Risk management is about more than responding to potential threats. As we explored in Part 1 of this series, a structured approach to risk can help organisations understand uncertainty, consider potential opportunities and make more informed decisions about the risks they are prepared to take.
Translating risk management principles into practical processes can present challenges. These can include information being held across different teams, securing appropriate leadership engagement and maintaining risk information as circumstances change.
In this second instalment, we’ll explore the practical aspects of risk management, including roles and responsibilities, common challenges and ways of embedding risk awareness across an organisation. We’ll also look at risk management documentation, including risk registers, risk assessment information, action tracking and risk scoring.
Drawing on my experience supporting organisations with governance, compliance and risk activity, I’ll also consider the practical importance of keeping risk information structured, current and useful for oversight and decision-making.
Roles and responsibilities within risk management
Effective risk management depends on clear responsibilities and appropriate oversight across an organisation. The precise structure will vary according to the organisation’s size, complexity and governance arrangements, but responsibilities commonly include:
Board of directors: The Board provides oversight of risk management and sets expectations for how risk is considered across the organisation. Depending on the organisation’s governance arrangements, this may include approving or overseeing risk appetite, considering significant risks as part of strategic decision-making, and receiving assurance on the effectiveness of risk management and internal controls.
Executive management: Executive management is typically responsible for implementing the organisation’s approach to risk management within day-to-day operations. This can include establishing appropriate processes and controls, promoting risk awareness, allocating responsibilities and resources, and ensuring significant risks and emerging issues are escalated through the appropriate governance arrangements.
Risk management function: Where an organisation has a dedicated risk function, it may be responsible for developing and maintaining the risk management framework, providing specialist support and challenge, coordinating risk information and reporting on the organisation’s risk profile to senior management and the Board. In smaller organisations, some of these responsibilities may sit within other roles or functions.
Business units: Managers and employees have an important role in identifying and managing risks within their areas of responsibility. This can include operating agreed controls, identifying and escalating new or changing risks, progressing agreed actions and providing accurate information to support risk monitoring and reporting.
The precise allocation of these responsibilities will vary between organisations, particularly where there is no dedicated risk function. Whatever the structure, effective risk management requires appropriate leadership oversight alongside clear ownership of risks, controls and actions throughout the organisation. Information about new or changing risks also needs to reach the people responsible for monitoring and decision-making.
Common challenges in risk management
Risk information is often held across different teams and functions, making effective communication and coordination important. Where information remains in separate parts of the organisation, there is a risk that significant issues, changes or dependencies are not reflected consistently in risk assessments, registers and reporting.
Some areas that may require particular attention include:
Overcoming silos and fostering collaboration
One of the primary challenges is the presence of organisational silos. Risk management often requires collaboration and communication across different departments and levels of the organisation. However, when teams operate in isolation, it can lead to a fragmented approach to risk management, resulting in duplicated efforts, missed opportunities, and potentially conflicting strategies.
Clear responsibilities, appropriate routes for escalation and established processes for sharing risk information can help address this. The approach should reflect the organisation’s size and structure, but the objective is to ensure that relevant information reaches risk owners and those responsible for oversight and reporting.
Supporting effective leadership oversight
Appropriate engagement from the Board and executive management is important to effective risk management. Without clear leadership expectations, responsibilities may be unclear, risk activity may become disconnected from decision-making, and agreed actions may not receive appropriate attention.
Risk information should be presented in a way that supports meaningful oversight and decision-making. Clear reporting on significant risks, changes in exposure, the effectiveness of controls and the status of agreed actions can help leadership understand where attention, challenge or further assurance may be required.
Keeping pace with a dynamic risk landscape
The risk landscape is constantly evolving, with new risks emerging and existing risks changing in nature or significance. Keeping risk information current can present a practical challenge. While organisations may undertake formal risk reviews at scheduled intervals, their arrangements should also allow significant new or changing risks to be identified, assessed and escalated when they arise.
Risk registers and supporting documentation should therefore be reviewed at appropriate intervals and updated when material changes occur. Clear processes for reporting emerging risks, changes to existing risks and progress against agreed actions can help ensure that information used for oversight remains relevant and current.
Embedding risk management into organisational activity
Risk management is most useful when it forms part of normal organisational activity rather than operating as a separate administrative exercise. This requires people to understand their responsibilities for identifying, managing and escalating risks and for progressing actions within their areas of responsibility.
Leadership can support this by setting clear expectations, communicating responsibilities and ensuring that appropriate risk information is considered within relevant decision-making and reporting processes. Training and guidance may also be appropriate where individuals need a better understanding of their risk responsibilities.
Risk management documentation and supporting tools
Clear and proportionate documentation can support an organisation’s risk management arrangements by providing a structured record of risks, assessments, controls, responses, actions and ownership.
The documentation used will vary according to the organisation and the nature of its risks. The important point is that information is recorded consistently, kept sufficiently current and remains useful for monitoring, oversight and decision-making.
Risk assessments
Organisations need an appropriate way of assessing identified risks, commonly considering factors such as likelihood and impact. Depending on the organisation’s approach and the nature of the risk, the assessment may be recorded directly within the risk register or supported by more detailed analysis or documentation where required.
The assessment should provide sufficient information to understand the nature and significance of the risk, relevant controls and the level of risk remaining. This can support decisions about whether further action or a different risk response is required.
Risk register
A risk register provides a structured record of identified risks within an organisation, function, programme or project. Depending on the organisation’s approach, it may also be the primary place in which risks are assessed, monitored and reviewed.
The information recorded will vary, but a risk register may include the risk description, likelihood and impact, inherent and residual risk ratings, existing controls, agreed responses or actions, risk owners, action owners, review dates and status. The level of detail should be proportionate to the organisation’s needs and sufficient to support meaningful monitoring, reporting and oversight.
The Corporate Assist risk register template provides an example of how risk information can be structured and tracked. Organisations should adapt the format and fields to reflect their own risk management arrangements.
Risk action tracking
Where actions are agreed in response to risks, they need to be recorded and followed through. Depending on the organisation’s arrangements, actions may be tracked within the risk register itself or through a separate risk action tracker.
An action tracker might record the relevant risk, the agreed action, the action owner, target date, current status and any subsequent update or closure information. Where a separate tracker is used, it should remain clearly linked to the relevant risk so that progress can be reflected in risk monitoring and reporting.
Maintaining a clear record of agreed actions can support accountability and provide evidence of how identified risks have been followed up.
Risk scoring
Risk scoring can provide a consistent method for assessing and comparing risks within an organisation. A scoring methodology will commonly consider likelihood and impact, although the approach and scales used should reflect the organisation’s own risk management framework.
Organisations may use numerical scales, descriptive ratings or a combination of approaches to determine an overall risk rating.
Whatever approach is used, the methodology should be applied consistently and the meaning of each rating should be clearly understood. Risk scores can support prioritisation and comparison, but they should be considered alongside the nature of the risk, the effectiveness of controls and other relevant information rather than relied upon in isolation.
Additional risk management tools and documentation
The documentation discussed above is not exhaustive. Organisations may use additional tools or records depending on their size, activities, regulatory environment and risk management arrangements. These might include more detailed risk assessments, scenario analysis, control records, assurance information or compliance and action trackers.
Whatever documentation is used, it should work together and provide a consistent view of relevant risks, controls, assessments and actions. Records should be reviewed and updated at appropriate intervals and when material changes occur.
A coherent approach to risk documentation can support consistency in monitoring and reporting and make it easier for risk owners, management and those responsible for oversight to understand the current position and any outstanding actions.
Practical support for risk management documentation
As explored in this two-part series, effective risk management depends on more than identifying risks. Organisations also need appropriate processes for assessing, recording, monitoring and responding to them, supported by information that remains useful for oversight and decision-making.
Risk registers, assessment information, action trackers and other supporting records can help provide that structure. The particular documents and level of detail will vary between organisations, but they should provide a clear and sufficiently current record of risks, controls, agreed responses and outstanding actions.
Corporate Assist provides practical support with risk management documentation, including maintaining risk registers, coordinating risk assessment information, organising supporting records and tracking agreed actions. We work alongside existing teams and risk owners to help keep risk information structured, current and available for monitoring, reporting and oversight.
Risk owners and the organisation retain responsibility for assessing risks, determining appropriate controls and responses, and making decisions about risk appetite and acceptance.
Read Part 1: Risk Management Fundamentals – Part 1, which introduces the core stages of risk identification, assessment, response and monitoring.
If your organisation needs additional capacity to support its risk management activities, find out more about our Compliance & Risk Support or get in touch to discuss how Corporate Assist could help.
Share this post: