To ensure IT risk is managed in a consistent manner, it is MOST important for IT governance to establish a:

A risk management committee is a component of a framework but doesn't, by itself, ensure consistent management without defined processes and policies.

A risk management framework, such as ISO 31000 or NIST RMF, provides the overarching structure, principles, and processes for managing risk consistently across an organization. It establishes the context, risk assessment methodology, treatment options, monitoring, and reporting mechanisms, ensuring a standardized and repeatable approach to IT risk management.

A balanced scorecard is a performance management tool that might include risk metrics but does not establish the fundamental methodology for consistent risk management.

A risk management reporting tool is an operational instrument that supports a framework but does not define the consistent management approach itself.