What is risk management?
Explore guides
On this page
What is it?
Risk management is the process of identifying, assessing, responding to and monitoring uncertainty. It helps your organisation understand what could affect your purpose, reputation, finances, people, network and programs.
Risk is about uncertainty
Risk isn’t just about when things go wrong. Risk is about uncertainty.
Managing risks involves threats, such as financial pressure, safety issues or damage to reputation. It can also involve opportunities, such as reaching new audiences, testing a new program model or forming a new partnership.
Risk management helps you navigate uncertainty
A useful risk conversation considers both threats and opportunities. You need to ask:
- What could go wrong?
- What risks are worth taking to meet our goals?
Why does it matter?
Risk management should support your organisation’s purpose and strategy. Your board and leadership consider what risks and threats could stop the organisation from achieving its goals, and what risks and opportunities are worth taking.
This helps you make informed decisions. It also helps the board understand whether the level of risk fits the organisation’s purpose, capacity and responsibilities.
The risk management cycle
Most risk management processes follow four basic steps:
- Identify the risks and opportunities that could affect the organisation.
- Assess how likely each risk is and what impact it could have.
- Decide how the organisation will respond.
- Monitor risks and review whether the response is working.
What boards and leadership do
Risk management is shared work, but the board and leadership have different roles.
- The board oversees major risks and checks that the organisation has a clear approach to managing them.
- Leadership manages day-to-day risks and reports significant risks to the board.
- The board and leadership work together to understand the organisation’s risk profile and agree what needs attention.
The board should discuss risk regularly. It may choose to make risk a standing agenda item and review the risk register at board meetings.
Documents that help you manage risk
Risk documents help your board and staff record, discuss and review risk. They do not need to be complex. The right level of detail depends on your organisation’s size, activities, communities and obligations.
- Risk register: Lists key risks, their likelihood and impact, who is responsible and what action is being taken.
- Risk assessment matrix: Helps compare risks and decide which need attention first.
- Risk appetite statement: Explains the level of risk your organisation is prepared to take in different areas. It may use a scale to describe different levels of risk.
- Risk treatment plan: Sets out how your organisation will manage, reduce, transfer, avoid or accept a risk.
- Crisis or business continuity plan: Explains what your organisation will do if a serious disruption or crisis occurs.
Start with the right level of detail
Small or new organisations
If you’re a small or newly established organisation, start with a simple risk register and regular board discussion. The register should focus on the risks most likely to affect the organisation’s purpose, people, finances, activities and communities.
Medium and larger organisations
If you’re a larger organisation, you may need more structured policies, reporting, committees or specialist advice. This will depend on your organisation’s scale, activities, legal structure, reporting obligations, agreements and risk profile.
When to seek professional support
You should seek professional advice if your organisation is facing complex risks in areas such as:
- legal matters
- financial matters
- safety
- child safeguarding
- employment
- insurance
- crisis management.
How to identify and manage risk
Learn how to identify, assess and manage risks and opportunities for your organisation.
