Non-financial Risk Policy

The GCF Non-financial Risk Policy defines a framework to manage operational, staffing, IT, disaster, and reputation risks. It implements a three-level responsibility model: First Level (risk owners), Second Level (independent control functions, primarily the ORMC), and Third Level (assurance via the Office of the Internal Auditor). The policy mandates quarterly risk dashboard reporting to senior management and the Board, annual risk control self-assessments for high-priority processes, and a business continuity management approach led by the Office of the Executive Director during disruptions.

• The GCF defines non-financial risk as the potential for losses resulting from failures in people, processes, technology, or external events, categorizing these into six specific types: Operational Process Error Risk, Staffing Risk, Disasters and Other Events Risk, IT Systems Failure Risk, Cyber Attack Risk, and Reputation Risk.
• Risk management is organized into three distinct levels of responsibility: the First Level consists of accountable units who own and manage the risk; the Second Level provides independent control to mitigate asymmetric incentives and optimism; and the Third Level, the Office of the Internal Auditor (OIA), provides assurance through audits and reviews.
• Specific GCF divisions are designated as First Level Operational Risk Owners for key activities: the Division of Country Programming for accreditation; the Private Sector Facility and Division of Mitigation and Adaptation for funding proposal reviews; the CFO for disbursements; and the Portfolio Monitoring Unit for monitoring and evaluation.
• The Operational Risk Management Committee (ORMC) serves as the Second Level of Responsibility for operational, IT, reputation, and staffing risks, with duties including reviewing the Risk Dashboard, finalizing impact levels of risk events, and providing independent recommendations for improvement.
• To ensure control effectiveness, the GCF requires risk control self-assessments to be performed annually for high-priority processes and at least once every three years for lower-priority processes.
• Business Continuity Management (BCM) is led by the Office of the Executive Director (OED), which acts as the crisis director with authority to classify business disruption events and implement response plans supported by a security task force.
• Reputation risk management involves the nomination of a Reputation Risk Owner responsible for maintaining a Communications Plan and developing Response Plans for high-impact threats, particularly those where the GCF has zero risk tolerance.

APA

Green Climate Fund (2018). Non-financial Risk Policy. https://www.greenclimate.fund/sites/default/files/document/non-financial-risk-policy-component-vi.pdf

Chicago

Green Climate Fund. Non-financial Risk Policy. 2018. https://www.greenclimate.fund/sites/default/files/document/non-financial-risk-policy-component-vi.pdf.

Wikipedia

{{cite report |author=Green Climate Fund |title=Non-financial Risk Policy |date=2 April 2018 |url=https://www.greenclimate.fund/sites/default/files/document/non-financial-risk-policy-component-vi.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{greenclimatefund2018nonfinancial, author = {{Green Climate Fund}}, title = {{Non-financial Risk Policy}}, institution = {Green Climate Fund}, year = {2018}, month = apr, url = {https://www.greenclimate.fund/sites/default/files/document/non-financial-risk-policy-component-vi.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }