Most organizations do some form of risk management, but far fewer have written down what they expect that risk management to look like. A risk management policy is the short, board-approved document that turns risk management from an informal activity into an explicit mandate. It defines who is responsible for what, how risks are assessed, and when they must be escalated. This guide explains what the policy contains, how it differs from a framework, and how to write and approve one.
What You'll Learn
By the end of this guide you will understand the purpose of a risk management policy, the standard sections it should contain, how it differs from a risk management framework, the board and management roles in approving it, and a practical process for drafting, reviewing, and maintaining one.
What Is a Risk Management Policy?
A risk management policy is a formal, approved statement of an organization's intent, commitment, and rules for managing risk. It is usually a concise document, often five to fifteen pages, that sets out why the organization manages risk, who is accountable, and the principles and minimum requirements everyone must follow.
The policy does not describe every step of how to run a workshop or score a risk. Instead, it establishes mandate and boundaries. It is the document a regulator, auditor, or new board member reads first to understand how risk is governed across the organization.
Think of the policy as the constitution of your risk program. It is deliberately stable and high-level, while the detailed procedures, templates, and the risk register sit beneath it and change far more often.
Why You Need a Risk Management Policy
A written policy does several things that informal practice cannot:
1. It Creates a Mandate
Without a policy, risk management depends on the enthusiasm of individuals. When a business unit pushes back and asks why it has to log a particular risk, the policy is the answer. It gives risk and compliance teams the authority to require participation.
2. It Sets Consistent Expectations
The policy ensures every department assesses, records, and escalates risk in the same way. That consistency is what makes risks comparable across the organization, and it is what makes aggregated reporting to the board meaningful.
3. It Demonstrates Governance
Boards, regulators, and external auditors expect documented evidence that risk is being governed deliberately. Standards such as ISO 31000 and corporate governance codes (including King IV in South Africa) explicitly expect a documented commitment to risk management. The policy is that evidence.
4. It Connects Risk to Strategy
A good policy links risk management to the organization's objectives and to its risk appetite. This makes risk management a tool for achieving strategy rather than a compliance chore.
Want the full framework with worked examples?
What a Risk Management Policy Contains
Format varies, but a complete risk management policy covers the sections below. Treat this as a checklist when you draft or review yours.
| Section | What It Covers |
|---|---|
| Purpose & Objectives | Why the policy exists and what risk management is intended to achieve for the organization |
| Scope | Which entities, business units, risk types, and activities the policy applies to (and any exclusions) |
| Definitions | Key terms such as risk, control, inherent vs. residual risk, appetite, and tolerance, so everyone uses the same language |
| Risk Appetite Link | A reference to the organization's risk appetite statement and how it guides decisions |
| Roles & Responsibilities | Who does what across the board, executive, risk owners, risk function, and internal audit (often using the three lines model) |
| Methodology | The agreed approach to identifying, assessing, treating, and monitoring risk, including the scoring scale |
| Escalation & Reporting | When and how risks are escalated, and the cadence of risk reporting to management and the board |
| Review Cadence | How often the policy itself is reviewed and who approves changes |
| Approval & Version | Approval body, effective date, owner, and version history |
Scope
The scope statement removes ambiguity about where the policy applies. A multi-entity group has to state whether subsidiaries adopt the policy directly or maintain aligned local versions. The scope should also name the risk categories covered: strategic, operational, financial, compliance, technology, and so on.
Roles and Responsibilities
This is often the most scrutinized section. Many organizations structure it around the three lines model:
- First line (business management): Owns and manages risks day to day. Risk owners identify, assess, and treat the risks in their area.
- Second line (risk and compliance functions): Sets the methodology, challenges the first line, aggregates risk information, and reports to leadership.
- Third line (internal audit): Provides independent assurance that the framework is working as intended.
Above all three sits the board, which owns the risk appetite and holds ultimate accountability, and the executive, which implements the policy.
Methodology
The methodology section summarizes the agreed approach to risk assessment, including the likelihood and impact scoring scale and the distinction between inherent and residual risk. The policy states the principle. The detailed procedure document carries the full mechanics.
Escalation and Review Cadence
The policy should specify thresholds at which a risk must be escalated (for example, any risk scoring in the "critical" band) and the frequency of risk reporting. It should also commit the organization to reviewing the policy itself on a defined cycle, typically annually.
An Escalation Clause
"Any risk assessed as Critical (residual score 20 to 25) must be reported to the Executive Risk Committee within five working days of identification and included in the next quarterly board risk report. Any risk that exceeds the approved risk appetite for its category must be escalated immediately to the Chief Risk Officer, regardless of score."
This clause turns a vague intention ("we escalate big risks") into an enforceable, auditable rule.
Policy vs. Framework: What's the Difference?
The terms policy and framework are often used interchangeably, but they are not the same thing. Understanding the difference keeps you from cramming everything into one bloated document.
| Dimension | Risk Management Policy | Risk Management Framework |
|---|---|---|
| Question it answers | What do we commit to and require? | How do the parts of risk management fit together? |
| Length | Short (5 to 15 pages) | Longer; describes structures, processes, and tools |
| Audience | Everyone; board reads it first | Risk practitioners and managers |
| Stability | Stable; reviewed annually | Evolves as practices mature |
| Approved by | Board or board risk committee | Executive / risk committee |
In practice, the policy is the mandate and the framework is the operating model. The framework typically references the risk appetite statement, the assessment methodology, the risk register, the controls register, and the reporting structures. One useful way to think about it: the policy says we will manage risk and here are the rules, while the framework says here is the machine that does it. For a fuller picture of how these pieces assemble, see our enterprise risk management guide.
Pro Tip
Keep the policy short and let it reference detailed documents rather than absorbing them. A 60-page "policy" that nobody reads is worse than a five-page one that everyone follows. Detail belongs in procedures and the framework, which you can update without going back to the board.
How to Write and Approve a Policy
Drafting a risk management policy follows a predictable path. You do not need to start from a blank page. Use the section checklist above as your skeleton.
Step 1: Confirm the Mandate
Establish who is sponsoring the policy. Usually this is the board risk committee or the chief risk officer. Without an executive sponsor, the policy will lack the authority it needs.
Step 2: Draft Against the Standard Sections
Work through purpose, scope, definitions, appetite link, roles, methodology, escalation, and review cadence. Reuse existing material, such as your scoring scale and your appetite statement, rather than reinventing it.
Step 3: Consult the First and Second Lines
Circulate the draft to the business units who will have to comply and to legal, compliance, and internal audit. The roles section in particular benefits from challenge, because people are quick to point out responsibilities that are unclear or unworkable.
Step 4: Align with Appetite and Strategy
Ensure the policy explicitly references the risk appetite statement and the organization's strategic objectives. A policy that floats free of strategy will not be used.
Step 5: Secure Board Approval
The policy is presented to the board or its risk committee for approval. Approval should be minuted, and the effective date and version recorded in the document.
Step 6: Communicate and Embed
Publish the policy, brief risk owners on what it requires of them, and make it accessible. A policy that lives in a folder nobody opens has no effect.
Important
Do not copy a generic policy template verbatim. Regulators and auditors can spot boilerplate immediately. More importantly, a policy that does not reflect how your organization actually works will create commitments you cannot keep. Tailor every section to your structure, risk categories, and appetite.
The Board and Governance Role
Risk governance is ultimately a board responsibility. The board does not run risk assessments, but it owns the policy and the appetite that drive them. The board's specific responsibilities typically include:
- Approving the policy and any material changes to it
- Setting and approving risk appetite, which the policy references
- Receiving regular risk reports and challenging management on the top risks
- Ensuring resourcing so the risk function can do its job
- Overseeing assurance from internal audit that the framework works
Many boards delegate detailed oversight to a risk committee (or a combined audit and risk committee), which meets more frequently and reviews the risk register and emerging risks in depth before reporting up to the full board. The policy should name whichever body holds this responsibility so there is no ambiguity about where accountability sits.
Common Mistakes to Avoid
1. Confusing the Policy With the Framework
Stuffing every procedure into the policy makes it long, unstable, and unread. Keep the policy to principles and rules, and push detail into the framework and procedures.
2. Vague Roles and Responsibilities
If the policy says "everyone is responsible for risk," then no one is. Name specific roles and what each must do.
3. No Link to Appetite
A policy that never mentions risk appetite cannot tell anyone when a risk is too high. Always connect the policy to the appetite statement.
4. Set and Forget
A policy approved once and never reviewed drifts out of date. Build in an annual review and stick to it.
5. Writing for the Auditor, Not the Organization
A policy written purely to pass an audit tends to be generic and ignored. Write it so that risk owners can actually use it to make decisions.
Summary
- A risk management policy is a short, board-approved statement of intent, rules, and accountability for managing risk
- Core sections include purpose, scope, definitions, appetite link, roles, methodology, escalation, and review cadence
- The policy is the mandate; the framework is the operating model that delivers it
- The board owns the policy and the appetite, and the three lines deliver risk management beneath it
- Keep the policy short, link it to strategy and appetite, and review it on a defined cycle
Frequently Asked Questions
Is a risk management policy legally required?
It depends on your sector and jurisdiction. Many corporate governance codes and regulators, especially in financial services, healthcare, and listed companies, expect or require a documented risk management policy. Even where it is not strictly mandatory, frameworks like ISO 31000 treat a documented commitment to risk management as a baseline of good governance.
How long should a risk management policy be?
Most effective policies are five to fifteen pages. The policy should state principles, rules, and accountabilities rather than detailed procedures. If yours is running past twenty pages, you are probably mixing in framework or procedure content that belongs in a separate document.
Who approves the risk management policy?
The board or its risk committee approves the policy, because the board holds ultimate accountability for risk. Management drafts and implements it, but final approval, and approval of any material change, rests at board level. The approval should be minuted and recorded in the document's version history.
What is the difference between a policy and a framework?
The policy is the mandate. It says the organization will manage risk and sets the rules and accountabilities. The framework is the operating model. It describes how the structures, processes, and tools (appetite, assessment methodology, risk register, reporting) fit together to deliver on the policy. The policy is shorter and more stable, while the framework is more detailed and evolves over time.
How often should the policy be reviewed?
Annually is the common standard, with an out-of-cycle review triggered by major events such as a merger, a regulatory change, a significant incident, or a shift in strategy. The review cadence should be written into the policy itself so the commitment is explicit and auditable.
Does the policy include the risk appetite statement?
Usually the policy references the risk appetite statement rather than containing it in full. The appetite is a separate, board-approved document that tends to be revisited more often as strategy shifts. Keeping it separate lets you update appetite without re-approving the whole policy, while the policy makes clear that decisions must respect the stated appetite.
Save this guide for later
Download the PDF version to read offline or share with your team.
