Publish and revise the delegated band thresholds

In plain terms

Set and maintain the nine thresholds that other layers depend on. A band with no published threshold is inert, and every decision relying on it cannot be exercised.

What is being judged

Where operational speed stops and risk authority begins. Set the band too high and operational roles accumulate risk authority by default, which is the failure delegated bands exist to prevent. Set it too low and every routine decision escalates, which produces a governance function nobody can staff and a workaround nobody logs.

Six thresholds are published as determination mechanisms and three as marked defaults. The judgment differs: a mechanism has to be applicable by someone without the Board in the room, and a default has to be defensible as a starting point without being adopted unexamined.

What this decision does not cover

It does not make individual decisions inside any band. It does not set the consequence class scheme, which is §5B and is not a band.

When it fires

On event. On regulatory change affecting an obligation in the register. On an incident where a band is implicated. When a band produces an outcome the Board would not have accepted. This is the most important trigger and the hardest to detect, because the outcome was correctly decided under the published threshold.

On cycle. Annually.

What you need before deciding

The current table. Where each band has actually fallen in the last period, which is the only evidence a threshold is set correctly. The risk appetite statement. Any exception or escalation pattern clustering just under a threshold, which usually means the threshold is wrong rather than that the cases were.

How this goes wrong

Publication without revision: nine thresholds set once and never revisited, so the framework runs on numbers chosen before anyone had experience of them. Retroactive revision: tightening a band and treating past decisions as findings, when they were correct under the threshold in force. The uncounted band: a table stating a count that disagrees with its rows, which happened in this specification and is now checked at build time.

Related decisions

Downstream every delegated band: L1-02, L2-06 and L2-07, L3-10 and L3-11, L4-POL-04 and L4-POL-05, L4-RSK-02 and L4-RSK-04, L5-04 and L5-05, L5-06, L6-05.

Upstream L4-RSK-01 risk appetite.

Instrument references

No instrument publishes delegated bands. COBIT and ISO/IEC 38500 both assume authority is delegated and neither specifies the mechanism.