Key risk documents 

Most arts and culture organisations use the following risk documents: 

• Risk register: records the risks and opportunities.
• Risk assessment matrix: prioritises the risks them.
• Risk appetite statement: guides decision-making.
• Treatment plans: sets out what will be done for priority risks. 

These documents are connected and work best when used together.  

Step 1. Start with a risk register 

A risk register is usually the first document to create. It lists the main risks and opportunities your organisation needs to understand and manage. 

Your register does not need to be complex. It just needs be clear enough for your staff and board members to use in regular conversations about risk. 

How to create a risk register 

A basic risk register should include: 

• a short description of the risk or opportunity
• what could cause it and what could happen if it occurs
• how likely it is and how significant the impact could be
• who is responsible for monitoring the risk and what action is being taken. 
   

Step 2. Create a risk assessment matrix to prioritise risks 

A risk assessment matrix helps you compare risks by likelihood and impact. Many organisations use simple ratings such as low, medium and high. 

How to create and use the matrix 

• List the risks from your register.
• Assess how likely each risk is.
• Assess the possible impact on your organisation’s goals, people, finances, reputation and operations.
• Use the results to decide which risks need attention first. 

Step 3. Write a risk appetite statement 

A risk appetite statement explains the level of risk your organisation is prepared to take in different areas. These can include financial, artistic, strategic, operational, legal, safety and reputation risks. It helps the board and leadership make consistent decisions. 

How to create and use the statement 

• The statement should include a scale that explains what different levels of risk mean for your organisation.
• The board should agree the statement with leadership and review it when the organisation’s goals, activities or operating environment change.
• Use the statement to guide whether to accept, reduce, transfer or avoid a risk.

• Connect the statement to your strategy so risk decisions support organisational priorities. 

   

Step 4. Develop treatment plans for priority risks 

A treatment plan explains what your organisation will do about a priority risk.  

How to create a treatment plan 

A treatment plan should include:  

• the response
• the actions needed
• who is responsible
• when the work will be reviewed. 

Your organisation may accept, reduce, transfer or avoid a risk. The right response depends on the risk, your capacity and the level of uncertainty your organisation is prepared to carry. 
 

Step 5. Plan for crises and serious disruptions  

Some risks need a crisis or business continuity plan. These plans help your organisation respond quickly when there is a serious incident, disruption or loss of critical services. 

How to create a crisis plan 

This plan should identify:  

• who will make decisions during a crisis
• who needs to be contacted and how communication will be managed
• which activities or services must continue during disruption
• what roles staff, board members and external advisers will play
• when the plan will be tested and reviewed.
• whether insurance needs to be checked as part of crisis and business continuity planning.