How to identify and manage risk
Explore guides
On this page
Why risk management matters
Risk management helps your organisation make better decisions when there’s uncertainty. It is not only about avoiding problems. It can also help your organisation:
- prepare for change
- recognise opportunities
- protect the people, work and communities connected to your organisation.
Step 1. Understand risk and your goals
Start by looking at what your organisation is trying to achieve. Review your strategy, plans, programs, partnerships and major activities.
Boards and leaders should discuss risk as part of regular planning. This keeps risk management connected to strategy, rather than treating it as a separate compliance task.
Look at uncertainty, not just problems
When you identify risk, consider both sides of uncertainty. This involves asking:
- What could go wrong or cause harm?
- What could create value if managed well?
This helps your organisation avoid being too cautious. It also helps you decide which opportunities are worth pursuing.
Step 2. Identify and discuss main sources of risk
Identify and discuss the main sources of risk. These can come from inside or outside your organisation. They may relate to finances, people, governance, programs, audiences, partners, reputation, legal duties, technology, safety or the wider operating environment.
How to discuss risk
Questions to guide discussions about risk:
- What are we trying to achieve?
- What could prevent, delay or change the outcome?
- Who or what could be affected?
- What opportunities could this uncertainty create?
- What controls or safeguards are already in place?
- Who should monitor or manage this risk?
What’s the best way to describe risk?
Use plain language and explain what is uncertain, what could cause this risk, and what effect it could have.
Step 3. Assess likelihood and impact
After you identify a risk, assess how likely it is to occur and how serious the impact could be. Many organisations use simple ratings such as low, medium and high. The rating doesn’t need to be perfect. It just needs to help the board and leaders prioritise what needs attention first.
For each risk, determine the following:
- Likelihood: How likely the risk is to occur.
- Impact: What could happen if the risk occurs.
- Priority: How soon the organisation needs to act.
- Ownership: Who will monitor the risk and lead the response.
Risks to prioritise
Focus first on risks that could affect safety, legal duties, financial stability, reputation or strategic priorities.
Step 4. Decide how to respond
Once you understand a risk, decide how to respond. The right response depends on the risk, your goals, resources and risk appetite.
Responses can include:
- Reduce the risk: change plans, add controls or improve safeguards.
- Transfer the risk: use insurance, contracts or specialist support where appropriate.
- Avoid the risk: stop or change the activity if the risk is too high.
- Accept the risk: when you’re comfortable with the level of uncertainty.
When to get specialist advice
Seek specialist advice for risks related to the law, insurance, safeguarding, workplace safety, cyber security or financial controls.
Step 5. Record and track risks
You can track and record risks through a simple risk register. It should include a short risk description, likelihood, impact, priority, owner, response and review date.
Step 6. Review risks and adapt
Review risks regularly, not only when something goes wrong, and adapt as needed. Match your risk processes to your organisation’s size, activities, communities, art forms and resources.
- Small organisations: a simple risk register and regular board discussion may be sufficient.
- Larger organisations: may need more. This could include detailed reporting, a risk appetite statement, with risks reviewed through a committee or internal review process.
How to develop risk management documents
Lean how to develop key risk documents like a risk register, assessment matrix, risk appetite statement and treatment plan.
