01Purpose and scope
What should the framework help the business decide?
Connect the risk process with business objectives, activities and existing governance. Establish the boundaries and categories that organise the work.
Enterprise risk frameworks
Risk decisions need
a common basis.
Clear criteria. Defined authority.
Accountability across the business.
We help leadership establish how risks are assessed, owned, escalated and reviewed, with a framework that fits the organisation’s objectives and operating context.
Discuss your risk frameworkThe framework
Set the basis
for consistent judgement.
The framework gives teams a shared way to discuss exposure and responsibility. These six elements connect the risk policy with its use in management decisions.
02Risk appetite
What exposure is leadership prepared to accept?
Help management articulate its position on material risks, the limits that matter and the circumstances that require further consideration.
03Assessment criteria
How will teams make comparable judgements?
Define likelihood, impact and rating criteria. Establish a common basis for considering existing controls and the exposure that remains.
04Ownership
Who is accountable for each part of the process?
Clarify responsibilities for identifying, assessing, responding to and monitoring risks, with review and approval roles made explicit.
05Escalation
When does the decision need higher authority?
Set out the thresholds, exceptions and changes that need escalation, the information required and the forum or person responsible for the decision.
06Review and update
How will the framework stay relevant?
Define how risk information, actions and changes in the business are reviewed. Establish responsibility for updating the framework and its underlying assumptions.
Three distinct decisions
Assess the exposure.
Clarify what follows.
An assessment informs a decision. Appetite and escalation arrangements explain how that decision should be considered and who has authority to make it.
Appetite
The position leadership takes.
The exposure the organisation is prepared to accept in pursuing its objectives, with relevant limits and conditions made clear.
The management question
Is this exposure consistent with our intended position?
Assessment
The judgement teams make.
The likelihood and consequences of an event, the controls in place and the remaining exposure, considered on a common basis.
The management question
What does the evidence tell us about the risk?
Escalation
The authority a decision needs.
The conditions under which an exception, change or proposed response needs to be referred to the appropriate decision-maker.
The management question
Who needs to consider this, and what do they need to know?
A rating helps prioritise the discussion. The rationale, existing controls and response options remain part of the decision.
Selected work · A food and grocery retailer
Defined criteria.
A shared starting point.
The draft risk-assessment criteria developed for a food and grocery retailer illustrate one part of an enterprise framework: a common basis for discussing and prioritising exposure.
Risk assessment criteria
Make the terms
of the discussion explicit.
The matrix brings five likelihood levels and five impact levels together, with defined severity classifications. It gives teams a consistent format in which to record their judgement.
Explore the risk and continuity work- Likelihood
- From Rare to Almost certain.
- Impact
- From Insignificant to Severe.
- Classification
- Low, Medium, High or Critical.
- Use
- A reference for assessment discussions, supported by the evidence and reasoning behind each rating.
The example presents draft assessment criteria. It does not establish adoption of a full enterprise risk framework.
What the work can include
A framework to approve.
A process teams can use.
We develop the framework and supporting tools with leadership and relevant functions. Management retains responsibility for risk appetite, approvals and decisions.
Policy and governance
A risk policy, governance structure and allocation of responsibilities for assessment, response, oversight and approval.
A common assessment basis
Risk categories, appetite statements and criteria for likelihood, impact, control assessment and prioritisation.
Tools for use and review
Risk-register formats, reporting requirements, escalation routes and arrangements for reviewing the framework and open actions.
Start a conversation
Where does risk judgement
need greater consistency?
Start with the decisions your teams face, the criteria they use and the responsibilities that need to be clearer.
Discuss your enterprise risk framework