vaayaa Inclusive Education
Professional risk assessment

Corporate Governance and Business Administration Risk Assessment: Records, Authority and Continuity Controls

A worked example of how a company administration function finds, scores and controls governance risks, from board records and delegated authority to fraud, data loss and supplier dependency.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Corporate Governance and Business Administration course

Executive summary

This assessment shows how a company administration function can find, rate and control the risks that affect sound board decisions, accurate records and the trust of stakeholders. Eight risks were chosen because they are plausible in everyday governance and administration work, including records and minutes, delegated authority, payments support, supplier dependency, data loss, handover failure, conflicts of interest and office duties. Most inherent risks sit in the High band, because administration errors are frequent and their effects spread quickly. Once existing and added controls are in place, most fall to Medium or Low, while a serious system outage remains Medium because its impact stays significant. The first actions are a board calendar with named owners, a split of approval rights for payments and contracts, a tested restore of records and a documented handover for each key role. The business is a teaching example, so every score illustrates method rather than a real organization.

Focus area
Corporate governance and business administration
Setting
Administration and governance function of a small to mid-sized private company with a board of directors
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the governance and administration function of a small to mid-sized private company, including board support, company records, policy management, delegated authorities, supplier administration, payments support and business continuity. It considers risks to decisions, assets, legal duties and stakeholder trust. It does not give legal or company law advice. Jurisdiction, company size and systems are assumptions made for teaching only.

Context

The company has a board of directors, a company secretary, an administration manager, two administrators who handle minutes, registers and filings, and a finance team that supports payments. Records are kept in a document management system, with spreadsheets used for registers and approval logs. Suppliers provide office, IT, payroll and facilities services. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed, so students can see how residual risk is reduced.

Objectives, assets and stakeholders

The objective is to support sound and lawful board decisions, keep accurate and available company records, protect funds and information, and maintain the confidence of owners, lenders, staff and regulators. The assets in scope are board papers, minutes and statutory registers, contracts and delegated authority records, the document management system, payment approvals, supplier relationships and the reputation of the administration team. Stakeholders include directors, shareholders, the company secretary, administration staff, finance colleagues, suppliers, customers, auditors and the authorities that receive filings. Every risk has one owner role, and the company secretary keeps the register current and reports to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H04
4 Likely Likelihood 4, impact 3, score 12, high: H05 Likelihood 4, impact 4, score 16, high: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H06 Likelihood 3, impact 5, score 15, high: H02 H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H06 H07 Likelihood 2, impact 4, score 8, medium: H03 H04
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Inaccurate or incomplete board records and minutes 16 High 6 Medium Company secretary
H02 Decisions taken outside delegated authority 15 High 6 Medium Company secretary
H03 Fraud and leakage through payments and expenses 15 High 8 Medium Finance lead
H04 Loss of records or system outage during business hours 20 Critical 8 Medium IT manager
H05 Loss of knowledge when administrators or directors leave 12 High 4 Low Administration manager
H06 Dependence on a single supplier for administration services 12 High 6 Medium Procurement lead
H07 Undeclared conflicts of interest at board level 10 High 6 Medium Chair of the board
H08 Office safety and facilities duties not tracked 9 Medium 4 Low Facilities coordinator
H01

Inaccurate or incomplete board records and minutes

Operational Before 16 After 6

Minutes, resolutions and statutory registers are drafted late, incomplete or unsigned, so decisions cannot be proven and filings may be wrong.

Who or what is affected: Directors, shareholders and the company secretary

Causes

Heavy meeting load, drafting done after the event and unclear decision wording.

Consequences

Disputed decisions, filing errors and weak evidence in audit or legal review.

Existing controls

  • Minutes are drafted by the administrator and checked by the company secretary.
  • A register of statutory books is kept in the document system.

Control gaps

No one checks that resolutions are signed and filed within a set period after each meeting.

Additional controls

  • Prevent: Use a standard minute template with required fields and a sign off step before circulation.
  • Detect: Check each set of minutes against the agenda and resolutions at the next meeting.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Company secretary Target: Within 30 days Early warning: Minutes that are not approved within 14 days of the meeting.
H02

Decisions taken outside delegated authority

Legal and compliance Before 15 After 6

Managers commit spend, sign contracts or approve policy changes beyond their limits, or the delegation schedule is out of date, so decisions lack valid authority.

Who or what is affected: Directors, managers, suppliers and the company

Causes

Schedule not updated after role changes and urgent decisions made informally.

Consequences

Contracts that cannot be enforced, personal liability for directors and board criticism.

Existing controls

  • A delegated authority schedule approved by the board is kept.
  • Contracts above a set value need a director signature.

Control gaps

The schedule is reviewed only once a year and is not checked against actual approvals.

Additional controls

  • Prevent: Link system approval workflows to the delegated authority limits and block actions above them.
  • Respond: Bring any decision taken without authority to the next board for ratification or reversal.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Company secretary Target: Within 45 days Early warning: A contract or payment signed by someone not named in the current schedule.
H03

Fraud and leakage through payments and expenses

Financial Before 15 After 8

Fake invoices, altered supplier bank details or inflated expense claims are paid, so funds leave the company through small, repeated or hidden transactions.

Who or what is affected: Shareholders, lenders, staff and suppliers

Causes

Trust placed in single approvers, pressure on budgets and weak checks on new suppliers.

Consequences

Direct loss, recovery costs, legal action and damage to trust.

Existing controls

  • Expense claims need a line manager approval and itemized receipts.
  • Supplier bank changes are confirmed by phone with a known contact.

Control gaps

Checks are sampled, so repeated small payments can pass unseen.

Additional controls

  • Prevent: Verify new suppliers and every bank detail change through a known contact before payment.
  • Detect: Review payment runs for duplicates, round sums and new payees each month.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Finance lead Target: Within 45 days Early warning: A supplier bank detail change with no recorded call back.
H04

Loss of records or system outage during business hours

Technology and data Before 20 After 8

A ransomware event, hardware fault or cloud outage makes board papers, contracts and registers unavailable or corrupted, so governance and administration stop.

Who or what is affected: Directors, staff, customers and regulators

Causes

Phishing, unpatched software and single points of failure in storage.

Consequences

Lost evidence, missed filings, delayed decisions and reputational harm.

Existing controls

  • Records are backed up daily to a separate location.
  • Accounts for the document system use individual sign in.

Control gaps

Restores are never tested end to end, so backup success is assumed rather than proven.

Additional controls

  • Prevent: Enable multi-factor sign in and restrict administrator rights to named staff.
  • Recover: Test a full restore of board records each quarter and keep a written recovery runbook.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: A failed or skipped backup job in any single week.
H05

Loss of knowledge when administrators or directors leave

People Before 12 After 4

A departing administrator takes unwritten procedures, contacts and filing dates with them, so tasks are missed or repeated by the next person.

Who or what is affected: Administration team, board and suppliers

Causes

Procedures held in people's heads and short notice resignations.

Consequences

Missed deadlines, duplicate work and errors in records.

Existing controls

  • Role descriptions list the main duties.
  • A shared calendar holds key filing and meeting dates.

Control gaps

Handover notes are optional and not checked by anyone before the person leaves.

Additional controls

  • Prevent: Require a written handover checklist and a shadow period before any key role changes hands.
  • Respond: Appoint an interim owner for each open task within one week of a departure.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Administration manager Target: Within 60 days Early warning: A key role vacant for more than two weeks without an interim owner.
H06

Dependence on a single supplier for administration services

Supplier Before 12 After 6

An outsourced payroll, document or facilities provider fails, changes terms or stops service, so administration tasks cannot be completed on time.

Who or what is affected: Staff, suppliers and customers

Causes

Cost savings that concentrate work with one provider and weak exit terms.

Consequences

Late pay or filings, loss of data access and higher costs.

Existing controls

  • The main supplier contract sets out service levels and reporting.
  • Service reports are reviewed by the administration manager each month.

Control gaps

Exit terms and data return rights are not tested or reviewed against current needs.

Additional controls

  • Prevent: Identify a second supplier for critical services and agree data return terms.
  • Respond: Keep a short list of contingency providers and a plan for switching in an emergency.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 90 days Early warning: A supplier service report that misses an agreed service level twice.
H07

Undeclared conflicts of interest at board level

Reputational Before 10 After 6

A director or senior manager has a personal or family link to a supplier, customer or decision, and it is not declared, so decisions may favor a private interest.

Who or what is affected: Directors, shareholders, staff and the public

Causes

Long relationships, informal networks and unclear rules on gifts and hospitality.

Consequences

Invalid decisions, loss of trust, regulatory attention and reputational harm.

Existing controls

  • Directors sign a conflicts declaration on appointment.
  • Minutes record any declared interest at the start of each meeting.

Control gaps

Declarations are not compared with current contracts, suppliers or customers.

Additional controls

  • Prevent: Require a written declaration before each board decision on contracts or appointments.
  • Detect: Compare declared interests with the supplier and customer list each quarter.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Chair of the board Target: Within 60 days Early warning: A declared interest linked to an item on the next board agenda.
H08

Office safety and facilities duties not tracked

Safety Before 9 After 4

Fire checks, first aid records, electrical testing or visitor logs are overdue or missing, so staff and visitors are exposed and the company cannot show duties were met.

Who or what is affected: Staff, visitors, contractors and the building owner

Causes

Reports sent to one inbox and no reminders before due dates.

Consequences

Injury, enforcement action, insurance dispute and loss of confidence.

Existing controls

  • A facilities calendar lists the main inspections.
  • The facilities contractor sends service reports to the administration team.

Control gaps

No one checks that reports are filed or that actions are closed on time.

Additional controls

  • Prevent: Assign an owner and a backup owner for every inspection and check the calendar each month.
  • Respond: Close any overdue item with a dated repair plan and inform the people affected.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Facilities coordinator Target: Within 30 days Early warning: An inspection due within 14 days with no named owner.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and additional controls are in place, and it must never be higher than the inherent score. Impact is judged on decision quality, money lost, legal exposure, time to correct and harm to trust, and a governance risk is not rated down simply because it has not yet happened. Anything still High needs director or senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Administration staff who do the work should challenge the ratings, the company secretary reviews them at each board cycle, and any rating is reopened when an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Board papers circulated later than the agreed deadline before a meeting.Escalate to the company secretary when any paper is late, and to the chair if two meetings in a row are affected.
Payments or contract approvals made by a single person without a second approval.Escalate to the finance lead at once and hold the payment until a second approval is recorded.
Restore tests of company records that fail or are not run in the period.Escalate to the IT manager within one day, and to the board if a restore has not succeeded within a month.
Declared interests linked to an item on the next board agenda with no recorded action.Escalate to the chair before the meeting, and minute the decision on how the interest will be managed.
Open actions from board minutes that are past their due date.Escalate to the company secretary when an action is 30 days overdue, and to the chair after 60 days.

Contingency arrangements

If a serious event occurs, such as loss of board records, a payment sent to the wrong party or a missed filing, the company secretary stops related activity, preserves evidence and informs the chair. The IT manager isolates affected systems and restores records from the latest tested backup. Legal and audit contacts are made through the chair or finance lead as required in the relevant jurisdiction. Urgent decisions are taken through a written resolution or an emergency meeting, and staff and stakeholders are told what they need to know early and plainly.

Prioritized action plan

  1. Publish a board and committee calendar with a named owner for every paper, owner company secretary, within 30 days.
  2. Split approval of payments and contracts and review delegated authority limits, owner finance lead, within 45 days.
  3. Test a full restore of board records and the document system from backup, owner IT manager, within 30 days.
  4. Document a handover checklist for every administration role, owner administration manager, within 60 days.
  5. Require a written conflicts declaration before each board decision, owner chair of the board, within 60 days.

Conclusion

Sound governance and administration rely on a few steady habits: a board calendar with owners, clear delegated authority, split approvals, tested backups and documented handovers. The highest scores sit with records errors, approval breakdown and system outage, and each has actions that reduce the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified legal or governance advice for any real question about company law or directors' duties.

Assumptions and limitations

Assumptions

  • The company is a private company with a board, a company secretary and written delegated authorities.
  • Administrators use shared software on managed computers and sign documents through an agreed process.
  • Jurisdiction is not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real company or board.
  • Governance and company law differ by country and change over time, so specialist review is needed.
  • This is educational content and is not legal, financial or governance advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Board committee terms of reference model
  • Hierarchy of controls
  • Business continuity planning lifecycle

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Corporate Governance and Business Administration course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners