The risk management process is a repeatable way to identify what could affect your objectives, assess how serious it is, decide what to do and check whether your response is working. A common five-step approach is to identify, analyse, evaluate, treat and monitor risks.
The value comes from the decisions that follow. Each significant risk needs an owner, a clear response and a review date so that it stays visible as circumstances change.
What are the five steps of risk management?
- Identify the risks that could affect your objectives.
- Analyse their causes, consequences and existing controls.
- Evaluate their significance and priority.
- Treat the risks with an appropriate response.
- Monitor and review changes, actions and control effectiveness.
These steps form a cycle. A new incident, failed control or change in priorities can send you back to an earlier stage.
Before you begin: agree the scope and risk appetite
Start with the activity, project or organisational objective you are assessing. Agree who should contribute, how risks will be rated and when they should be escalated.
The board or governing body should set the organisation’s risk appetite: the types and level of risk it is willing to take in pursuing its objectives. This gives managers a basis for deciding which exposures need further action. Different activities may need different thresholds.
1. Identify the risks
Ask what might prevent the objective from being achieved, what could cause it and who would be affected. Speak to the people delivering the work as well as those responsible for oversight. Incidents, complaints, audit findings and changes in the operating environment can all reveal risks.
Describe each risk clearly. For example: “If our only supplier cannot fulfil orders, essential materials may be unavailable, delaying service delivery.” This is more useful than a broad label such as “supplier risk”.
Record the risk in a register and assign an owner with the authority to coordinate its assessment and response.
2. Analyse the risk
Understand how the risk could arise and what the consequences could be. Consider the controls already in place and the evidence that they work.
Analysis should distinguish between the exposure before controls, often called inherent risk, and the exposure remaining after existing controls, or residual risk. A policy being available is different from evidence that people follow it.
For the supplier example, examine delivery history, alternative sources, stock levels and the effect of a disruption on different services. One event may have operational, financial and reputational consequences.
3. Evaluate and prioritise the risk
Use agreed likelihood and impact criteria to assess the remaining exposure. A risk matrix can help teams compare risks consistently, provided everyone understands the definitions behind its scores.
Compare the result with the relevant risk appetite and escalation thresholds. Decide whether the existing controls are sufficient, further action is needed or a senior decision is required.
The score supports judgement; it does not replace it. Consider the quality of the evidence, how quickly the risk could develop and whether several risks depend on the same control.
4. Treat the risk
Choose a response that fits the exposure and the objective. The main risk management strategies are to tolerate, treat, transfer or terminate the activity giving rise to the risk.
For a risk that needs further treatment, specify:
- The action to take and the control gap it addresses.
- The person responsible for completing it.
- The completion date and resources required.
- The level of risk you expect to remain.
- How you will check whether the action has worked.
In the supplier example, a response might be to assess an alternative supplier and agree a contingency plan. “Monitor suppliers” alone does not explain what will change or who will deliver it.
5. Monitor and review the risk
Set review intervals that reflect the exposure, and review sooner when circumstances change. Check whether actions are complete, controls remain effective and the current rating still reflects the evidence.
For the supplier risk, this could include reviewing missed deliveries, changes in supplier capacity and whether the alternative arrangement is ready to use. Escalate concerns when agreed thresholds are reached.
Completing an action does not automatically close the risk. Confirm what exposure remains, who accepts it and when it will next be reviewed.
Put the process into everyday work
An effective risk management approach connects the register to management meetings, service planning and board reporting. Review the risks that need a decision, explain changes and follow up agreed actions.
A shared register can help teams keep owners, ratings and review dates together. Where spreadsheet administration becomes difficult, risk management software can support a consistent record and clearer reporting. The underlying discipline remains the same: understand the risk, make a decision and check the result.