Choosing a risk framework for your housing association

If you’re asking what risk framework should a UK housing association use, you’re probably not starting from scratch. Most associations already have something in place. The real problem is that many frameworks are inherited from a previous regime, built around paperwork rather than decisions, or so over-engineered that the board approves the document once and nobody looks at it again until the regulator asks. The register gets updated annually. The assurance map sits on a shared drive nobody visits, a pattern observed repeatedly across the sector.

If you are a board member, risk lead, or governance officer who needs to justify a specific framework choice and build something that actually works, this article gives you that. Our founding belief at Sarah Vause Consulting is that governance should be designed rather than accumulated. That belief shapes everything that follows.

What the Regulator of Social Housing actually expects

The RSH does not mandate ISO 31000 or COSO, the Governance and Financial Viability Standard 2024 sets outcomes, not named standards. What it does require is a framework that gives the board genuine assurance, protects social housing assets, and demonstrates prudent management of risk. Start there, not with a named model.

The governance and viability standard in plain terms

The standard requires registered providers to have an effective, board-approved business planning, risk management, and internal controls assurance framework covering all areas of the business. “Effective” means the board has real visibility of risk, controls are realistic and tested, and assurance reaches decision-makers in a form they can act on. The standard also requires stress testing of plans, including multivariate analysis against severe but plausible scenarios, not simple sensitivity testing. That is a high bar, and it represents a genuine challenge for frameworks built primarily around annual review cycles.

Board ownership versus operational management

The regulator expects the board to set risk appetite and receive assurance. Management runs the framework day to day. When those two roles collapse into each other, frameworks fail inspection. Boards that rubber-stamp a risk register presented by the executive are not exercising ownership; they are providing cover, and regulators have noted this pattern in governance reviews. Getting this distinction right before choosing any named model matters more than the label you put on the framework.

How lender expectations overlay the regulatory floor

Lenders such as THFC and major sector banks expect evidence that financial risks are identified early and that the framework supports timely escalation. Covenant compliance reporting, income cover monitoring, and security adequacy are not separate from your risk framework: they sit inside it. A well-designed framework accommodates both RSH expectations and lender reporting requirements without running two separate processes.

What risk framework should a UK housing association use, ISO 31000, COSO, or bespoke?

The named frameworks are reference points, not requirements. The sector norm is bespoke. What matters is whether your framework meets three tests: board assurance, regulatory confidence, and operational usefulness. The rest is detail.

Why bespoke frameworks dominate the sector

Housing associations vary too much in size, stock profile, development exposure, and geography for a single named model to fit cleanly. Organisations such as Ark Housing and Clyde Valley Group publish their own risk management frameworks for housing associations, built around their specific regulatory obligations and board governance needs rather than an off-the-shelf standard. That is typical across the sector and the right approach for most providers.

When ISO 31000 is the right starting point

ISO 31000 works well when the goal is to embed risk thinking across operations without building a heavy governance structure. It is principle-based, flexible, and straightforward to phase in. For a housing association that needs to improve risk culture and create a working risk register without adding bureaucracy, ISO 31000 is the lower-friction option. Think of it as the “embed and improve” choice.

When COSO ERM makes more sense

COSO suits organisations where the board, external auditors, or funders expect a formal governance and control model with documented components and clear lines of oversight. It is heavier to implement but stronger on auditability. A medium-sized association facing regulatory scrutiny or a significant refinancing may find COSO’s structure easier to defend externally. If your primary need is to govern, document, and assure, COSO is worth the additional effort.

The risk appetite statement: where most frameworks fall apart

Risk appetite statements are the part of risk frameworks that boards tend to approve and then ignore. They are either so broad as to be meaningless or so technical that non-executive directors cannot connect them to actual decisions. Neither version is useful.

What a risk appetite statement needs to do

A good statement tells the board and management which risks the association is willing to take in pursuit of its objectives, and how much. It should be expressed in terms that connect to real decisions: treasury policy, development pipeline, rent setting, and stock investment. The RSH 2025 Sector Risk Profile reports that sector EBITDA MRI interest cover (a measure of how comfortably interest payments are covered by earnings before major cost adjustments) fell to 91% in 2024/25 and is not forecast to recover above 100% until 2027/28. A financial risk appetite statement that does not engage with that reality is not fit for purpose.

Published examples from associations including Ark and Clyde Valley show providers calibrating appetite by category: moderate for strategic initiatives, conservative on financial risk, low to moderate on operations, and averse on compliance and governance. That structure, which you can cross-reference with a risk appetite statement UK housing template, gives the board a genuine reference point when facing real decisions.

Common mistakes and how to avoid them

The same problems surface repeatedly across the sector. Appetite statements that are identical across every risk category, so “cautious” applies to everything from cyber risk to development exposure. Statements disconnected from the strategic risk register, so the board approves one document and reviews another. Boards that sign off the statement without debating its content. The fix for all three is the same. Draft the statement around real decisions the board faces, bring it to a board workshop before formal approval, and map every risk category in the register to the relevant appetite threshold.

The core artefacts your framework needs

A risk framework is only as useful as its working parts. Three artefacts translate framework intent into real governance: the strategic risk register, the assurance map, and the board reporting cadence. Build these proportionately, not comprehensively.

Building a strategic risk register that earns board trust

The RSH 2025 Sector Risk Profile identifies the categories your register should reflect. These include financial viability and refinancing, building safety and decency compliance, data integrity, development and sales exposure, and climate risk. Each entry should include a risk description, inherent rating, controls, residual rating, a named risk owner, and the source of assurance. Fewer well-owned risks outperform a long register that no one manages. As a practical guide, a risk register template for housing associations typically covers 10 to 15 strategic risks, enough to give the board meaningful focus without overwhelming accountability.

An assurance map that shows real coverage, not theoretical lines

Most assurance maps in the sector are drawn on a whiteboard and then filed. A useful map shows where assurance actually comes from, such as management monitoring, internal audit, external audit, regulatory evidence, committee review, and board oversight. Unlike the Institute of Internal Auditors’ Three Lines Model, which divides responsibility into ownership, oversight, and independent audit, an assurance map for a social landlord reflects a broader ecosystem, including outsourced services, external scrutiny, and tenant-facing arrangements. Build it to show genuine coverage, not aspiration.

A reporting cadence that supports decisions, not filing

As a matter of good practice, risk should reach the board at least quarterly, with clear escalation routes for material changes between cycles. A good board risk report covers the risks that have moved, why they moved, what action has been taken, and what the board needs to decide. Boards do not need every risk on every report. They need the right risks at the right time with enough context to act.

How to know if your current framework is falling short

Many housing associations do not know whether their framework is genuinely effective or just compliant on paper. Four questions reveal the answer quickly. Does the board debate risk appetite or just approve the statement? Can anyone show you the last time the assurance map identified a gap? Does the risk register reflect the decisions being made right now? Have controls been tested, or just listed?

If most of those answers are no, the framework is decorative. The Conscious Governance Diagnostic™ at Sarah Vause Consulting is a structured assessment built for exactly this moment. It maps obligations across 11 governance and risk categories, identifies where the framework is under-developed or misaligned, and produces a clear, prioritised action plan. It is the structured starting point for boards that recognise the gap but are not sure where it is.

Making the business case to your board and lenders

A risk lead who wants to redesign or upgrade the framework still needs board approval to act. The business case does not need to be long. One or two pages with clear asks will land better than a governance review report nobody reads before the meeting. Boards often resist framework redesign proposals because they read as abstract or expensive, anchoring the case in specific regulatory language and concrete gaps addresses both objections directly.

What the business case needs to cover

The case needs to address three things. What the current framework cannot do, what the RSH Governance and Financial Viability Standard 2024 and lender expectations require, and what a proportionate redesign will cost and deliver. Boards approve things they can picture, not things they have to interpret.

What risk framework should a UK housing association use, practical tests for proportionality

The framework should match the risk profile and capacity of the organisation, not the size of the ambition or the complexity of a published standard. A 2,000-home association with one risk officer needs something different from a 20,000-home provider. Proportionality is not a compromise. It is the point.

Start with what you need, not what looks impressive

Ultimately, the answer to what risk framework should a UK housing association use is not a named standard, it is a proportionate, bespoke model aligned to the RSH Governance and Financial Viability Standard 2024. The question is not which framework to adopt. The question is whether your framework gives your board real assurance, satisfies the regulator, and supports operational decisions. Most associations need a well-designed bespoke approach, not a textbook model.

Start with the risk appetite statement. Build the register and assurance map around it. Create a reporting cadence the board actually uses. If the starting point is unclear, the Conscious Governance Diagnostic™ at Sarah Vause Consulting is built precisely for this moment. Get in touch to find out what your framework is missing before the regulator does.