Governance
1. Institutional Roles and Mandates
NRM is not institutionally neutral. Its authority and legitimacy depend on clearly defined roles for GCRI, GRF, GRA, and the distributed network of Regional Nexus Consortia (RNCs) and Nexus Competence Cells (NCCs).
1.1 GCRI as Technical and Scientific Authority for NRM
Mandate
The Global Centre for Risk & Innovation (GCRI) is the technical and scientific authority for Nexus Risk Management. Its mandate covers:
Design and stewardship of:
Nexus Rail core architecture,
Core Risk Ontology and domain extensions,
UNOSINT pipelines and AEP formats,
NRM scoring engines, simulation methods, and model governance frameworks.
Operation of global and reference infrastructure (e.g., reference observatories, reference NRM Profiles).
Leadership of research, experimentation, and methodological innovation relevant to NRM.
Responsibilities
GCRI shall:
Define and maintain the technical specifications that underlie NRM, including reference implementations and SDKs.
Validate and approve new models, methods, and ontological changes proposed for NRM use, subject to GRF governance review.
Coordinate Nexus Competence Cells (NCCs) as distributed technical and research nodes:
Support NCCs in implementing and extending NRM in countries, sectors, and institutions.
Anchor the Risk Academy:
Develop curricula and training standards for NRM practitioners (analysts, modelers, validation experts, chairs, etc.).
Advise GRF and GRA:
Provide scientific and technical input to governance and capital decisions involving NRM.
GCRI is thus responsible for ensuring NRM is scientifically sound, technically robust, and continuously updated.
1.2 GRF as Governance and Consortia Authority for NRM
Mandate
The Global Risks Forum (GRF) is the governance and consortia authority for NRM. Its mandate covers:
The constitutional, normative, and organisational aspects of NRM.
The design and enforcement of NRM standards, conformance levels, and profiles.
Convening and stewarding NRM-related consortia, including RNCs and thematic coalitions.
Operating the Council Register and contributing to dual logging (with the Nexus Ledger) for decisions with legal/protocol effect.
Responsibilities
GRF shall:
Articulate governance principles for NRM (polycentricity, inclusivity, accountability, anti-capture).
Charter, recognise, and oversee Regional Nexus Consortia and other NRM consortia, ensuring adherence to:
NRM standards,
Data sovereignty and justice commitments,
Participation and grievance procedures.
Define and maintain:
NRM Conformance Levels (CL),
Evidence Quality Levels (EQL),
Governance templates for NRM Profiles, AEP assurance, and consortia charters.
Provide forums and processes for:
Multi-level dialogue (global–regional–national–community–Indigenous),
Contested-knowledge resolution,
Community and Indigenous participation in NRM decisions.
Dual log governance-relevant actions:
Record key NRM decisions, certifications, and conformance changes in the GRF Council Register, mirrored in the Nexus Ledger where required.
GRF ensures NRM is legitimate, accountable, and resistant to capture, and that it serves the public interest, not narrow institutional agendas.
1.3 GRA as Capital and Industry Authority for NRM
Mandate
The Global Risks Alliance (GRA) is the capital and industry authority for NRM. Its mandate covers:
Organising financial institutions, insurers, reinsurers, asset managers, corporates, and infrastructure operators into NRM-aligned alliances.
Translating NRM evidence and profiles into risk transfer, risk-sharing, and resilience investment programmes.
Ensuring industry participation respects NRM’s public-interest governance and standards.
Responsibilities
GRA shall:
Convene and manage membership-based industry alliances operating on the Nexus Rail:
Define participation rules and codes of conduct for members,
Align product development with NRM Profiles and GRF standards.
Co-design financial and risk instruments that use NRM evidence:
Sovereign & sub-sovereign facilities,
Parametric covers and reinsurance layers,
Resilience bonds, credit enhancements, and other structured products.
Ensure transparency and auditability:
Products and programmes claiming NRM alignment must use:
NRM Profiles and AEPs,
Clear trigger and allocation logic,
Dual logging of key events (e.g., payouts, escalations) where appropriate.
Protect public-interest guardrails:
Enforce rules that prevent proprietary black-box models from substituting for NRM evidence in public decisions,
Ensure fair access and non-discriminatory terms in public-interest NRM programmes.
GRA ensures NRM is not merely analytic, but connected to real capital flows and operational risk-sharing, under robust rules.
1.4 Roles of Regional Nexus Consortia (RNCs) and Nexus Competence Cells (NCCs)
Regional Nexus Consortia (RNCs) and Nexus Competence Cells (NCCs) are the distributed implementation arms of NRM.
RNCs (e.g., Singapore Nexus/APAC, Kenya Nexus/East Africa, etc.) are regional consortia operating under local legal frameworks and GRF licenses.
NCCs are institutionally hosted units (often in universities, agencies, or infrastructure operators) responsible for localisation and operation of NRM capabilities.
RNC responsibilities
RNCs shall:
Act as regional stewards of NRM:
Adapt and apply NRM Profiles to regional realities,
Coordinate cross-border, cross-sector NRM initiatives.
Host or coordinate regional instances of:
Nexus Rail infrastructure,
UNOSINT observatories,
Risk Academy programmes.
Facilitate participation of:
National governments and agencies,
Regional financial institutions,
Community and Indigenous networks.
Report on regional NRM performance, including:
Adoption, use, and impact of NRM Profiles,
Equity and justice outcomes,
Lessons for global evolution of NRM.
NCC responsibilities
NCCs shall:
Operate as technical and analytical cells:
Implement NRM ontologies, data pipelines, and models,
Produce NRM AEPs and scenario analyses for local contexts.
Serve as interface nodes between:
Local institutions (universities, agencies, firms, communities),
GCRI, GRF, and their global counterparts.
Support capacity-building:
Train local experts and practitioners via the Risk Academy,
Support integration of NRM into curricula and institutional processes.
Uphold NRM standards:
Conform to CL/EQL requirements,
Implement governance, ethics, and participation protocols locally.
Together, RNCs and NCCs ensure NRM is globally coherent and locally grounded.
2. NRM Governance Model
2.1 Governance Principles (Polycentricity, Inclusivity, Accountability, Anti-Capture)
NRM governance is built on four core principles:
Polycentricity
Multiple centres of decision-making exist (global, regional, national, community), each with defined mandates and coordination mechanisms.
No single institution can unilaterally dictate how NRM is used everywhere.
Inclusivity
Those affected by NRM-related decisions—especially communities and Indigenous nations—must have structured opportunities to:
Participate in design and review,
Supply and interpret evidence,
Challenge outcomes and seek remedies.
Accountability
Decisions and standards must be:
Traceable to their authors and rationales,
Reviewable by oversight entities,
Open to revision when harm, error, or bias is demonstrated.
Anti-capture
Governance design actively mitigates risks of:
Regulatory capture by powerful industries or states,
Technocratic capture by narrow epistemic communities,
Data or platform capture by a small set of vendors or infrastructures.
These principles guide all institutional and procedural design choices in NRM governance.
2.2 Multi-Level Governance: Global, Regional, National, Community, Indigenous
NRM governance is multi-level:
Global level
GCRI, GRF, GRA define and steward global standards, profiles, and infrastructure baselines.
Interfaces with global standard-setting bodies and multilaterals.
Regional level
RNCs adapt and apply NRM to regional contexts, coordinating cross-border initiatives.
Regional councils bring together states, regional organisations, industry, and community representatives.
National level
National authorities and NCCs:
Integrate NRM into national risk, finance, and resilience strategies,
Align NRM with domestic law and policy.
National multi-stakeholder forums help prioritise NRM Profiles and use cases.
Community and municipal level
Local structures (municipal councils, community organisations) use NRM for local risk decisions and engage in participatory modelling and scenario work.
Indigenous level
Indigenous governance bodies negotiate:
How (and if) their knowledge participates in NRM,
How consent, benefits, and oversight are structured,
How Indigenous ontologies and governance traditions are recognised.
Multi-level interactions are governed by explicit subsidiarity and escalation rules, so decisions are made at the lowest appropriate level, with higher levels providing support and coordination.
2.3 Decision Rights and Escalation Paths
NRM governance specifies who decides what, and how disputes are resolved:
Decision rights
Designation of:
Technical decisions (e.g., model inclusion, ontology changes) → primarily GCRI with GRF oversight,
Governance and standard-setting decisions → GRF councils,
Capital and product design decisions → GRA, under GRF/GCRI guardrails,
Local implementation details → RNCs and NCCs, within NRM conformance boundaries.
Escalation paths
When conflicts occur (e.g., between:
Local and regional interpretations,
Community and state perspectives,
Technical and governance views):
Clear steps exist for:
Mediation and joint review,
GRF panel adjudication,
Appeal to higher-level councils or independent oversight.
Dual logging
Key governance decisions are dual logged:
In the GRF Council Register for legal/institutional record,
In the Nexus Ledger (where applicable) for protocol-level enforcement and transparency.
This structure ensures that NRM decisions are structured, reviewable, and enforceable without rigid centralisation.
3. NRM Standards and Conformance
3.1 NRM Conformance Levels (CL1–CL4)
NRM defines Conformance Levels (CL1–CL4) to describe the maturity and completeness of implementations:
CL1 – Awareness and Partial Alignment
Ad-hoc use of NRM concepts and some ontology mapping,
Limited use of AEPs or NRM Profiles,
No formal certification.
CL2 – Basic NRM Integration
Systems and institutions:
Use approved NRM Profiles in selected use cases,
Consume AEPs and produce some NRM-conformant outputs,
Implement basic governance and documentation requirements.
CL3 – Full NRM Conformance
Systems and institutions:
Systematically use NRM Profiles for relevant decisions,
Produce and consume AEPs aligned with EQL requirements,
Implement model governance, participation, and grievance mechanisms,
Are audited and certified by GRF-accredited bodies.
CL4 – NRM Anchor / Reference Implementation
Entities (e.g., GCRI reference systems, leading RNCs, exemplary NCCs) that:
Contribute significantly to NRM evolution,
Host reference implementations of NRM components,
Serve as training and demonstration sites.
Profiles, systems, and institutions may claim specific CL levels for specific scopes; GRF oversees the use of these claims.
3.2 Evidence Quality Levels (EQL1–EQL5) for NRM Contexts
Evidence Quality Levels (EQL1–EQL5) classify the robustness and suitability of evidence for different NRM uses:
EQL1 – Exploratory / Hypothesis-Generating
Early-stage, experimental models or datasets,
Suitable for research and internal learning, not for high-stakes decisions.
EQL2 – Indicative
Limited validation, known gaps and biases,
Useable for framing issues and low-stakes decisions, with explicit caveats.
EQL3 – Operational
Reasonable validation, documented uncertainties,
Suitable for typical operational uses and mid-stakes decisions.
EQL4 – Decision-Critical
Strong validation, multi-source triangulation, rigorous uncertainty treatment,
Suitable for high-stakes policy or capital decisions, subject to governance review.
EQL5 – Exceptional / Constitutional
Highest level of scrutiny, including:
Independent replication,
Community and Indigenous review where relevant,
Deep ethical and equity analysis.
Reserved for decisions with long-term or constitutional consequences.
NRM Profiles specify minimum EQL requirements for each use case (e.g., “EQL3+ for portfolio stress testing, EQL4+ for triggering sovereign facility payouts”).
3.3 Certification and Accreditation Processes (Systems, Institutions, Profiles)
GRF, with GCRI support, operates or accredits certification schemes for:
Systems and platforms
Certification that a system:
Implements relevant NRM components correctly,
Meets security and governance requirements,
Properly handles provenance and evidence.
Institutions
Certification of institutions as:
CL2, CL3, or CL4 NRM entities for specific roles (e.g., NCC, RNC operator, AEP producer).
NRM Profiles
Formal adoption and labelling of profiles as:
GCRI/GRF-approved NRM Profiles,
With specified CL/EQL usage constraints.
Accredited third parties may carry out assessments under GRF’s supervision; decisions are dual logged and publicly registered.
3.4 Compliance and Enforcement Mechanisms
Compliance is enforced via:
Contractual mechanisms
NRM conformance commitments embedded in:
Membership agreements (for RNCs, GRA alliances),
Facility term sheets,
Data sharing and licensing agreements.
Registry and reputational mechanisms
Public registries of:
Certified entities and systems,
Sanctions and suspensions for non-compliance.
Naming and shaming for repeated or serious violations.
Protocol-level enforcement
In some cases, NRM conformance is enforced at the protocol level (via NSF rules and Nexus Ledger):
Automatic revocation of entitlements or access when breaches are detected,
Smart-contract-based restrictions on non-conformant entities in certain programmes.
Remedial pathways
Entities may regain status through:
Corrective action plans,
Re-certification processes,
Demonstrated improvements in governance and practice.
Compliance is treated as a means to protect systemic integrity and public interest, not a punitive end in itself.
4. Authority Establishment and Recognition
4.1 Legal and Policy Instruments that Recognise NRM
NRM becomes authoritative when embedded into:
National laws and regulations
E.g., as recognised frameworks for:
Systemic risk assessment,
Climate and disaster risk management,
Risk finance eligibility criteria.
Supervisory guidance and expectations
Central banks and regulators may:
Reference NRM Profiles and EQLs in stress testing and disclosure,
Encourage or mandate use of NRM for specific systemic risk assessments.
Public finance and procurement frameworks
Inclusion of NRM requirements in:
Budgeting methodologies,
Infrastructure planning guidelines,
Public procurement RFPs.
International agreements
References to NRM in memoranda, frameworks, or treaties dealing with risk, climate, resilience, or digital public goods.
NRM specifications are designed to be modularly adoptable, allowing jurisdictions to start with specific profiles or sectors.
4.2 Memoranda of Understanding with Standards Bodies (e.g., ISO, BIS, NIST, WMO)
GRF and GCRI seek MoUs and cooperative arrangements with:
Technical standard bodies (e.g., ISO, IEC, NIST, ETSI),
Financial standard-setting bodies (e.g., BIS/BCBS, IAIS, IOSCO),
Scientific and climate bodies (e.g., WMO, IPCC-linked entities),
DRR bodies (e.g., UNDRR).
These MoUs aim to:
Coordinate development of overlapping standards,
Ensure mappings and crosswalks remain current,
Avoid duplicative or conflicting guidance,
Explore co-badging or mutual recognition arrangements in certain domains.
4.3 Relationships with Multilateral and Regional Organisations
NRM’s global authority is strengthened through relationships with:
Multilateral development banks and funds (e.g., World Bank, regional development banks, climate funds),
UN entities (e.g., UNDP, WHO, FAO, UNEP, UNFCCC institutions),
Regional organisations (e.g., AU, ASEAN, EU, OAS, regional economic communities).
These relationships may encompass:
Adoption of NRM Profiles in programme design,
Use of NRM AEPs for project appraisal and monitoring,
Co-financing of NRM infrastructure (RNCs, NCCs, Risk Academy programmes),
Joint governance arrangements for specific NRM initiatives.
4.4 Pathways to Regulatory Reliance on NRM Evidence
Regulators may develop reliance frameworks similar to those used for accounting, ratings, or benchmarks:
Recognition of NRM Profiles as:
Acceptable frameworks for stress scenarios and systemic risk analyses,
Reference methodologies for specific regulatory requirements.
Approval of AEP producers and NCCs as:
Recognised third-party providers of systemic risk evidence,
Subject to oversight and quality standards.
Integration into supervisory processes:
Use of NRM outputs in:
Supervisory reviews (e.g., SREP, ORSA),
Macroprudential assessments,
Resolution planning and contingency frameworks.
Reliance does not imply blind acceptance; regulators retain discretion and judgement, but NRM provides a common technical and governance baseline.
5. Community, Indigenous, and Stakeholder Governance
5.1 Formal Roles for Communities and Indigenous Nations in NRM Governance
NRM formally embeds community and Indigenous roles:
Representation
Seats for community and Indigenous delegates in relevant GRF and RNC governance bodies.
Authority
Veto or consent rights for:
Use of their knowledge in NRM,
NRM Profiles that materially affect their territories and rights.
Advisory and review
Participation in:
AEP review panels,
Model and ontology governance committees,
Evaluation and oversight processes.
These roles are defined in charters and MoUs, not as symbolic gestures but as substantive governance powers.
5.2 Rights to Refusal, Withdrawal, and Opaque Knowledge
NRM recognises that some knowledge:
Cannot ethically or legally be codified or shared,
May be conditional on specific relational obligations.
Therefore communities and Indigenous nations have:
Right to refusal
To decline participation in certain NRM Profiles or data flows without penalty.
Right to withdrawal
To withdraw previously shared knowledge or data from future NRM use, subject to negotiated transition arrangements.
Right to opacity
To maintain certain knowledge as opaque: informing governance and decisions without being fully encoded in the semantic and data layers.
These rights are encoded in:
Legal agreements,
Ontology and data governance rules,
Technical access and deletion mechanisms where feasible.
5.3 Grievance, Appeal, and Remedy Mechanisms
NRM establishes pathways for stakeholders to:
File grievances
E.g., about misuse of data, misrepresentation of risk, harmful decisions linked to NRM.
Seek appeal
Against specific NRM-based decisions or certifications,
Through structured review panels at appropriate governance levels.
Obtain remedies
Where harm is established, remedies may include:
Correction or withdrawal of NRM outputs,
Public acknowledgement and apologies,
Changes to NRM Profiles or standards,
Financial or other forms of reparation (particularly where NRM-linked programmes caused or exacerbated harm).
Grievance systems must be:
Accessible (including non-digital pathways),
Fair and timely,
Independent of direct control by implicated actors.
5.4 Participatory Modelling and Co-Design Processes
Participatory modelling and co-design are core methods in NRM:
Co-design of Profiles and scenarios
Communities, Indigenous nations, local practitioners, and other stakeholders are involved from the outset in shaping:
The questions NRM asks,
The metrics and thresholds considered,
The scenarios deemed plausible and relevant.
Participatory modelling practices
Workshops, citizen assemblies, living labs, and other participatory processes help:
Build shared understanding of risks and trade-offs,
Identify blind spots and local insights.
Capacity-building
Risk Academy programmes explicitly include:
Training for communities and Indigenous practitioners,
Co-creation of educational materials.
This ensures NRM is co-produced, not simply deployed onto communities from above.
6. Meta-Governance and Reflexivity
6.1 Risk of the NRM System Itself (Meta-Risk)
NRM itself creates new risks:
Procyclicality
Shared risk models and scenarios can amplify herd behaviour.
Concentration
Reliance on a common rail may create common failure modes.
Bias and exclusion
Ontologies and models may systematically underrepresent certain groups or risk types.
Abuse of authority
NRM governance structures could be captured or misused.
NRM therefore treats its own operation as an object of risk management:
Meta-risk is analysed, monitored, and managed using NRM tools and governance, with explicit KPIs and safeguards.
6.2 Independent Review and Oversight Structures
Independent oversight structures provide external checks:
Independent review panels
Composed of experts, community representatives, and ethicists with no direct operational role in NRM.
External audits
Periodic audits of:
Governance processes,
Technical architectures,
Equity and justice outcomes.
Whistle-blower protections
Safe channels for individuals to report concerns about misuse or malfunctions in NRM without fear of retaliation.
Oversight maintains trust and legitimacy and can recommend changes to GCRI, GRF, and GRA.
6.3 Protocols for Rollback, Safe Mode, and Architecture Changes
NRM includes protocols for:
Rollback
Reverting specific models, profiles, or rules when harm or major error is detected.
Safe mode
Operating the Rail and NRM capabilities in a degraded but safe configuration during crises or suspected compromise:
Restricting certain automated actions,
Limiting high-stakes uses of AI,
Reverting to conservative, well-understood methods.
Architecture changes
Governing major structural changes:
New classes of actors or domains,
Fundamental ontology shifts,
Changes in the balance of centralised vs federated components.
These changes follow the change control processes described earlier, with enhanced scrutiny for meta-level modifications.
6.4 Transparency and Public Reporting Requirements
Finally, NRM is subject to strong transparency and public reporting obligations:
Public dashboards
High-level indicators of:
Systemic risk and resilience,
NRM adoption and coverage,
Equity and justice outcomes.
Annual NRM reports
Summarising:
Key decisions and changes in NRM governance and standards,
Evaluations of performance and impact,
Responses to grievances and oversight findings.
Open documentation
NRM specifications, model cards, AEP catalogues (with appropriate redactions), and governance records are accessible to the public, except where constrained by legitimate security, privacy, or sovereignty concerns.
Transparency is a primary defence against capture, misuse, and erosion of public trust in Nexus Risk Management.
Last updated
Was this helpful?