CIMMYT’s risk governance model

Governing body

(Board of Trustees)

Delegates Responsibility

Delegates Responsibility

Audit/ Advisory Reports

Accountability Reporting

First and second line

The third line

The business

Internal audit

Assurance & Advisory Engagements (Independent Assurance)

The Three Lines in Action

Responsible for daily operations and for reporting overall performance to the Board of Trustees.

Internal Audit provides independent assurance and advice on governance, risk management and internal control practices of the organization.

The arrows show flows: downward (delegation, resources, oversight), upward (accountability and reporting), and across (alignment and collaboration).

At CIMMYT, the Board of Trustees sets the strategic direction of the organization. The Board of Trustees delegates to management the responsibility for day-to-day operations of the Center.

Risk management and other oversight functions provide support, coordination and guidance on risk, control and compliance related matters.