Summary An effective Risk and Compliance Director works to a calendar rather than a queue. This article sets out an annual governance calendar that anchors the major cycles — framework, appetite, ICAAP or ORSA, EWRA, resilience and supervisory dialogue — so that each receives deliberate attention and none is displaced by the urgent.
The anchor cycles The core cycles are recurring and non-negotiable: strategy and business planning; appetite review; capital assessment (ICAAP for banks, ORSA for insurers); liquidity assessment (ILAAP for banks); financial crime risk assessment (EWRA); operational resilience self-assessment; model inventory review; policy review; and the supervisory dialogue calendar (typically anchored around annual supervisory review).
Sequencing Sequencing matters. Appetite review should feed strategy and business planning. ICAAP or ORSA should draw on appetite and stress. EWRA and resilience assessment should inform the annual risk report to the board. Model inventory review should precede annual validation planning. Sequenced well, cycles reinforce each other; sequenced poorly, they conflict.
Board committee alignment Board committee calendars should be built around the anchor cycles, not vice versa. Board risk committee time should be reserved for the material decisions each cycle produces: appetite approval, ICAAP/ORSA sign-off, EWRA outcomes, resilience findings, and framework changes.
Governance of the calendar The calendar itself is a governance artefact. It should be approved at the start of the year, monitored for slippage, and revised only through documented change control. Ad-hoc reprioritisation is the enemy of disciplined governance.
CRO and board implications Boards should be able to see the calendar, see progress against it, and see reasons for any material change. A calendar that is invisible is a calendar that is not being run.
Practical implementation Documented annual calendar mapping cycles to committees; ownership named for each cycle; slippage reporting; change control for material revisions; end-of-year review of calendar effectiveness.
Limitations Institution-specific circumstances (regulatory events, corporate change, market stress) will disrupt any calendar. The point is to make disruption visible and deliberate, not to eliminate it.
Related reading See [Effective CRO operating model](/insights/effective-cro-operating-model), [Governance, Risk and Compliance](/expertise/grc), [Regulatory Compliance](/expertise/regulatory-compliance) and [Governance](/governance).
Frequently asked questions
What should risk leaders know about the anchor cycles?
The core cycles are recurring and non-negotiable: strategy and business planning; appetite review; capital assessment (ICAAP for banks, ORSA for insurers); liquidity assessment (ILAAP for banks); financial crime risk assessment (EWRA); operational resilience self-assessment; model inventory review; policy review; and the supervisory dialogue calendar (typically anchored around annual supervisory review).
What should risk leaders know about sequencing?
Sequencing matters. Appetite review should feed strategy and business planning. ICAAP or ORSA should draw on appetite and stress. EWRA and resilience assessment should inform the annual risk report to the board. Model inventory review should precede annual validation planning. Sequenced well, cycles reinforce each other; sequenced poorly, they conflict.
What should risk leaders know about board committee alignment?
Board committee calendars should be built around the anchor cycles, not vice versa. Board risk committee time should be reserved for the material decisions each cycle produces: appetite approval, ICAAP/ORSA sign-off, EWRA outcomes, resilience findings, and framework changes.
What should risk leaders know about governance of the calendar?
The calendar itself is a governance artefact. It should be approved at the start of the year, monitored for slippage, and revised only through documented change control. Ad-hoc reprioritisation is the enemy of disciplined governance.
What should risk leaders know about cRO and board implications?
Boards should be able to see the calendar, see progress against it, and see reasons for any material change. A calendar that is invisible is a calendar that is not being run.