Risk Management
-
1
What is risk and why manage it?
In everyday use, the word "risk" means something bad that has happened. In the profession it is something that might happen — and it may be damaging, or it may be an opportunity missed.
8 min read -
2
The risk management cycle
Risk management is not an annual meeting nor a file prepared for the auditor. It is a repeating cycle with known steps, turning for as long as the business runs.
9 min read -
3
Identifying risks and the risk register
A risk that has not been surfaced cannot be managed. This lesson is about the tools for surfacing risks, and about the document that gathers what has been found: the risk register.
9 min read -
4
Measurement: the impact and likelihood matrix
What is not measured is not ranked, and what is not ranked gets resources spread evenly across it until they are wasted. Here we learn how to give each risk a score that can be compared with the rest.
10 min read -
5
Treatment, controls and monitoring
We have identified the risk and measured it. The practical question remains: what do we do about it? There are four options and no fifth — and the tools for delivering them are controls.
9 min read