Short answer
Risk management is the way an organisation finds, assesses and deals with the things that could stop it reaching its objectives. It follows a repeating cycle: set the context, identify risks, analyse and evaluate them, decide how to treat them, then monitor, review and report. ISO 31000 is the most widely used guide to doing it well.
Every organisation takes risks. A supplier might fail, a system might go down, a regulation might change, a project might run late. Risk management is the discipline of seeing those things coming and deciding, on purpose, what to do about them. This guide explains what risk management means, the main types of risk, the process step by step, and how to start without drowning in paperwork.
Table of Contents
What Is Risk Management?
ISO 31000, the international standard for risk management, defines risk as the "effect of uncertainty on objectives". Two things follow from that definition:
- Risk is tied to objectives. A risk only matters because of what it could do to something you are trying to achieve: a project deadline, a profit target, a client's safety record, a clean audit.
- Risk can be positive or negative. Uncertainty can work against you (a threat) or for you (an opportunity). Good risk management deals with both.
Risk management is the coordinated set of activities an organisation uses to direct and control itself with regard to risk. In practice that means a repeatable way of identifying risks, judging how serious they are, deciding what to do about them, and checking that it worked.
A Simple Example
A consultancy relies on one senior partner for its largest client. The risk: if that partner leaves or falls ill, the client relationship and a large share of revenue are exposed. Risk management means naming that risk, rating it (likely enough and serious enough to act on), choosing a response (bring a second partner into the account, document the relationship), giving someone ownership, and checking each quarter that the response is in place.
Why Risk Management Matters
- Fewer surprises: problems are seen early, while they are still cheap to fix
- Better decisions: leaders choose between options knowing the risks of each, not just the upside
- Confidence for boards, clients and regulators: you can show that risks are known, owned and managed
- Resilience: when something does go wrong, there is already a plan and an owner
- Opportunity: understanding risk lets you take the right risks deliberately instead of avoiding all of them
Types of Risk
Most organisations group their risks into categories so nothing important is missed. A typical set:
| Type | What it covers | Example |
|---|---|---|
| Strategic | Risks to the direction and goals of the organisation | A competitor launches a cheaper service and wins key clients |
| Operational | Failures in day to day processes, people and systems | A key process depends on one person who leaves |
| Financial | Cash flow, credit, market and currency exposure | A large client pays 120 days late |
| Compliance and legal | Breaking laws, regulations, contracts or internal policies | Personal data is processed without a lawful basis |
| IT and cyber | Attacks, outages and data loss | Ransomware locks the finance system at month end |
| Third party | Suppliers, outsourcers and partners | A critical cloud provider suffers a long outage |
| Health and safety | Harm to employees, contractors and the public | A forklift incident at a warehouse |
| Environmental and climate | Physical climate impacts and the move to a low carbon economy | Flooding at a site, or new emissions reporting rules |
| AI | Errors, bias, privacy and misuse in AI systems | A model used in hiring treats some applicants unfairly |
The Risk Management Process
ISO 31000 sets out a process that most organisations follow, whatever framework they say they use. It is a cycle, not a one off exercise.
- Communication and consultation. Involve the people who own, live with or understand each risk, throughout the process, not just at the end.
- Scope, context and criteria. Decide what you are assessing (the whole organisation, a project, a client engagement), what objectives are at stake, and how you will judge whether a risk is acceptable.
- Risk assessment. Three steps in one:
- Identify: find the risks, using workshops, interviews, checklists, past incidents and audit findings
- Analyse: understand each risk's causes, consequences, existing controls, and how likely and severe it is. See how to score likelihood and impact
- Evaluate: compare the result with your criteria to decide which risks need action, and in what order
- Risk treatment. Choose and carry out responses, with an owner and a date for each.
- Monitoring and review. Check regularly that risks, controls and treatments are still as expected, and update the assessment when things change.
- Recording and reporting. Keep the results in a risk register and report to the people who need to act or oversee, such as management, the board or the client.
For a step by step walk through of the assessment itself, see how to run a risk assessment.
Risk Treatment Options
Once you know which risks need action, there are four broad responses. ISO 31000 lists more detailed options, but they fit into these:
| Option | What it means | Example |
|---|---|---|
| Avoid | Stop or do not start the activity that creates the risk | Decline a project in a market you cannot support |
| Reduce | Lower the likelihood, the impact or both, usually with controls | Add multi factor authentication and tested backups |
| Share or transfer | Pass part of the risk to another party | Insurance, or contract terms with a supplier |
| Accept | Keep the risk, knowingly, because it is within appetite or too costly to treat | Accept a small currency exposure on one contract |
Accepting a risk is a valid decision as long as it is deliberate, recorded and within the organisation's risk appetite. Our guide to risk treatment plans covers how to document each response.
Who Does What
Most organisations divide risk responsibilities using the IIA's Three Lines Model:
- Management (first line): owns and manages risks in day to day work
- Risk and compliance functions (second line): set the method, support and challenge management, and report on the overall risk picture
- Internal audit (third line): gives independent assurance to the board that risk management works
- The board or governing body: sets risk appetite and oversees the whole system
In a small organisation one person may wear several of these hats, and many bring in a consultant to design the approach or run it for them. What matters is that every significant risk has a named owner.
Tools and Techniques
- Risk register: the central list of risks, with causes, ratings, controls, owners and actions
- Risk matrix and heat map: a grid of likelihood against impact used to rate and compare risks. Useful for prioritising, but research has shown that matrices can rank risks inconsistently, so treat the colours as a guide, not a measurement. See how to build a risk heat map
- Risk appetite statement: how much risk the organisation is willing to take in pursuit of its objectives
- Controls register: the controls that reduce each risk and whether they work. See controls registers
- Key risk indicators (KRIs): measures that warn when a risk is growing, such as overdue patches or staff turnover
- Risk assessment techniques: IEC 31010 describes dozens of methods, from simple checklists and brainstorming to bow tie analysis, scenario analysis and Monte Carlo simulation
- Board risk report: a regular summary of the top risks, trends and actions for the people who oversee them
Risk Management Frameworks
A framework gives you a structure so you are not inventing the method yourself. The two general frameworks are:
- ISO 31000: principles, a framework and the process described above. Works for any organisation in any country.
- COSO ERM: links risk to strategy and performance, with more on board oversight and risk culture.
Specialist frameworks such as NIST CSF 2.0 for cyber and the NIST AI RMF for AI plug into them. Our risk management frameworks comparison sets them side by side.
Risk Management vs ERM vs GRC
| Term | Scope |
|---|---|
| Risk management | The general discipline of managing risk. It can apply to a single project, process or client. |
| Enterprise risk management (ERM) | Risk management applied across the whole organisation, with one view of risk for leadership. See our ERM guide. |
| GRC | Governance, risk and compliance run together, so risks, obligations, controls and oversight share one picture. |
Common Mistakes
- The register nobody opens: risks are listed once a year for the board pack and never used to make decisions
- Risks with no link to objectives: long lists of generic risks that do not say what they threaten
- No owners: a risk owned by "management" is owned by no one
- False precision: treating a 4 x 5 score as a measurement rather than a judgement
- Controls that are assumed, not tested: a control on paper is not a control in practice
- Silos: risk, compliance, audit and health and safety each keep their own list of the same issues
How to Get Started
For a small team, or a consultant setting up risk management for a client, a workable first version takes days, not months:
- Write down the five to ten objectives that matter most
- Agree a simple five point scale for likelihood and impact
- Run one workshop with the people who know the work and list the risks to each objective
- Rate each risk, note the controls already in place, and name an owner
- Pick the top risks and agree one action for each, with a date
- Put it all in one register that everyone can see
- Review it monthly or quarterly, and report the top risks to leadership
Our free risk register template gives you a starting structure.
Risk Management in 2027
The basics have not changed, but several developments shape what good risk management looks like in 2027:
- AI risk is now mainstream: organisations are adding AI systems to their registers, often using the NIST AI Risk Management Framework. Under the EU AI Act, as amended by Regulation (EU) 2026/1744, obligations for high risk Annex III systems apply from 2 December 2027
- Internal audit expectations are rising: the IIA's topical requirements on cybersecurity (from 5 February 2026), third parties (15 September 2026), organisational behaviour (15 December 2026) and organisational resilience (30 April 2027) shape what auditors will look for
- Boards must evidence controls: in the UK, Provision 29 of the Corporate Governance Code asks boards of financial years starting on or after 1 January 2026 to declare whether material controls were effective
- ISO 31000 is due a refresh: the 2018 edition is still current, and ISO has marked it for revision
Summary
- Risk is the effect of uncertainty on objectives, and it can be positive or negative
- Risk management is a repeating cycle: context, identify, analyse, evaluate, treat, monitor and report
- The four responses are avoid, reduce, share and accept
- Every significant risk needs a named owner and a date for action
- ISO 31000 is the most widely used guide; COSO ERM adds a stronger link to strategy
- Start small: one register, one scale, the top risks, reviewed regularly
Frequently Asked Questions
What is risk management in simple terms?
Risk management means spotting what could go wrong (or unexpectedly right) before it happens, deciding how much it matters, and choosing what to do about it. It is a habit of asking "what could stop us reaching this goal, and what will we do about it?" and writing the answer down.
What are the steps of risk management?
Following ISO 31000: set the scope, context and criteria; identify risks; analyse them; evaluate them against your criteria; treat the ones that need action; then monitor, review and report. Communication and consultation run through every step.
What are the four ways to treat a risk?
Avoid the risk, reduce it with controls, share or transfer it (for example through insurance or contracts), or accept it knowingly when it is within your risk appetite.
What is the difference between risk management and enterprise risk management?
Risk management can be applied to anything: a project, a process, a single client engagement. Enterprise risk management applies it across the whole organisation, so leadership sees all significant risks in one place and can weigh them against each other and against strategy.
Which risk management framework should I use?
ISO 31000 is the usual starting point because it works for any organisation and country. COSO ERM suits boards that want risk built into strategy. Add specialist frameworks such as NIST CSF 2.0 for cyber or the NIST AI RMF for AI where those risks matter.
Do small businesses need risk management?
Yes, though it can be simple. A short register of the top risks, an owner for each and a quarterly review is often enough. Small organisations are usually more exposed to single points of failure, such as one big client or one key person, so a little structure goes a long way.
- ISO 31000:2018 Risk management guidelines, from the International Organization for Standardization
- IEC 31010:2019 Risk assessment techniques (iso.org)
- COSO Enterprise Risk Management: Integrating with Strategy and Performance, at coso.org
- The IIA's Three Lines Model
- The NIST AI Risk Management Framework
- On the limits of risk matrices: Cox (2008), "What's Wrong with Risk Matrices?" in Risk Analysis, and Douglas Hubbard, The Failure of Risk Management
For educational purposes only, not legal, audit or professional advice. Standards and laws change, so check the sources above before acting. Last reviewed: November 2026.