Glossary term
Risk Management Framework (RMF)
Subject: Risk Management, Risk Fundamentals and Frameworks
Also known as: Risk framework
A risk management framework is the structure of policies, roles, processes and tools an organisation uses to manage risk consistently, from setting objectives to reporting results to the board.
Explanation
Frameworks usually include a risk policy, a statement of appetite, defined roles and committees, a common method for identifying, assessing, treating and monitoring risks, a risk register, escalation rules, reporting and training. Standards such as ISO 31000 and COSO ERM supply templates, and sector rules add requirements. The framework is the underlying machinery; enterprise risk management is the organisation-wide approach that uses it. The label also appears in other settings: the US NIST Risk Management Framework, for example, is a specific method for managing the security risk of information systems, so check which meaning is intended. A good framework is sized to the organisation. A small charity may need a few pages, while a bank needs a layered set of documents. Board reports built on nine different scales cannot be added up; a shared framework is what makes them comparable.
Example
A state transport agency has no standard way to rate risk, and each regional office uses its own scale. Management writes a framework: a short policy, one five-point scale for likelihood and impact, named risk owners, quarterly reviews and escalation of anything rated high to the executive team. Within a year the board receives one consistent register instead of nine spreadsheets.
Not to be confused with
- Enterprise Risk Management (ERM)
- ERM is the integrated, organisation-wide approach; the framework is the working machinery of policies, roles and tools behind it.