Risk Management Process: How to Identify, Assess and Treat Risk

7 min

Dec 30, 2025

The risk management process helps an organisation understand uncertainty, decide which risks require action and monitor whether its responses are working. It is not a one-off workshop or a list maintained for audit. Effective risk management is part of setting objectives, evaluating options, allocating resources and reviewing performance.

A sound process considers both threats and opportunities. It also distinguishes a possible future event from an issue that has already happened, assigns accountable owners and connects risk information to real decisions.

This guide explains the risk management process step by step, clarifies the difference between a framework, plan and risk register, covers the main types of business risk, and provides a practical example organisations can adapt.

What Is Risk Management?

Risk is commonly defined as the effect of uncertainty on objectives. The effect may be negative, positive or different from what was expected. Risk management therefore does not mean eliminating every risk. An organisation that avoided all uncertainty would also avoid many opportunities to improve, invest and grow.

Risk management is the coordinated way an organisation:

understands the objectives that could be affected;
identifies uncertain events, causes and consequences;
analyses the likelihood and potential impact;
compares exposure with agreed criteria and risk appetite;
selects and implements proportionate treatments; and
monitors change, control effectiveness and emerging risk.

ISO 31000 provides internationally recognised principles, a framework and a process that can be used by organisations of any size or sector. The UK's Orange Book similarly treats risk management as an integral part of governance, leadership and decision-making rather than a separate compliance exercise.

Risk, issue and control are not the same

Term	Meaning	Example
Risk	An uncertain event or condition that may affect an objective	A sole-source component may arrive late and delay a launch
Issue	A relevant event or problem that has already occurred	The supplier has confirmed a four-week delay
Control	A measure that maintains or modifies risk	Dual sourcing, supplier monitoring or holding safety stock
Treatment	A planned action to change the likelihood, consequence or exposure	Qualify a second supplier before the next production cycle

When a risk occurs, it may become an issue and activate contingency or recovery actions. Keeping the terms distinct improves reporting and prevents teams from recording current problems as if they were still uncertain.

Risk Management Framework vs Process, Plan and Register

These terms are related but perform different jobs.

Element	Purpose	Typical contents
Risk management framework	Establishes how risk management operates across the organisation	Governance, policy, risk appetite, roles, integration, reporting, assurance, culture and improvement
Risk management process	Provides repeatable activities for managing uncertainty around objectives	Context, identification, analysis, evaluation, treatment, monitoring, communication and reporting
Risk management plan	Tailors the framework and process to a business unit, programme, project or decision	Scope, categories, methods, criteria, responsibilities, review cadence and reporting routes
Risk register	Records current risk information and actions	Risk description, owner, assessment, controls, treatment, action owner, trigger and status

A register is a tool, not a complete risk management system. It can be accurate and still add little value if risks are not discussed when strategies, investments, projects or operational priorities are decided.

The framework creates organisational conditions for good decisions. The process applies those conditions to a particular objective. The plan explains how that application will work, while the register preserves the information needed to manage and report individual risks.

The Risk Management Process in Six Steps

Risk management is often presented as a sequence, but in practice it is iterative. Communication, consultation, recording, reporting, monitoring and review continue across every step.

1. Define objectives, scope, context and criteria

Risk has meaning only in relation to an objective. Begin by clarifying:

the decision, activity, project or organisational objectives in scope;
stakeholders and their different expectations;
internal and external conditions;
assumptions, dependencies and time horizon;
applicable legal, regulatory and contractual obligations;
the categories and scales that will support consistent assessment; and
the level and type of risk the relevant authority is willing to take.

Risk criteria describe how significance will be judged. They may consider likelihood, financial impact, safety, service, reputation, compliance, delivery time, strategic effect and the speed at which an event could materialise.

Risk appetite is the nature and extent of risk an organisation is willing to take to achieve its objectives. It should influence options and resource decisions, not sit as an abstract statement in a policy. Appetite can differ by category: an organisation may accept more innovation risk while having very little appetite for unsafe or unlawful activity.

2. Identify risks and opportunities

Identification asks what could affect the objective, why it could happen and what the consequences would be. Sources include workshops, interviews, process reviews, incident data, assumptions, supplier analysis, horizon scanning, lessons learned and specialist assessment.

A useful risk statement separates cause, event and effect:

Because a critical component has only one approved supplier (cause), it may arrive after the required date (event), delaying the launch and increasing expediting costs (effect).

“Supplier risk” is too vague to support analysis or action. A clear statement enables the team to test causes, identify existing controls and design a relevant response.

Identification should include opportunities as well as threats. It should also consider connections: several individually moderate risks can combine into a serious exposure, while one cause may affect multiple objectives.

3. Analyse likelihood, consequences and controls

Risk analysis develops an understanding of the exposure. A proportionate analysis may consider:

likelihood or frequency;
range and severity of consequences;
existing controls and whether they are designed and operating effectively;
the timing, proximity and velocity of the risk;
uncertainty in the evidence and assumptions;
interdependencies, concentration and cumulative effects; and
scenarios in which the outcome would be materially different.

Many organisations use a likelihood-impact matrix for qualitative analysis. It provides a common language and helps group risks, but the resulting score is an ordinal prioritisation aid—not a precise mathematical prediction. Two risks with the same score may need different decisions because one threatens safety, crystallises faster or has weaker controls.

Terminology varies, so define it in the risk plan. Common views include:

inherent exposure: the risk before considering controls;
current or residual exposure: the risk after considering controls already in place; and
target exposure: the intended level after planned treatments are implemented.

Do not assume a control works because it exists on paper. Consider evidence of its design, operation and effectiveness.

4. Evaluate and prioritise risks

Evaluation compares the analysis with risk criteria and appetite to determine what needs attention. The decision may be to:

take additional action immediately;
maintain current controls and monitor;
escalate beyond the owner's authority;
analyse the uncertainty in greater depth;
reconsider the objective, option or business case; or
accept the exposure with a documented rationale.

Priority should reflect decision urgency and potential effect, not only the matrix colour. A low-likelihood event with severe consequences, a rapidly emerging risk or a control failure may deserve senior attention even when a simple score does not place it at the top of the register.

Evaluation also helps allocate resources. Controls and treatments have costs, limitations and unintended effects. The objective is a proportionate response that improves the chance of achieving the objective—not the maximum possible number of controls.

5. Select and implement risk treatments

Risk treatment changes exposure or prepares the organisation to respond. Common options for threats include:

avoid: change the objective, option or activity so the exposure no longer arises;
reduce: lower the likelihood or consequence through preventive or detective controls;
share or transfer: allocate part of the exposure through insurance, contracts, partnerships or outsourcing;
accept or retain: take no additional preventive action because the exposure is within appetite or further treatment is not proportionate; and
prepare contingency: define triggers and actions if the event occurs.

Opportunities may be pursued, enhanced, shared or accepted according to the organisation's method. Treatments can create secondary risks, shift exposure elsewhere or introduce new dependencies, so they must be assessed rather than assumed beneficial.

Each treatment needs:

a named action owner;
a specific deliverable rather than “monitor closely”;
an agreed completion date and resources;
the expected change in exposure;
an implementation status; and
evidence that the treatment works.

The risk owner remains accountable for the risk even when individual treatment actions are assigned to other people.

6. Monitor, communicate, report and improve

Risk exposure changes as objectives, controls and external conditions change. Monitoring should cover:

new and emerging risks;
changes in likelihood, consequence or proximity;
treatment progress and overdue actions;
control performance and failures;
trigger events and key risk indicators;
risks outside appetite or tolerance;
connections between risks; and
lessons from incidents, near misses and successful responses.

Reports should support a decision. Senior leaders usually need trends, principal exposures, movement against appetite, control effectiveness, actions and required decisions—not every field in a long register.

The Orange Book emphasises useful reporting, timely escalation and continual improvement through learning and experience. Review the process itself as well as the risks: if assessments are inconsistent, treatments remain overdue or information reaches governance forums too late, the framework needs improvement.

A Practical Risk Register Template

A useful risk register contains enough information to make ownership, exposure and action visible without becoming an administrative burden.

Field	What to record
Risk ID and objective	Unique reference and the objective that could be affected
Risk statement	Cause, uncertain event and potential effect
Category and source	Taxonomy used for aggregation and specialist input
Risk owner	Person accountable for understanding and managing the risk
Inherent assessment	Exposure before controls, if the organisation uses this view
Existing controls	Current preventive, detective or corrective measures and their owners
Current/residual assessment	Exposure after considering current controls
Treatment and action owner	Specific additional action, accountable implementer and due date
Target exposure	Expected level after the treatment works
Trigger or indicator	Evidence that exposure is changing or contingency should begin
Status and review date	Current decision, escalation and next review point

Completed example

Field	Example entry
Objective	Launch the new service by 30 September within the approved budget
Risk statement	Because a critical component has one approved supplier, it may arrive late, delaying commissioning and increasing expediting cost
Owner	Operations Director
Existing controls	Monthly supplier review, confirmed production slot and contractual delivery milestone
Current assessment	High: delivery date has limited float and no qualified alternative exists
Treatment	Qualify a second supplier and approve an interchangeable component by 31 May
Action owner	Procurement Manager
Trigger and contingency	If the primary supplier misses the June production milestone, place the approved secondary order and re-sequence commissioning work
Target assessment	Medium after qualification and production capacity are confirmed

The example connects the risk to an objective, explains the uncertainty, separates ownership from the action and establishes a trigger. “Supplier delay – high – Procurement” would not provide the same decision value.

Main Types of Business Risk

There is no universal list that fits every organisation. A risk taxonomy should help teams identify and aggregate exposure without forcing one risk into only one category.

Risk category	Typical sources or examples	Objectives commonly affected
Strategic	Poor assumptions, market change, failed investment, business-model disruption	Growth, mission, competitive position and long-term value
Operational	Process failure, capacity constraints, equipment failure, human error	Service, productivity, cost, quality and continuity
Financial	Liquidity, credit, currency, interest rate, fraud or budget pressure	Cash flow, affordability, investment and financial sustainability
Legal and compliance	Regulatory change, contractual breach, misconduct or inadequate records	Licence to operate, obligations, penalties and trust
Technology and cyber	System outage, data loss, security breach, technical obsolescence	Availability, confidentiality, integrity and digital delivery
People	Skills gaps, turnover, industrial relations, key-person dependency	Capacity, knowledge, safety, culture and performance
Third-party and supply chain	Supplier failure, concentration, subcontractor controls or geopolitical disruption	Delivery, quality, cost, continuity and compliance
Project and change	Requirements, estimates, dependencies, adoption or benefits uncertainty	Business case, scope, schedule, cost, quality and outcomes
Health, safety and environmental	Hazards, unsafe work, environmental events or inadequate controls	People, assets, environment, compliance and continuity
Reputational	Stakeholder response to conduct, failure, poor service or misinformation	Trust, relationships, demand and legitimacy

Categories overlap. A cyber incident can create operational, financial, compliance and reputational consequences. Reputation is also often a consequence of another risk rather than a standalone cause. The taxonomy should prompt broader thinking, not replace a clear cause-event-effect description.

Risk Assessment Tools and Techniques

Choose assessment methods according to the decision, available evidence and potential consequence.

Technique	Useful when	Main caution
Interviews and workshops	Different functions or stakeholders hold relevant knowledge	Group dynamics, optimism and anchoring can distort judgement
Checklists and lessons learned	Work is repeatable or historical experience is relevant	Past lists can obscure novel and emerging risks
Risk matrix	A common qualitative view is needed for screening and reporting	Scores can imply more precision than the scales support
Bow-tie analysis	Teams need to connect causes, preventive controls, event and recovery controls	A simplified diagram may miss wider system interactions
Scenario analysis	Several plausible futures or severe uncertainties need comparison	Scenarios require credible assumptions and decision relevance
Sensitivity analysis	Decision-makers need to know which assumptions most affect an outcome	It may test one variable at a time and miss dependencies
Failure Modes and Effects Analysis (FMEA)	Process, product or technical failure modes can be examined systematically	Ranking numbers should not replace engineering judgement
Quantitative cost or schedule analysis	Complex projects need a range of possible outcomes and contingency evidence	Model quality depends on realistic inputs, correlations and interpretation

IEC 31010 complements ISO 31000 with risk-assessment techniques. The objective is not to use the most sophisticated tool available; it is to produce evidence proportionate to the decision and uncertainty.

Risk Management in Project Management

Project risk management applies the same core process to temporary work and its business case. Risks may affect scope, schedule, cost, quality, safety, resources, suppliers, stakeholder adoption, benefits or the organisation receiving the output.

The Association for Project Management stresses that individual risk events and overall risk should be understood proactively, with threats minimised and opportunities maximised. It also recommends describing causes, uncertain events and effects separately so that analysis and responses are useful.

In practice, project teams should:

identify risk while developing requirements, estimates, contracts and the schedule;
reflect uncertainty in contingency and forecasts;
review exposure at milestones, changes and governance gates;
connect risk responses to the integrated project plan;
escalate risks beyond project authority or tolerance; and
transfer residual risks and controls clearly at handover.

A project risk register that is updated only before a steering meeting is not an active process. Risk owners and treatment actions should appear in normal planning and decision routines.

LOTC's guide to composite risk management explains a more specific five-step hazard-and-control approach. This article retains ownership of the broader organisational risk management process and its application across decisions, operations and projects.

Common Risk Management Mistakes

Build Practical Risk Management Capability with LOTC

Risk capability requires more than learning a scoring matrix. Professionals need to connect objectives, evidence, appetite, controls, treatments and governance while communicating uncertainty clearly.

LOTC's Governance, Risk and Compliance course covers organisational frameworks, risk assessment, appetite, controls and integrated GRC. Project professionals can explore Project Risk Management and Compliance for risk identification, analysis, response planning and monitoring in delivery environments.

Choose training according to the decisions participants make and the risks the organisation needs to manage. For an individual or corporate requirement, contact LOTC on WhatsApp.

Like what you read? Share with others.

Keywords

London optimum London training types of project management risk management project risk management risk management in project management professional risk manager risk management best practices risk management training Risk management courses

In This Article