State-Owned Entity Governance, Risk Appetite and Accountability Training Course

Programme Summary

State-owned entity governance, risk appetite and accountability form the subject of this ten-day training course for strategic-level officials, ending in a governance and risk oversight framework for one state body. State bodies carry public money, public mandates and close scrutiny, yet ownership roles, risk limits and reporting lines are often unclear. The programme moves from principles of ownership and oversight, through diagnosis of control and risk gaps, to the design of appetite, assurance and reporting, then to application in a capstone. Mars Training Centre UK delivers this programme in state-owned entity governance.

The Business Case

When ownership, risk limits and reporting are loosely defined, losses surface late, accountability is disputed and oversight bodies receive information they cannot act on. Leaders who set clear mandates and measurable risk limits can intervene earlier and defend decisions under scrutiny.

• Risk Exposure: Becomes visible earlier as an agreed risk appetite statement replaces informal judgement.
• Control Failures: Fall as control ownership is assigned and tested through an internal control framework.
• Oversight Quality: Improves as board and ministry reports focus on decisions rather than activity.

Principles and Evidence Base

• ISO 31000: Its principles, framework and process for managing risk shape the risk work in Sessions 3, 4 and 6.
• COSO Enterprise Risk Management: Its framework linking risk with strategy and performance structures the appetite and reporting work in Sessions 5 to 7.
• ISSAI 100: Its basic principles of public-sector auditing, covering financial, performance and compliance audit, inform the assurance work in Sessions 8 and 9.

Intended Participants

• Officials who exercise the ownership function over state bodies and approve their mandates.
• Directors-general who answer for results, spending and risk within a ministry.
• Heads of governance and risk who build the oversight and reporting structure.
• Heads of internal control and audit liaison who test whether controls work.

The programme serves ministries, state-owned utilities, public financial institutions and government agencies.

Learning Outcomes

1. Participants will be able to evaluate the ownership, board and reporting arrangements of a state body against recognised principles.
2. Participants will be able to diagnose weaknesses in mandate clarity, control ownership and risk reporting.
3. Participants will be able to construct a risk appetite statement with measurable limits and escalation triggers.
4. Participants will be able to design an internal control framework with named owners and testing routines.
5. Participants will be able to prioritise assurance activity across three lines of defence.
6. Participants will be able to justify a governance and risk oversight framework to a minister, a board and an audit body.

Programme Structure

Day 1: Ownership and Mandate in State Bodies

What should the state expect of a body it owns, and how is that expectation written down?

• Ownership Function and Mandate Letter
• Public Purpose and Commercial Objective Map
• Separation of Policy, Ownership and Regulation
• Ownership Policy Template
• Case Review of Two Sector Mandates

Day 2: Boards, Committees and Decision Rights

Who decides what, and how is that recorded?

• Board Composition and Skills Matrix
• Committee Charter Design
• Delegation of Authority Schedule
• Conflict of Interest Register
• Decision Rights Matrix

Day 3: Risk Principles and Public Risk Types

Which risks matter most to a state body, and how are they described consistently?

• ISO 31000 Principles and Framework
• Strategic, Fiscal and Operational Risk Taxonomy
• Reputational and Political Risk Cases
• Risk Language and Rating Scales
• Risk Ownership Allocation

Day 4: Diagnosing Governance and Control Gaps

Where do current arrangements fail, and what evidence shows it?

• Governance Maturity Diagnostic
• Control Environment Review
• Root Cause Analysis of Past Failures
• Reporting Line and Accountability Gap Map
• Gap Register and Priority Ranking

Day 5: Risk Appetite and Tolerance

How much risk may a state body take, and who sets the limit?

• COSO Enterprise Risk Management Components
• Risk Appetite Statement Drafting
• Tolerance Limits and Key Risk Indicators
• Escalation Triggers and Breach Protocol
• Appetite Alignment with Strategy and Budget

Day 6: Risk Registers and Risk Assessment

How are exposures identified, scored and ranked so leaders can act?

• Risk Register Structure
• Likelihood and Impact Scoring
• Scenario and Stress Testing for Public Bodies
• Risk Treatment Options Table
• Heat Map and Top Risk Report

Day 7: Internal Control Frameworks

How do controls turn a risk decision into daily practice?

• Control Objectives and Control Activities
• Segregation of Duties Analysis
• Procurement and Payment Control Points
• Fraud Risk Indicators
• Control Self-Assessment Method

Day 8: Assurance and Audit Relationships

Which assurance does the board receive, and is it enough?

• Three Lines of Defence Model
• ISSAI 100 Audit Types and Their Uses
• Assurance Map Construction
• Audit Committee Reporting Calendar
• Management Response and Follow-Up Tracker

Day 9: Accountability, Transparency and Reporting

How do officials show the public and oversight bodies that the body is well run?

• Accountability Chain Design
• Performance and Risk Dashboard Layout
• Annual Governance Statement Outline
• Disclosure and Transparency Checklist
• Minister and Board Briefing Format

Day 10: Applying State-Owned Entity Governance to One State Body

Is the governance and risk oversight framework ready to put before a minister and a board?

• Applying the Session 1 Ownership Policy to the Chosen Body
• Testing the Session 4 Gap Register Against the Draft Framework
• Fitting the Session 5 Appetite Statement to the Session 6 Risk Register
• Checking Session 8 Assurance Map Coverage
• Completing the Governance and Risk Oversight Framework

Methodology

The programme is built around case analysis and structured exercises. Participants work in small teams on an anonymised state body, review its mandate, rate its risks and draft its framework, then defend the result before a simulated ministerial panel. Each session ends with a peer review of the artefact produced that day.

• Suggested activity: Drafting a risk appetite statement for a utility and a public finance body.
• Suggested activity: Mapping assurance coverage for a ministry's five highest risks.
• Suggested activity: Rehearsing a board briefing on a limit breach.

Capstone Output

Each participant completes a governance and risk oversight framework for one state body. It contains an ownership policy, a decision rights matrix, a risk appetite statement, a risk register, a control framework, an assurance map and a reporting pack. It is used to brief a minister, a board and an audit body, and to guide the body's next governance review.

Frequently Asked Questions

Is state-owned entity governance suitable for officials who are not risk specialists?

Yes. State-owned entity governance is set at strategic level and assumes responsibility for ownership, oversight or spending decisions, not technical risk modelling or audit qualifications.

Which standards does state-owned entity governance rest on in this course?

State-owned entity governance here rests on ISO 31000 for risk management, COSO Enterprise Risk Management for appetite and reporting, and ISSAI 100 for public-sector auditing principles.

How is the framework from state-owned entity governance training used at work?

You use the framework from state-owned entity governance training to brief a minister and a board, set risk limits, assign control owners and guide the next governance review.

How does state-owned entity governance differ from a corporate governance course for company directors?

State-owned entity governance centres on public mandates, ownership roles, public accountability and risk limits for state bodies, while a corporate governance course for directors centres on board duties in commercial companies.