Risk Management

Risk management exists so that leaders take risk deliberately rather than by accident. Every significant decision — entering a market, signing a large contract, delaying an investment in redundancy — implicitly accepts some risks and rejects others. A structured process makes those trade-offs visible, comparable and defensible before the board. Without it, the organisation still takes risks; it simply does not know which ones.

In practice the process is coordinated by a risk function or a chief risk officer, while each risk keeps a named owner in the business. Risks are reviewed on a fixed rhythm — quarterly at enterprise level, monthly for fast-moving operational exposures — and the results live in the risk register, the risk policy and the board risk report. A useful test of maturity is whether assessments carry numbers, for example "loss of the main warehouse stops 40% of daily shipments within 48 hours". ISO 31000 provides the shared vocabulary of principles, framework and process.

The classic failure is risk management as an annual ritual: a workshop, a heat map, a report, and no change in a single real decision. If risk information never alters budgets, contracts or continuity investments, the process is decoration. In the ERGP programme this discipline, and its link to resilience, is examined in module M2 "From enterprise risk management to business resilience".