4 Risk Management

Purpose and cycle of risk management

Risk management is the coordinated work of identifying, assessing, treating, and monitoring uncertainty that may affect an organization’s objectives. A risk can threaten an objective or create an opportunity, so risk management should support decisions and be integrated into governance, strategy, planning, and daily operations rather than treated as a separate paperwork exercise.

The process is iterative: identify uncertainty, assess and prioritize exposure, choose and implement a proportionate response, and monitor and revise it as conditions change.

Identify risks in relation to objectives

Begin with the objective: a risk matters because it could affect something the organization is trying to achieve. Describe each risk by connecting its Cause, Event, and Consequence. This structure helps distinguish a possible risk from a problem that has already happened.

For example, a key supplier’s reliance on a single production site is the cause; a disruption that delays component deliveries is the event; missed customer orders and lost revenue are possible consequences.

Consider both Operational risks and Strategic risks. Operational risks arise in delivering products and services; examples include equipment failure, fraud, process errors, and staff shortages. Strategic risks may affect direction or long-term success; examples include a new competitor, changing customer needs, a major technology shift, or a strategy based on unreliable assumptions.

Look at internal and external conditions, emerging trends, dependencies, and ways risks could combine.

Assess and prioritize exposure

Estimate the Likelihood and Impact of each risk using criteria suited to the organization and its objectives. Impact may involve financial loss, safety, service quality, legal obligations, reputation, or strategic performance.

A likelihood-impact matrix can help compare risks, but its ratings are estimates, not precise predictions. Use evidence and explain important assumptions. Compare assessed exposure with the organization’s Risk appetite: the type and level of risk it is willing to accept while pursuing its objectives. Prioritize risks that exceed appetite or could seriously affect critical objectives.

Consider existing controls when estimating remaining exposure. Inherent risk is exposure before controls; Residual risk is what remains after controls. Record the assessment and identify who owns the risk.

Choose and implement a response

Choose a response that fits the objective, risk appetite, obligations, and cost of action. Common options are:

• Avoid: stop or change the activity that creates the exposure.

• Reduce: lower likelihood or impact through controls, process changes, or preparation.

• Share: allocate part of the exposure through arrangements such as insurance or contracts; the organization may still retain some exposure.

• Accept: knowingly retain the risk when it is within appetite or further action is not justified.

• Pursue: take or increase risk to capture an opportunity, with appropriate safeguards.

A treatment plan should specify the action, accountable owner, resources, due date, expected effect, and how progress will be checked. For severe disruptions, include contingency and recovery arrangements. Management should weigh treatment benefits against costs and other consequences.

Monitor and review changing risks

Risk management continues after a response is chosen. Monitor whether controls work, whether actions are completed, and whether likelihood, impact, or exposure is changing. Key risk indicators can provide early warning; rising supplier delays, for example, may signal growing continuity risk.

Review risks regularly and when significant events occur, such as a strategy change, new regulation, control failure, or major market shift. Update assessments, escalate risks that exceed delegated authority or appetite, and use lessons from incidents and near misses to improve controls.

Governance, ownership, and reporting

Those responsible for an activity generally own its risks and operate its day-to-day controls. Senior leaders and governing bodies set direction, clarify responsibilities, define risk appetite, and oversee significant exposures. Risk information should support decisions at the appropriate level through clear reporting and challenge.

A risk register can organize this work, but it is useful only when its entries are current, owned, and connected to decisions and action.

For example, if a sole-source supplier could be disrupted and delay delivery of a critical product, assess likelihood and business impact against agreed criteria, identify dependencies and existing safeguards, and assign an owner to develop a backup-sourcing plan. Monitor delivery delays and test the continuity plan.