Risk management is a continuous process. It starts with working out how much risk the organisation is prepared to take, then moves on to identifying the risks, assessing them, designing controls, monitoring them, and then improving. The aim is not to eliminate all risk, but to manage it so the business can keep performing and remain resilient.
For risk, audit, and compliance professionals, the lifecycle provides a clear way to apply risk principles in day-to-day decisions.
Risk appetite and tolerance
The lifecycle starts with risk appetite (how much risk the organisation is prepared to take to achieve its objectives). Senior management or the board sets and approves this at the enterprise level.
Risk tolerance is more detailed. It defines the range of acceptable risk around a risk appetite statement for a particular business, process or metric. So a company may have very little risk tolerance for breaches of regulation but be quite comfortable with a certain amount of planned operational disruption.
Appetite and tolerance together define the limits of business activity. They tell you when you can accept risk, when you can reduce it and when you can increase it.
Risk identification techniques
Once the organisation has established its risk appetite, the next step is to identify risks that could impact its objectives. Good methods of identification are structured, repeatable and appropriate to the business.
Common techniques include:
- Risk and Control Self-Assessments (RCSAs) - where the business assesses its own risks and controls.
- Workshops and interviews (to get the insight of the process owners and subject matter experts).
- Scenario analysis (which looks at what could happen under a set of adverse conditions).
- Process walkthroughs (which map out how the work is actually performed and where the possibility of failure lies).
- Incident and loss reviews (which use previous incidents to identify current weaknesses).
The leading organisations use a range of risk identification techniques rather than just one. This enables them to identify both the known risks and any new risks that emerge. Once the risks are identified, they are assessed. A common assessment method is the impact vs likelihood matrix, where each risk is scored on two axes: the likelihood of it occurring and the severity of the impact if it did occur.
This simple tool helps the team focus on the key risks. High-likelihood/high-impact risks will obviously require action, while low-likelihood/low-impact risks can be managed with a basic level of control. It also provides a consistent way to assess risks.
Assessment goes well beyond the initial score. You also need to consider how quickly the risk could materialise, how easy it is to detect, how effective the controls are, and how much of the exposure is in one place. That gives you a much better understanding of the actual risk.
Control design and effectiveness testing
After assessing the risks, you put controls in place to reduce exposure to an acceptable level. Good controls are based on the risk. They need to be specific, practical, and appropriate to the situation. They should resolve the root cause of the risk, not just the symptom.
For instance, if the risk is unauthorised payments, a control might be dual approval and segregation of duties. If the risk is of inaccurate reporting, then a reconciliation and review control would be more appropriate.
Designing the controls is only half the job. You also have to test the controls to ensure they work as intended and actually do reduce risk. A weak or poorly applied control can provide a false sense of security, which may be worse than having no control at all.
Monitoring and continuous improvement
The final stage of the lifecycle is monitoring and improvement. Risks will of course change as the business grows, systems change, rules change, and the external environment changes. Risk management has to keep up with that. The key monitoring activities are:
- Control testing: The regular checking that controls are being applied as designed and that they actually do reduce risk.
- Key Risk Indicators (KRIs): The particular metrics that you track to provide an early warning when risk levels are on the rise.
- Issue tracking: Keeping a record of the issues that have been identified, making sure they are actually dealt with and resolved.
- Trend analysis: Looking at the patterns in incidents and near misses to identify some emerging risks or weak areas.
- Management reporting: Summarising the risk information for the decision makers to highlight the key exposures and the progress.
Continuous improvement means using information from these activities to improve controls, update assessments, reinforce ownership, and close gaps before they become failures.
Organisations that do this well don't wait for problems to arise. They use monitoring data to identify issues early and improve risk management proactively before any failure occurs.
Why the lifecycle matters
The risk management lifecycle brings discipline and structure. It ensures risk appetite drives decisions, risks are properly assessed, controls are designed with purpose, and monitoring leads to action. Without the lifecycle, you can end up with a reactive, ad hoc form of risk management.
Closing perspective
A good risk management lifecycle provides an effective way of managing uncertainty. It enables leaders to strike the right balance between risk and opportunity, promotes accountability and over time builds resilience. The principles are obviously also at the heart of a number of the key global risk and control frameworks (COSO's Enterprise Risk Management Framework being a prime example, as is ISO 31000). Citing those frameworks is a good way of anchoring the risk management lifecycle in established professional best practice.