actioned is also the foundation for accurate, credible risk disclosures in the annual report. Boards that can point to a live, maintained register when preparing their risk management disclosures are in a fundamentally stronger position than those working from ad hoc management summaries.
It Provides Audit Trail Evidence
When regulators, auditors, or litigation parties scrutinise a company’s governance, one of the first questions is: what did the board know, and when did they know it? A risk register with a timestamped audit trail — showing when risks were first identified, how ratings changed, what treatment actions were completed, and when the board last reviewed material risks — provides documentary evidence that genuine governance was exercised. This is not achievable with a spreadsheet that overwrites its history.
What Good Board-Level Risk Oversight Looks Like
The ASX recommendations and ASIC guidance point toward a model of board risk oversight with several consistent features. The board (or its risk committee) should receive regular risk reports that include: a summary of the organisation’s current risk profile, any changes to material risks since the last report, the status of treatment actions for high and critical risks, and any new risks identified since the last review. These reports should be driven by the risk register — not produced independently of it.
The risk register itself should be accessible to the board, not just to management. Directors who only receive a PowerPoint summary have no way to verify that the underlying register is complete, current, and accurate. Material risks should be discussed at board level, not just noted. The board should be asking: Is the current rating accurate? Are the controls in place adequate? Is the treatment plan progressing? What would it take for this risk to escalate further?
Frequently Asked Questions
Are directors personally liable for risk management failures?
Potentially yes. Under the Corporations Act 2001, directors can face personal liability for breaching their duty of care and diligence (s 180). ASIC has pursued directors in cases where risk management failures were foreseeable and where the director failed to take reasonable steps to address the risk. Industrial manslaughter laws in multiple Australian states create criminal exposure for directors where gross negligence or reckless conduct causes a worker’s death. The existence of a well-maintained, board-reviewed risk register is not a guarantee against liability, but it is a significant demonstration of due diligence.
Do private companies need a board-level risk register?
There is no statutory requirement for private companies to maintain a board-level risk register in the same way listed companies follow the ASX recommendations. However, the director duties under the Corporations Act apply equally to private company directors. For any private company with material financial, operational, or compliance risk exposure — which describes most businesses of meaningful scale — a board-reviewed risk register is best practice, not a compliance formality.
How often should the board review the risk register?
For listed companies, quarterly board or risk committee review of the material risk register is standard practice, with annual review of the full risk framework. For private companies, review frequency should match the volatility of the risk environment — at minimum annually for the full register, with triggered reviews following any significant operational, financial, or regulatory change. High and critical risks should be reviewed more frequently — at least quarterly.
What is the difference between a risk register and a risk management framework?
A risk management framework is the broader governance structure that defines how risk is identified, assessed, treated, and monitored across the organisation — including policies, roles, escalation pathways, and review cycles. The risk register is the operational instrument within that framework: the structured document where all identified risks are recorded and managed. A framework without a register is aspirational; a register without a framework lacks the governance structure to be credible.
Strengthen Your Governance with a Purpose-Built Risk Register
For boards and executives serious about corporate governance, a spreadsheet risk register is an inadequate foundation. Genuine governance requires a system that provides a complete audit trail, enforces consistent risk ratings, sends automated reminders to risk owners, generates board-ready risk reports, and connects your risk register to your live Australian legislative and regulatory obligations.
Lahebo is built specifically to support this kind of governance-grade risk management — with module-level compliance mapping, board reporting dashboards, and a risk register architecture designed to meet the expectations of the Corporations Act, ASX Principles, and Australian regulators.
For a comprehensive introduction to what a risk register is and how to structure one, see: What Is a Risk Register? The Complete Guide for Australian Businesses.
Strengthen your corporate governance with Lahebo — book a demo today.