sample risk management strategic plan

An enhanced risk culture covers mind-sets and behaviors across the organization. A shared understanding is fostered of key risks and risk management, with leaders acting as role models.

3. Crisis preparedness and response

A high-performing, effective risk operating model and governance structure, with a well-developed risk culture minimize the probability of corporate crises , without, of course, completely eliminating them. When unexpected crises strike at high velocity, multinational companies can lose billions in value in the first days and soon find themselves struggling to keep their market position. A best-in-class risk management environment provides the ideal conditions for preparation and response.

In a digitized, networked world, with globalized supply chains and complex financial interdependencies, the risk environment has grown more perilous and costly. A holistic approach to risk management, based on the lessons, good and bad, of leading companies and financial institutions, can derive value from that environment. The path to risk resilience that is emerging is an effort, led by the board and senior management, to establish the right risk profile and appetite. Success depends on the support of a thriving risk culture and state-of-the-art crisis preparedness and response. Far from minimal regulatory adherence and loss avoidance, the optimal approach to risk management consists of fundamentally strategic capabilities, deeply embedded across the organization.

Daniela Gius is a senior expert in McKinsey’s Hamburg office, Jean-Christophe Mieszala is a senior partner in the Paris office, Ernestos Panayiotou is a partner in the Athens office, and Thomas Poppensieker is a senior partner in the Munich office.

The business logic in debiasing

Are you prepared for a corporate crisis?

Nonfinancial_risk_today_1536x1536_0_Standard

Nonfinancial risk today: Getting risk and the business aligned

Building a Mature Enterprise Risk Management Plan

In 2017, COSO published “Enterprise Risk Management Framework: Integrating with Strategy and Performance,” an updated framework for audit, risk, and compliance professionals to leverage in developing their risk management plans. The framework defines enterprise risk management (ERM) as the “culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.”

Today, risks are growing in complexity and volume, rendering the need for ERM more important than ever. Evolving cybersecurity threats, political, social, and economic fluctuation, and external risk events, including the 2008 global financial crisis and the 2020 COVID-19 pandemic crisis, point to the need for mature ERM practices to help the organization manage its response to strategic risks — the risk exposures that are most consequential to the organization’s ability to execute strategy and achieve its objectives.

Building a strategic risk management plan requires thorough preparation and involvement from management and the Board. The following is a step-by-step guide for audit, risk, and compliance professionals to build an enterprise risk management plan that can evolve and mature with the organization.

1. Familiarize with risk management framework examples and guidance.

Whether your risk management effort sits with the audit, risk, or compliance team, it is important for all involved parties to familiarize with ERM guidance documents widely available to the industry. Some examples of risk management frameworks commonly employed by audit, risk, and compliance professionals include:

2. Conduct risk management planning education and discussion sessions.

ERM is not a separate activity with its own objectives, but an integral part of the organization’s strategy setting and performance processes. For this reason, risk management planning requires the involvement of the Board and management. The Board is responsible for putting pressure on the CEO to identify those risks inherent in the business’s strategy, in addition to monitoring the organization’s risk culture. Management, with input from the Board, is responsible for identifying, managing, and monitoring strategic risks.

However, the responsibility to engage management and the Board in ERM discussions lies with the audit, risk, and compliance professionals leading the organization’s risk management efforts. In order to solicit management’s and the Board’s required involvement in ERM planning, the risk function must proactively educate leadership regarding the importance of strategic risk management. During education and discussion sessions, the risk management team should aim to:

3. Set a formal agenda item to discuss ERM strategies, objectives, and expectations.

Set a formal agenda item with senior leadership to discuss the role that risk management will play in the organization, as well as goals and expectations for the ERM program. A best practice is to identify an executive or Board member who will help drive ERM initiatives. Ideally, this risk advocate is already an embedded key player in the organization’s strategic planning process. It is also a best practice to establish an executive-level risk committee or working group to assist the appointed risk leader in driving risk management initiatives.

4. Perform a strategic risk assessment

Performing a strategic risk assessment will produce the information needed to begin developing your risk management plan. A strategic risk assessment involves identifying, understanding, and ranking the risks that are most consequential to the organization’s ability to execute its strategy and achieve its business objectives. This process, led by the risk leader and their team, is performed through surveys, interviews, and discussions conducted with management. The results of these assessments are then discussed among Board members and management in order to achieve consensus upon the top key risks facing the organization.

The appointed risk leader and their team can reference example models from risk management frameworks, such as COSO ’s Return Driven Strategy Model (pictured below), as a first step in preparing to conduct the risk assessment. This encourages approaching the risk assessment with a strategy-centric attitude versus a risk-centric one. This is important because overemphasis on risk-prevention can hinder the business from taking risks that may be important for growth, and breed increasingly risk-averse cultures.

For a step-by-step approach to conducting a strategic risk assessment, view AuditBoard’s article here. What will emerge from the process is a risk profile of the organization’s top strategic risks, which should ultimately be validated and finalized with management and the Board before moving on to the next step.

5. Develop enterprise risk management action plans.

Once you have validated and finalized the top strategic risks, the next step is to develop your risk mitigation action plans. During this phase of planning, a best practice is to develop a risk management charter that outlines risk management roles and responsibilities, and delineates specifically when and how internal audit and compliance will be involved. This is important because risk, internal audit, and compliance teams often overlap in their roles, capabilities, and methodologies — and allowing duplicative roles to persist can compromise the value of risk management initiatives. The risk charter may also include a universal appendix of risk definitions and a unified taxonomy, such as how the organization defines inherent risks, residual risks, and strategic risks. This can further unite risk perspectives and eliminate differing interpretations that may affect risk response strategies.

Once risk management roles and responsibilities have been clearly defined, the responsible business group can use the five risk responses — accept, avoid, pursue, reduce, share — to determine the best response to each of the organization’s key risks and develop appropriate risk management action plans. For examples of risk response strategies appropriate for your key risks, refer to the framework that best suits your organization’s strategic risk profile. Once the risk management action plans have been completed, communicate the overall action plan and strategic risk profile with the business.

6. Leverage technology to centralize your risk management plan and streamline collaboration.

ERM is a collaborative, cross-functional effort that requires modern technology to execute effectively at each stage. How organizations choose to leverage technology for ERM can have a significant impact on the quality and impact of their risk management plan. Managing risk across a large organization can be complex and involve many moving parts. One benefit an ERM solution can provide is the template for a universal, real-time risk register . In theory, a risk register is a trusted, centralized location that houses all important information on your business’s key risks, as well as links to their correlating action plans and risk assessments. In a manual environment of spreadsheets, emails, and shared drives, managing a risk register is prone to version control issues and can easily lose credibility. An integrated ERM solution that is cloud-based and leverages a relational database — where updates made in one place cascade throughout the entire system — provides the platform for a trustworthy, real-time risk register.

The Integration Imperative: Connecting People, Technology, and Business in a New Era of Risk

Investing in an intuitive, integrated risk management software solution can help your organization maximize collaborative efforts between internal audit, risk, and compliance groups by centralizing all risk management activities in one place, from your risk assessments to your risk management action plans. In addition, it can help you automate the risk assessment process and provide visibility into risk trends and mitigation activities. To learn how AuditBoard can help you manage your risk management plan from end to end, contact us by filling out the form below.

Planning for Tail Risk Resilience: Key Questions to Ask

How to Create a Project Risk Management Plan

By Kate Eby | February 27, 2023

Link copied

Teams can use a project risk management plan to identify and assess the potential risks to a project. We’ve gathered expert tips on creating an effective risk management plan, as well as step-by-step instructions for creating an example plan.

On this page, you’ll find information on what to include in a project risk management plan and how to create a plan , as well as step-by-step instructions for completing an example project risk management plan .

What Is a Project Risk Management Plan?

Project teams create a project risk management plan , a document that helps identify and assess potential risks to a project. The plan outlines how your team will analyze and mitigate the potential risks to ensure project success.

The project risk management plan is one of the most important documents in project risk management . You can learn more about project risks in general — as well as specific types of project risks — in our comprehensive guides

What Does a Risk Management Plan Cover?

A risk management plan should cover a number of areas detailing potential project risks and how your team will deal with them. It will include a description of the project, along with how your team will identify and assess risk.

At a minimum, your project risk management plan should include the following details:

“A risk management plan defines how the risks for a project will be handled to ensure that the project can be completed within the set timeframe,” says Veniamin Simonov, Director of Product Management at NAKIVO , a backup and ransomware recovery software vendor. “The plan should cover methodology, risk categorization and prioritization, a response plan, staff roles, and responsibility areas and budgets.”

“The risk management plan will address ‘What are we going to do? How are we going to do it? What are the processes we're going to follow?’” says Alan Zucker, Founding Principal of Project Management Essentials . “It may include things such as what are the major categories you're going to use to define your risks. It might also include some guidelines for assessing risks.”

Components in a Project Risk Management Plan

A project risk management plan will include certain components and describe how your project team will use certain tools to understand and manage potential risks. Some components include a risk register, a risk breakdown structure, and a risk response plan.

Here are components or tools that a project risk management plan often includes or describes:

To determine what you need to include in your risk management plan, see the following requirements based on project size:

An Organization’s Risk Management Plan Often Doesn’t Change with Projects

Many risk management experts emphasize that an organization’s project risk management plans might not change much from project to project. That’s because the plan sets out particulars that will be followed for all projects.

“Remember, it's just an approach document that answers the question: How?” says Kris Reynolds, Founder and CEO of Arrowhead Consulting in Tulsa, Oklahoma. “The company or the department as a whole should have a single risk management plan that gets built as you're building your project management methodology. And it’s your Bible. It’s your guidebook.

“But it isn't going to change across projects,” Reynolds continues. “What changes are the artifacts, including the risk register. But your approach of how you're going to address risk or analyze risk or plan for risk is in the project risk management plan document. As a company or organization, you create that document, and it exists for a year or two years without changing.”

To create a project risk management plan, your team should gather important documents and decide on an approach for assessing and responding to risks. This process involves gathering support documents, listing potential risk management tools, and more.

Consider some of these basic steps and factors as you begin creating the project risk management plan:

Steps in Developing a Project Risk Management Plan

After your project team has gathered documents and done other preparation work, you will want to follow nine basic steps in creating a project risk management plan. Those start with identifying and assessing risks.

Here are details on the nine steps of project risk management to keep in mind while drafting your project risk management plan:

Risk Management Plan Examples, Templates, and Components

Examples of project risk management plans can help your team understand what information to include in a plan. The risk management plan can also detail various components that will be part of your team’s risk management.

Project Risk Management Plan Template

Download the Sample Project Risk Management Plan Template for Microsoft Word

Download this sample project risk management plan, which includes primary components that might be described in a project risk management plan, such as details on risk identification, risk mitigation, and risk tracking and reporting.

Download the Blank Project Risk Management Plan for Microsoft Word

Use this blank template to create your own project risk management plan. The template includes sections to ensure that your team covers all areas of risk management, such as risk identification, risk assessment, and risk mitigation. Customize the template based on your needs.

Project Risk Register Template

Download the Sample Project Risk Register for Excel

This sample project risk register gives your team a better understanding of the information that a risk register should include to help the team understand and deal with risks. This sample includes potential risks that a project manager might track for a construction project.

Download the Blank Project Risk Register Template for Excel

Use this project risk register template to help your team identify, track, and plan for project risks. The template includes columns for categorizing risks, providing risk descriptions, determining a risk severity score, and more.

Quantitative Risk Register Template

Quantitative Risk Matrix Template Example

Download the Sample Quantitative Project Risk Impact Matrix for Excel

This sample quantitative project risk impact matrix template can help your team assess a project risk based on quantitative measures, such as potential monetary cost to the project. The template includes columns where your team can assess and track the probability and potential cost of each project risk. The template calculates a total monetary risk impact based on your estimates of probability and cost.

Risk Breakdown Structure Template

Risk Breakdown Structure Diagram Template

Download the Risk Breakdown Structure Template for Excel

Your team can use this template to create a risk breakdown structure diagram that shows different types of risks that could affect a project. The template helps your team organize risks into broad categories.

Step-By-Step Guide to Creating a Project Risk Management Plan

Below are step-by-step instructions on how to fill out a project risk management plan template. Follow these steps to help you and your team understand the information needed in an effective risk management plan.

This template is based on a project risk management plan template created by Arrowhead Consulting of Tulsa, Oklahoma, and was shared with us by Kris Reynolds.

Do Complex Projects Require More Complex Project Risk Management Plans?

Experts say that complex projects shouldn’t require more complex project risk management plans. A project might have more complex tools, such as a more detailed risk register, but the risk management plan should cover the same basics for all projects.

“The problem is, most people get these management plans confused. They then start lumping in the artifacts [such as risk registers] — which can be more complex and have more detail — to the risk management plan itself,” says Reynolds. “You want it to be easily understood and easily followed.

“I don't think the complexity of the project changes the risk management plan,” Reynolds says. “You may have to circulate the plan to more people. You may have to meet more frequently. You may have to use quantitative risk analysis. That would be more complex with more complex projects. But the management plan itself — no.”

Effectively Manage Project Risks with Real-Time Work Management in Smartsheet

From simple task management and project planning to complex resource and portfolio management, Smartsheet helps you improve collaboration and increase work velocity -- empowering you to get more done.

The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed.

When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time. Try Smartsheet for free, today.

Discover a better way to streamline workflows and eliminate silos for good.

Contact Sales

Risk management plan template

Starting a project without considering risks is, well, a big risk to take. Prevent major issues from occurring in your project with a risk management plan template. Learn how to create a risk management plan template in Asana.

INTEGRATED FEATURES

Recommended apps.

Before you start a project, it’s important to take into account any potential issues and risks that can prevent your project from progressing smoothly.

Using a risk management plan template can help you mitigate risk and establish a contingency plan so you can successfully hit your goals without a hitch. Here’s how to do it.

What is a risk management plan template?

A risk management plan template is a tool to help project managers prevent and measure potential risks. While the content of the template may change from project to project, the main structure of the template will not change. Using a template to manage the risk management process can help expedite future projects and align your team members so they know what to expect in the event that a risk occurs.

[product ui] risk management plan template in Asana (list view)

Creating a risk management plan template also makes it easier to manage projects with multiple stakeholders. When everyone is familiar with your established template, there’s less of a learning curve each time you start a new project.

What’s the purpose of a risk management plan?

Why create a risk management plan template.

Creating a risk management plan template is a best practice for project management professionals, and for good reason. Here’s why you should create a project risk management plan template before starting a large project.

Proactively prevent risks

With a risk management plan template, you can proactively ensure that problems that could occur already have a solution before they ever happen. By assigning a specific risk to a team member, you’re specifying the person responsible for actively monitoring each potential risk.

For some teams, developing mitigation strategies for high-impact projects is necessary before a project is even approved. This prevents high-risk projects from affecting major business operations. If your team doesn’t have mitigation plans in place, your project may not make it past the approval stage.

Provide clarity

A risk management plan template gives your team clarity, especially when it comes to contingency plans . Stakeholders often don’t enjoy hearing that something could go wrong with a project schedule , but if you and your team already have response strategies in place, it’s much easier to quell that anxiety. Collaborative work management software like Asana allows everyone on your team to access important risk management documentation, such as a risk log, a risk assessment matrix , or other project documents.

Encourage accountability

It’s not easy to own up to an issue when things go wrong. But when there’s an assigned risk owner, that individual is responsible for mitigating that risk as much as possible if it occurs. This allows team members to evaluate the negative impact of a potential risk and develop contingency plans if or when issues arise. Individual team members have the agency to find the right solution. And if any key stakeholders have questions regarding that specific risk, they know exactly which team member to ask.

What to include in your risk management plan template

Creating a risk management plan template is easy, but the way you manage information within the plan can vary from team to team. So how should you organize the information in your risk management plan template?

One of the easiest ways to do this is by importance—for example, by ranking risks according to their potential impact on your project. Or, you could organize your risk management plan template by the likelihood of each risk happening.

No matter how you organize your risk management plan template, it’s important to utilize a tool that is customizable and collaborative. That way, your team can organize your risk management plan template in a way that makes the most sense for your team.

4 steps to use your risk management plan template

Brainstorm which risks to add. Use collaborative software so everyone on your team can identify and add any potential risks that can negatively impact your project.

Assess the probability and impact of each risk. The probability and impact of each risk combined represents the potential impact of the risk. Make sure your template has a way to track both risk likelihood and severity.

Predict how likely each risk is . Based on historical data or previous projects, team members can predict the probability that each risk will occur.

Monitor risks during the project lifecycle. The easiest way to do this is to assign team members a specific risk to monitor throughout the lifetime of a project.

Integrated features

Custom fields . Custom fields are the best way to tag, sort, and filter work. Create unique custom fields for any information you need to track—from priority and status to email or phone number. Use custom fields to sort and schedule your to-dos so you know what to work on first. Plus, share custom fields across tasks and projects to ensure consistency across your organization.

Dependencies . Mark a task as waiting on another task with task dependencies. Know when your work is blocking someone else’s work, so you can prioritize accordingly. Teams with collaborative workflows can easily see what tasks they’re waiting on from others, and know when to get started on their portion of work. When the first task is completed, the assignee will be notified that they can get started on their dependent task. Or, if the task your work is dependent on is rescheduled, Asana will notify you—letting you know if you need to adjust your dependent due date as well.

Start dates . Sometimes you don’t just need to track when a to-do is due—you also need to know when you should start working on it. Start times and dates give your team members a clear sense of how long each task should take to complete. Use start dates to set, track, and manage work to align your team's objectives and prevent dependencies from falling through the cracks.

Subtasks . Sometimes a to-do is too big to capture in one task. If a task has more than one contributor, a broad due date, or stakeholders that need to review and approve before it can go live, subtasks can help. Subtasks are a powerful way to distribute work and split tasks into individual components—while keeping the small to-dos connected to the overarching context of the parent task. Break tasks into smaller components or capture the individual components of a multi-step process with subtasks.

Gmail . With the Asana for Gmail integration, you can create Asana tasks directly from your Gmail inbox. Any tasks you create from Gmail will automatically include the context from your email, so you never miss a beat. Need to refer to an Asana task while composing an email? Instead of opening Asana, use the Asana for Gmail add-on to simply search for that task directly from your Gmail inbox.

Outlook . As action items come in via email, like reviewing work from your agency or a request for design assets from a partner, you can now create tasks for them in Asana right from Outlook. You can then assign the new task to yourself or a teammate, set a due date, and add it to a project so it’s connected to other relevant work.

Zendesk . With Asana's Zendesk integration, users can quickly and easily create Asana tasks directly from Zendesk tickets. Add context, attach files, and link existing tasks to track work needed to close out the ticket. The integration also provides continuing visibility across both systems, so everyone is kept up to speed regardless of which tool they use.

Jira . Create interactive, connected workflows between technical and business teams to increase visibility around the product development process in real-time—all without leaving Asana. Streamline project collaboration and hand offs. Quickly create Jira issues from within Asana so that work passes seamlessly between business and technical teams at the right time.

Do I need a risk management plan template?

A risk management plan template is a helpful collaboration tool. If you’re looking for a way to connect your project team members and your key stakeholders, a risk management plan template can help your team get on the same page by compiling all work in one central place.

How do you use a risk management plan template?

A risk management plan template is most commonly used to help mitigate potential risks. Use your risk management plan template during the project planning phase. Brainstorm potential risks with your team and log them into your already existing template. Remember to include the likelihood of the risk happening, a description of the risk, and a team member who is responsible for that specific risk should it occur.

What is the purpose of a risk management plan template?

Use a risk management plan template to help mitigate risks as your team moves through the project lifecycle. You can use a risk management plan template to help align project managers and team members to establish a tentative plan if a risk happens. You can also use it to help establish set processes for future projects. This can help expedite the risk management process and give your team some guidelines to work with.

How do I make a risk management plan template?

Your risk management plan template should live in a project management platform that your entire team has access to. By tracking this information in a central source of truth, you can track all potential risks, the impact of those risks, and who is responsible for monitoring and reacting to the risk if it occurs. Your risk management plan template should include descriptions of potential risks, the level of impact a risk would have on a project, the likelihood of that risk occurring, and a dedicated individual to monitor that specific risk.

What are the benefits of creating a risk management plan template?

A risk management plan template can help your team proactively prevent risks, provide your team clarity on contingency plans, and encourage accountability with team members. Creating a risk management plan template can help standardize processes across the organization, further preventing more risk.

Waterfall project management

Standardize your project process with a waterfall project management template. Break your project into sequential phases that map to your end goal.

Status report

Keep track of project status and provide key stakeholders with at-a-glance progress updates with a project status report template.

Weekly to-do list template

Clarity doesn’t have to be complicated. With a weekly to-do list template, you can create a new task list in seconds every Monday.

Project timeline template

Learn how to keep a project on track—and ensure success—by creating a project timeline template.

RFP Process

Use our template to prepare an RFP, then organize and evaluate the responses—all in the same place—so you can pick the best vendor for the job.

Business process management template

Learn how a business process management template can help improve your business processes.

Project estimation

Create a project estimation template to accurately scope project resources and align on project expectations.

Communication plan

Keep everyone on the same page and clearly communicate important information to stakeholders by creating a communication plan template in Asana.

Work log template

See where you're losing time and kickstart your productivity by creating a work log template in Asana.

Project schedule

Complex work, simplified. Organize project tasks, deliverables, and milestones into one cohesive schedule. Learn how to create a customized project schedule template in Asana.

Prioritization matrix

Take the guesswork out of task prioritization by creating a prioritization matrix template. Prioritize your work by business impact and needed effort.

IT project plan

Organize your IT work in one place. Manage deployments, order equipment, and connect teams—without compromising security.

Risk register template

Create a risk register template to proactively identify and solve potential roadblocks before they become a bigger problem.

Daily planner template

Keeping your day organized is more than just writing down a list of daily to-dos. Learn how to create a daily planner template in Asana.

[Templates] Event Marketing Plan (Card image)

Event promotion plan

Use Asana’s event marketing plan template to increase event awareness, build excitement, and drive audience attendance.

Marketing project plan

Our template guides you through project management best practices for marketing teams so you can get from strategy to tactics to results.

HR project plan

No matter the project, human resources teams can use our template to set priorities, track progress, and streamline recurring work.

Design project plan

What’s the secret to more productive design and creative projects? A smooth creative process.

Project documentation

Looking for documents is a giant time waster for most people—which is where a project documentation process comes in. Learn how to create a project documentation template so that you always know where documents live—for every project, company-wide.

Eisenhower Matrix template

Overwhelmed by your to-do list? Learn how to create an Eisenhower Matrix template in Asana so you can prioritize and sort your tasks based on their urgency and importance.

Scope management plan template banner image

Project scope management plan

A project’s scope is just as important as its budget or timeline. Prioritize this crucial part of project management by creating a project scope management plan template.

RACI matrix

Team decision-making can be hard—a RACI matrix template makes it easier. Define each project task role to instantly boost clarity for all your stakeholders.

Project initiation template document card image

Project initiation document

A project initiation document template is a helpful way to standardize the information you share with your team before a project begins.

Project premortem

A premortem is a brainstorming tactic your team uses to anticipate different ways a project can fail. Learn how to use a premortem template to minimize project risk.

Implementation plan

Create an implementation plan template to break down your business goals into manageable, achievable steps.

Project charter template

Want to nail your next project pitch? Create a project charter template and outline everything you need to get your next initiative approved.

Public relations plan

Create focused, targeted, and organized PR campaigns—no matter who’s planning them—with a public relations plan template.

A sales plan template can help provide your team with the organized framework they need to establish their sales goals. Learn how you can do that with Asana.

[Templates] Operations Project Plan (Card)

Operations project plan template

Operations teams strive to optimize and gain efficiency across the business, and can do the same for their own projects with our template.

Web production process template banner image

Web production template

Let our template help you coordinate a web production schedule—even if producers and web developers work out of different tools.

Action items template

No matter your best intentions, you need more than motivation to knock out your to-dos. An action item template—where you decide the who, what, and when of every task—can help you organize your workflows and get more done.

Learn how creating a RAID log template in Asana can help you proactively identify and mitigate project risks.

Change management plan template

Is your organization starting to make some big changes? Create a change management plan template to make the process easier.

Critical path method template

Project delays holding you back? Create a critical path method template to visualize everything that needs to be done in order to reach your end goal.

Bill of materials

Learn how a bill of materials template helps keep you organized by housing all the information needed for the successful completion of your project.

Short-term goals template

Learn how reusable short-term goals templates can take your goals from vision to reality.

Milestone chart template

Milestone charts highlight significant moments in your workflow. Learn why this matters and how to create one for yourself.

Create templates with Asana

Learn how to create a customizable template in Asana with a free Premium trial today.

Contributors

Strategic Risk Management: A Primer for Directors

Matteo Tonello is managing director of corporate leadership at the Conference Board. This post is based on an issue of the Conference Board’s Director Notes series by Mark L. Frigo and Richard J. Anderson, director and professor of strategic risk management, respectively, at DePaul University. This Director Note was based on a book authored by Dr. Frigo and Mr. Anderson, available here .

As noted by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), “In the aftermath of the financial crisis, executives and their boards realize that ad hoc risk management is no longer tolerable and that current processes may be inadequate in today’s rapidly evolving business world.” [1] However, especially for nonfinancial companies that may be relatively new to these topics, enhancing risk management can be a somewhat daunting task.

This article focuses on two key aspects of the relationship between risk and strategy: (1) understanding the organization’s strategic risks and the related risk management processes, and (2) understanding how risk is considered and embedded in the organization’s strategy setting and performance measurement processes. These two areas not only deserve the attention of boards, but also fit closely with one of the primary responsibilities of the board — risk oversight.

The Advent of Strategic Risk Management

Enterprise risk management (“ERM”) and risk management in general can encompass a wide range of risks that face any organization. Some risks may reflect exposures that, although harmful, will not threaten the overall health of an organization or its ability to ultimately meet its business objectives. For example, a temporary data center outage can result in a short-term problem or customer dissatisfaction, but once recovered, the organization can quickly be back on track. Other more significant risk events can be catastrophic, resulting in losses that can not only impair an organization’s ability to meet its objectives, but may also threaten the organization’s survival. The recent credit crisis is an example of this type of risk. These more significant risk exposures have given rise to a focus on “strategic risks” and “strategic risk management.” “Strategic risks” are those risks that are most consequential to the organization’s ability to execute its strategies and achieve its business objectives. These are the risk exposures that can ultimately affect shareholder value or the viability of the organization. “Strategic risk management” then can be defined as “the process of identifying, assessing and managing the risk in the organization’s business strategy—including taking swift action when risk is actually realized.” Strategic risk management is focused on those most consequential and significant risks to shareholder value, an area that merits the time and attention of executive management and the board of directors.

Standard & Poor’s included the following attributes for strategic risk management in its 2008 announcement that it would apply enterprise risk analysis to corporate ratings:

Management’s view of the most consequential risks the firm faces, their likelihood, and potential effect; The frequency and nature of updating the identification of these top risks; The influence of risk sensitivity on liability management and financial decisions, and The role of risk management in strategic decision making. [2]

Clearly the potential impact of strategic risks is significant enough to deserve the attention of the board and its directors.

Strategic Risk Management and the Role of the Board

At the board level, strategic risk management is a necessary core competency. [3] In Ram Charan’s book, Owning Up: The 14 Questions Every Board Member Needs to Ask, one of the questions posed is “Are we addressing the risks that could send our company over the cliff?” [4] According to Charan, boards need to focus on the risk that is inherent in the strategy and strategy execution:

Risk is an integral part of every company’s strategy; when boards review strategy, they have to be forceful in asking the CEO what risks are inherent in the strategy. They need to explore ‘what ifs’ with management in order to stress-test against external conditions such as recession or currency exchange movements. [5]

Regarding risk culture, Charan provides the following insight: “Boards must also watch for a toxic culture that enables ethical lapses throughout the organization. Companies set rules—but the culture determines how employees follow them.” [6] We believe that corporate culture plays a significant role in how well strategic risk is managed and must be considered as part of a strategic risk assessment.

Understanding an Organization’s Strategic Risks and Related Risk Management Processes

A necessary first step for boards to understand their strategic risks and how management is managing and monitoring those risks is a strategic risk assessment. A strategic risk assessment is a systematic and continual process for assessing the most significant risks facing an enterprise. [7] It is anchored and driven directly by the organization’s core strategies. As noted in a 2011 COSO report, “Linkage of top risks to core strategies helps pinpoint the most relevant information that might serve as an effective leading indicator of an emerging risk.” [8]

Conducting an initial assessment can be a valuable activity and should involve both senior management and the board of directors. Management should take the lead in conducting the assessment, but the assessment process should include input from the board members and, as it is completed, a thorough review and discussion between management and the board. These dialogues and discussions may be the most beneficial activities of the assessment and afford an opportunity for management and the directors to come to a consensus view of the risks facing the company, as well any related risk management activities.

The strategic risk assessment process is designed to be tailored to an organization’s specific needs and culture. To be most useful, a risk management process and the resultant reporting must reflect and support an enterprise’s culture so the process can be embedded and owned by management. Ultimately, if the strategic risk assessment process is not embedded and owned by management as an integral part of the business processes, the risk management process will rapidly lose its impact and will not add to or deliver on its expected role.

The Strategic Risk Assessment Process

There are seven basic steps for conducting a strategic risk assessment:

1 Achieve a deep understanding of the strategy of the organization The initial step in the assessment process is to gain a deep understanding of the key business strategies and objectives of the organization. Some organizations have welldeveloped strategic plans and objectives, while others may be much more informal in their articulation and documentation of strategy. In either case, the assessment must develop an overview of the organization’s key strategies and business objectives. This step is critical, because without these key data to focus around, an assessment could result in a long laundry list of potential risks with no way to really prioritize them. This step also establishes a foundation for integrating risk management with the business strategy. In conducting this step, a strategy framework could be useful to provide structure to the activity.a

2 Gather views and data on strategic risks The next step is to gather information and views on the organization’s strategic risks. This can be accomplished through interviews of key executives and directors, surveys, and the analysis of information (e.g., financial reports and investor presentations). This data gathering should also include both internal and external auditors and other personnel who would have views on risks, such as compliance or safety personnel. Information gathered in Step 1 may be helpful to frame discussions or surveys and relate them back to core strategies. This is also an opportunity to ask what these key individuals view as potential emerging risks that should also be considered.

3 Prepare a preliminary strategic risk profile Combine and analyze the data gathered in the first two steps to develop an initial profile of the organization’s strategic risks. The level of detail and type of presentation should be tailored to the culture of the organization. For some organizations, simple lists are adequate, while others may want more detail as part of the profile. At a minimum, the profile should clearly communicate a concise list of the top risks and their potential severity or ranking. Colorcoded reports or “heat-maps” may be useful to ensure clarity of communication of this critical information.

4 Validate and finalize the strategic risk profile The initial strategic risk profile must be validated, refined, and finalized. Depending on how the data gathering was accomplished, this step could involve validation with all or a portion of the key executives and directors. It is critical, however, to gain sufficient validation to prevent major disagreements on the final risk profile.

5 Develop a strategic risk management action plan This step should be undertaken in tandem with Step 4. While significant effort can go into an initial risk assessment and strategic risk profile, the real product of this effort should be an action plan to enhance risk monitoring or management actions related to the strategic risks identified. The ultimate value of this process is helping and enhancing the organization’s ability to manage and monitor its top risks.

6 Communicate the strategic risk profile and strategic risk management action plan Building or enhancing the organization’s risk culture is a communications effort with two primary focuses. The first focus is the communication of the organization’s top risks and the strategic risk management action plan to help build an understanding of the risks and how they are being managed. This helps focus personnel on what those key risks are and potentially how significant they might be. A second focus is the communication of management’s expectations regarding risk to help reinforce the message that the understanding and management of risk is a core competency and expected role of people across the organization. The risk culture is an integral part of the overall corporate culture. The assessment of the corporate culture and risk culture is an initial step in building and nurturing a high performance, high integrity corporate culture.

7 Implement the strategic risk management action plan As noted above, the real value resulting from the risk assessment process comes from the implementation of an action plan for managing and monitoring risk. These steps define a basic, high-level process and allow for a significant amount of tailoring and customization to reflect the maturity and capabilities of the organization. As shown by Figure 1, strategic risk assessment is an ongoing process, not just a one-time event. Reflecting the dynamic nature of risk, these seven steps constitute a circular or closed-loop process that should be ongoing and continual within the organization.

Integrating Strategic Risk Management in Strategy Setting and Performance Measurement Processes

The second step for an organization is to integrate strategic risk management into its existing strategy setting and performance measurement processes. As discussed above, there is a clear link between the organization’s strategies and its related strategic risks. Just as strategic risk management is an ongoing process, so is the need to establish an ongoing linkage with the organization’s core processes to set and measure its strategies and performance. This would include integrating risk management into strategic planning and performance measurement systems. Again, the maturity and culture of the organization should dictate how this performed. For some organizations, this may be accomplished through relatively simple processes, such as adding a page or section to their annual business planning process for the business to discuss the risks it sees in achieving its business plan and how it will monitor those risks. For organizations with more developed performance measurement processes, the Kaplan- Norton Strategy Execution Model described in The Execution Premium may be useful. [9] This model describes six stages for strategy execution and provides a useful framework for visualizing where strategic risk management can be embedded into these processes.

Stage 1: Develop the strategy This stage includes developing the mission, values, and vision; strategic analysis; and strategy formulation. At this stage, a strategic risk assessment could be included using the Return Driven Strategy framework to articulate and clarify the strategy and the Strategic Risk Management framework to identify the organization’s strategic risks.

Stage 2: Translate the strategy This stage includes developing strategy maps, strategic themes, objectives, measures, targets, initiatives, and the strategic plan in the form of strategy maps, balanced scorecards, and strategic expenditures. Here, the strategic risk management framework would be used to develop risk-based objectives and performance measures for balanced scorecards and strategy maps, and for analyzing risks related to strategic expenditures. [10] At this stage, boards may also want to consider developing a risk scorecard that includes key metrics.

Stage 3: Align the organization This stage includes aligning business units, support units, employees, and boards of directors. The Strategic Risk Management Alignment Guide and Strategic Framework for GRC (Governance, Risk and Compliance) would be useful for aligning risk and control units toward more effective and efficient risk management and governance, and for linking this alignment with the strategy of the organization. [11]

Stage 4: Plan operations This stage includes developing the operating plan, key process improvements, sales planning, resource capacity planning, and budgeting. In this stage, the strategic risk management action plan can be reflected in the operating plan and dashboards, including risk dashboards. One organization we worked with developed a “resources follow risk” philosophy to make certain that resources were appropriately and efficiently allocated. This philosophy focused on ensuring that resources used in risk management are justified economically based on the relative amount of risk and cost-benefit analysis.

Stage 5: Monitor and learn This stage includes strategy and operational reviews. “Strategic risk reviews” would be part of the ongoing strategic risk assessment, which reinforces the necessary continual, closed-loop approach for effective strategy risk assessment and strategy execution.

Stage 6: Test and adapt This stage includes profitability analysis and emerging strategies. Emerging risks can be considered part of the ongoing strategic risk assessment in this stage. The strategic risk assessment can complement and leverage the strategy execution processes in an organization toward improving risk management and governance.

For more information about integrating risk management in the strategy execution model and a discussion of risk scorecards, see “Risk Management and Strategy Execution Systems.” [12]

Final Thoughts: Moving Forward with Strategic Risk Management

Management teams and boards must challenge themselves and their organizations to move up the strategic risk management learning curve. Developing strategic risk management processes and capabilities can provide a strong foundation for improving risk management and governance. Boards may want to consider engaging independent advisors to advise and educate themselves on these matters. For organizations that are early in this process, the seven keys to success for improving ERM as described in a 2011 COSO Thought Leadership Paper may be useful, and are applicable in strategic risk management:

However the board decides to proceed, their leadership, direction, and overall oversight will be critical to the success of a strategic risk management process.

[1] “Effective Enterprise Risk Oversight: The Role of the Board of Directors,” COSO 2009, p. 1. (go back)

[2] “Enterprise Risk Management, Standard & Poor’s to Apply Enterprise Risk Analysis to Corporate Ratings” Standard & Poor’s press release, May 7, 2008 (www.standardandpoors.com). (go back)

[3] Mark L. Frigo, “Strategic Risk Management: The New Core Competency,” Balanced Scorecard Report, 11, no. 1, January–February 2009. (go back)

[4] Ram Charan, Owning Up: The 14 Questions Every Board Member Needs to Ask (San Francisco: John Wiley & Sons 2009). (go back)

[5] Charan, Owning Up: The 14 Questions Every Board Member Needs to Ask, p. 23. (go back)

[6] Charan, Owning Up: The 14 Questions Every Board Member Needs to Ask, p. 28. (go back)

[7] Mark L. Frigo and Richard J. Anderson, “Strategic Risk Assessment: A First Step for Improving Risk Management and Governance,” Strategic Finance, December 2009. (go back)

[8] Mark S. Breasley, Bruce C. Branson and Bonnie V. Hancock, “Developing Key Risk Indicators to Strengthen Enterprise Risk Management,” COSO, 2011 p.2. (go back)

[9] Robert S. Kaplan and David P. Norton, The Execution Premium (Cambridge, MA: Harvard Business Press, 2008). (go back)

[10] Mark L. Frigo and Richard J. Anderson, “Strategic Risk Management: A Primer for Directors and Management Teams,” 2012. (go back)

[11] Mark L. Frigo and Richard J. Anderson, “A Strategic Framework for Governance, Risk and Compliance,” Strategic Finance, February 2010. (go back)

[12] Robert S. Kaplan, “Risk Management and Strategy Execution Systems,” Balanced Scorecard Report, Vol. 11, No. 6, November-December 2009. (go back)

[13] Mark L Frigo and Richard J. Anderson, “Embracing Enterprise Risk Management: Practical Approaches for Getting Started,” COSO, 2011. (go back)

ERM and SRM should consider integrating with the Competitive Intelligence process. This will guarantee proficiency in Collection and Strategy development and Integration.

Integration of CI into this process will increase to identify risks in advance. I have written about it three years ago.

One Trackback

[…] full article via Strategic Risk Management: A Primer for Directors — The Harvard Law School Forum on Corporate Gove…. Share OptionsPrintEmailMoreFacebookLinkedInStumbleUponTwitterPinterestRedditDiggTumblrLike […]

Supported By:

Subscribe or Follow

Program on corporate governance advisory board.

Please wait while your request is being verified...

RISK-ACADEMY Blog

Controversial thoughts about modern day risk management in non-financial companies, training and consulting services.

4 steps to integrate risk management into strategic planning

Let me first start by saying integrating risk management into strategic planning is NOT doing a strategic risk assessment or even having a risk conversation at the strategy setting meeting, it is so much more. You will also find it difficult to relate if the objectives have not been defined or documented in your company or if the objectives are not measurable.

Kevin W Knight, during his first visit to Russia a few years ago, said ‘ risk management is a journey… not a destination’. Risk practitioners are free to start their integration journey at any process or point in time, however, I believe that evaluating strategic [email protected] can be considered a good starting point. The reason why I think this is a good starting point is because it is relatively simple to implement, yet has an immediate and a significant impact on senior management decision making.

STEP 1 – STRATEGIC OBJECTIVES DECOMPOSITION

Any kind of risk analysis should start by taking a high-level objective and breaking it down into more tactical, operational key performance indicators (KPIs) and targets. When breaking down any objectives it is important to follow the McKinsey MECE principle (ME – Mutually Exclusive, CE – Collectively Exhaustive) to avoid unnecessary duplication and overlapping. Most of the time strategic objectives are already broken down into more tactical KPIs and targets by the strategy department or HR, so this saves the risk manager a lot of time.

This is a critical step to make sure risk managers understand the business logic behind each objective and helps make risk analysis more focused.

Important note, while it should be management’s responsibility to identify and assess risks, the business reality in your company may be that sometimes the risk manager should take the responsibility for performing risk assessment on strategic objectives and take the lead.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

EXAMPLE: RISK MANAGEMENT IMPLEMENTATION

STEP 2 – IDENTIFYING FACTORS, ASSOCIATED WITH UNCERTAINTY

Once the strategic objectives have been broken down into more tactical, manageable pieces, risk managers need to use the strategy document, financial model, business plan or the budgeting model to determine key assumptions made by the management.

Most assumptions are associated with some form of uncertainty and hence require risk analysis. Risk analysis helps to put unrealistic management assumptions under the spotlight. Common criteria for selecting management assumptions for further risk analysis include:

The assumption is associated with high uncertainty.
The assumption impact is properly reflected in the financial model (for example, it makes no sense to assess foreign exchange risk if in the financial model all foreign currency costs are fixed in local currency and a change in currency insignificantly affects the calculation).
The organisation has reliable statistics or experts to determine the possible range of values and the possible distribution of values.
There are reliable external sources of information to determine the possible range of values and the possible distribution of values.

For example, a large investment company may have the following risky assumptions: the expected rate of return for different types of investment, an asset sale timeframe, timing and the cost of external financing, rate of expected co-investment, exchange rates and so on.

Concurrently, risk managers should perform a classic risk assessment to determine whether all significant risks were captured in the management assumptions analysis. The risk assessment should include a review of existing management and financial reports, industry research, auditors’ reports, insurance and third party inspections, as well as interviews with key employees.

By the end of this step risk managers should have a list of management assumptions . For every management assumption identified, risk managers should work with the process owners, internal auditors and utilise internal and external information sources to determine the ranges of possible values and their likely distribution shape .

EXAMPLE: RISK MANAGEMENT IMPLEMENTATION (CONTINUED)

STEP 3 – PERFORMING RISK ANALYSIS

The next step includes performing a scenario analysis or the Monte-Carlo simulation to assess the effect of uncertainty on the company’s strategic objectives. Risk modeling may be performed in a dedicated risk model or within the existing financial or budget model. There is a variety of different software options that can be used for risk modeling. All examples in this guide were performed using the Palisade @Risk software package , which extends the basic functionality of MS Excel or MS Project to perform powerful, visual, yet simple risk modeling.

When modeling risks it is critical to consider the correlations between different assumptions. One of the useful tools for an in-depth risk analysis and identification of interdependencies is a bow-tie diagram. Bow-tie diagrams can be done manually or using the Palisade Big Picture software . Such analysis helps to determine the causes and consequences of each risk, improves the modeling of them as well as identifying the correlations between different management assumptions and events.

The outcome of risk analysis helps to determine the risk-adjusted probability of achieving strategic objectives and the key risks that may negatively or positively affect the achievement of these strategic objectives. The result is [email protected].

STEP 4 – TURNING RISK ANALYSIS INTO ACTIONS

Risk managers should discuss the outcomes of risk analysis with the executive team to see whether the results are reasonable, realistic and actionable. If indeed the results of risk analysis are significant, then the management with the help from the risk manager may need to:

Revise the assumptions used in the strategy.
Consider sharing some of the risk with third parties by using hedging, outsourcing or insurance mechanisms.
Consider reducing risk by adopting alternative approaches for achieving the same objective or implementing appropriate risk control measures.
Accept risk and develop a business continuity / disaster recovery plan to minimise the impact of risks should they eventuate.
Or, perhaps, change the strategy altogether (the most likely option in our case)

Based on the risk analysis outcomes it may be required for the management to review or update the entire strategy or just elements of it. This is one of the reasons why it is highly recommended to perform risk analysis before the strategy is finalised.

At a later stage, the risk manager should work with the internal audit to determine whether the risks identified during the risk analysis are in fact controlled and the agreed risk mitigations are implemented.

WATCH THE FREE WEBINAR TO FIND OUT MORE: https://www.youtube.com/watch?v=Ne0k-YW9ffA

Please comment, share and like.

– – – – – – – – – – – – – – – – – – – – –

RISK-ACADEMY offers decision making and risk management training and consulting services. Our corporate risk management training programs are specifically designed to promote risk-based decision making and integrating risk management into business processes. Risk managers all over the world call us in to help sell idea of integrating risk analysis into decision making and using quantitative risk analysis techniques. Check out most popular course for decision makers https://riskacademy.blog/product/risk-based-decision-making-executives/ or our dedicated programs to help risk managers learn the foundations of quant risk analysis https://riskacademy.blog/product/risk-managers-training/ . We can also help audit risk management effectiveness or develop a roadmap for risk management integration into decision making https://riskacademy.blog/product/g31000-risk-management-maturity-assessment/

Check out other decision making books

RISK-ACADEMY offers online courses

Informed Risk Taking

Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!

ISO31000 Integrating Risk Management

Alex Sidorenko , known for his risk management blog http://www.riskacademy.blog , has created a 25-step program to integrate risk management into decision making, core business processes and the overall culture of the organization.

Advanced Risk Governance

This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.

Please share to improve risk literacy

Click to share on Twitter (Opens in new window)
Click to share on Facebook (Opens in new window)
Click to share on LinkedIn (Opens in new window)
Click to share on Reddit (Opens in new window)
Click to share on Tumblr (Opens in new window)
Click to share on Pinterest (Opens in new window)
Click to share on Pocket (Opens in new window)
Click to share on Telegram (Opens in new window)
Click to share on WhatsApp (Opens in new window)
Click to share on Skype (Opens in new window)
Click to print (Opens in new window)
Click to email a link to a friend (Opens in new window)

Published by Alex Sidorenko

View all posts by Alex Sidorenko

16 thoughts on “ 4 steps to integrate risk management into strategic planning ”

Hi Alex,Congratulations for the very nice presentation!

Pingback: Risk Management Could Be a Powerful Tool, But it Just isn’t (part 1) – RISK-ACADEMY Blog
Pingback: Here is a small lesson I learned a while back – RISK-ACADEMY Blog
Pingback: RISK-ACADEMY top blog posts in 2017 – RISK-ACADEMY Blog
Pingback: COSO ERM 2017 – full review by Alex Sidorenko (part 1) – RISK-ACADEMY Blog
Pingback: COSO ERM 2017 – full review by Alex Sidorenko (part 2) – RISK-ACADEMY Blog
Pingback: 4 steps to integrate risk management into strategic planning - РИСК-АКАДЕМИЯ АНО ДПО ИСАР
Pingback: COSO ERM 2017 – full review by Alex Sidorenko (part 1) RISK-ACADEMY Blog
Pingback: 4 steps to integrate risk management into strategic planning - RISK OWNER by RISK-ACADEMY
Pingback: Most influential risk management articles of 2021 RISK-ACADEMY Blog

sample risk management strategic plan

IMAGES

VIDEO

COMMENTS