Risk Management Framework: How to Build One That Works

A risk management framework is the set of arrangements that makes risk handling consistent across your business: who owns risk, how risks are identified and rated, how much risk you will accept, what you do about the rest, and how it all gets reviewed. For a small or mid-sized UK business, a working version needs five parts: governance, a repeatable assessment method, a risk register, a risk appetite statement and a mitigation plan with monitoring. This guide shows how each part fits together and how to build them without creating a paperwork exercise.

TL;DR

• A framework is the structure (ownership, method, appetite, reporting). The process is what you run inside it: identify, assess, treat, monitor, review.
• UK government guidance treats risk management as part of governance and daily decisions, not a separate administrative task.
• Rate each risk by likelihood and impact, record it in a register with an owner, and review the register regularly and whenever circumstances change.
• Write a short risk appetite statement so people know where risk can be taken and where it cannot.
• Make every mitigating action specific, owned and dated, and report on whether the control actually operates.

Table of Contents

• What a risk management framework is, and what it is not
• The components of a practical framework
• Step 1: Set ownership and decision rights
• Step 2: Identify risks
• Step 3: Assess likelihood and impact
• Step 4: Build and maintain a risk register
• Step 5: Write a risk appetite statement
• Step 6: Plan and carry out mitigation
• Step 7: Monitor, report and improve
• Choosing a standard or building your own
• Common mistakes
• Build the capability with us
• FAQ
• Sources

What a risk management framework is, and what it is not

People use “framework”, “process” and “policy” as if they were one thing. They are not, and separating them makes the whole job easier.

• The framework is the structure: leadership commitment, roles, the risk appetite, the rating scales, the reporting lines and how often things are reviewed.
• The process is the repeating cycle you run within it: identify risks, assess them, decide on treatment, monitor and report.
• The policy is the short written statement of what your business has agreed to do.

The UK government’s Orange Book, the HM Treasury guidance on managing risk in public bodies, describes the principle clearly. Risk management should be an integral part of governance and of all organisational activities, supported by collaboration informed by expertise, with structured identification, assessment, treatment, monitoring and reporting, and continual improvement. The Orange Book is written for central government, but the logic transfers well to a business with ten or two hundred people. If risk only gets discussed when something goes wrong, you have a reaction, not a framework.

The components of a practical framework

Here is what we would expect to see in a framework that a smaller business can actually run.

Notice what is missing: a long manual. The aim is a small number of agreed decisions that people follow, not a document nobody opens.

Step 1: Set ownership and decision rights

Before you rate a single risk, settle who is responsible for what. Without this, the register fills up with risks that nobody owns and nothing happens.

Three questions to answer in writing:

1. Who is the senior sponsor for risk (usually the managing director, founder or a board member)?
2. Who owns each individual risk? It should be the person with the authority to act on it, not whoever happened to spot it.
3. At what point does a risk get escalated, and to whom?

The National Cyber Security Centre makes the ownership point sharply for cyber risk. Its guidance says the decision not to fix or update something is a senior-level business risk decision, and that the business, not the security team, should own the risk, with senior leaders able to see it. The same applies to any risk type: the people who accept a risk should be the people who answer for it.

If escalation is where your organisation tends to stall, our guide to the escalation management process covers how to set triggers and routes. For clarity on who is responsible, accountable, consulted or informed on each risk, see RACI vs DACI, and for building ownership into everyday work, our accountability framework guide.

Step 2: Identify risks

Start with what matters to the business, then ask what could stop it. The UK Government’s business portal advises that proactive risk management begins with identifying your critical assets and the threats to them, building a risk register, and then developing, implementing and reviewing prioritised mitigation measures.

For a founder-led services firm, critical assets are rarely machinery. They are more likely to be:

• a handful of client relationships that produce most of the revenue
• key people whose knowledge is not written down
• client and personal data
• the systems and suppliers that keep delivery running
• your reputation and regulatory standing

Run a short workshop with the people who do the work, not only the leadership team. Ask what would hurt most if it failed next month, what depends on one person, and what has nearly gone wrong before. Write risks as a cause and an effect (“if the only person who holds the supplier relationship leaves, delivery of three contracts stalls”), not as vague labels such as “staffing”.

The Health and Safety Executive offers a useful caution here. It provides risk assessment templates and examples but warns against copying an example wholesale, because you must think through the hazards and controls in your own circumstances. The same goes for any generic risk list you download.

Step 3: Assess likelihood and impact

This is the part most people mean when they search for risk assessment steps. The core sequence is short:

1. Identify the asset, activity or objective at stake.
2. Identify what could go wrong and why.
3. Estimate how likely it is.
4. Estimate how serious the impact would be.
5. Combine the two to prioritise, then decide what to do.

A common scoring approach is to multiply a likelihood score by an impact score, typically each on a 1 to 5 scale, giving a total risk value. Here is a worked example.

The figures above are illustrative, not benchmarks. What matters is that the scales are written down. Define what a “5” for impact means in your business, for instance a loss above a set sum, a regulatory breach or loss of a major client, so that two different people rating the same risk reach a similar answer.

Two habits improve the quality of scoring. First, rate the inherent risk (before controls) and the residual risk (after the controls you already have). The gap shows you how much your current controls are worth. Second, treat the score as a conversation starter, not a verdict. A risk with a moderate score but a catastrophic worst case deserves a separate look.

Step 4: Build and maintain a risk register

A risk register is the working record of the process. HM Treasury-linked guidance describes a register that records risks, their causes and effects, owners, inherent and residual ratings and mitigating actions, tracks progress, is reviewed regularly and as circumstances change, and supports escalation where needed.

A workable register for a small business has these columns:

• reference number and short title
• description (cause, event, effect)
• risk owner
• inherent score and residual score
• existing controls
• further actions, with owner and target date
• status and date of last review

Keep it in one place that people can open without asking for permission. A spreadsheet is enough. Many businesses keep a longer operational register for each team and a short strategic register for the top handful of risks. Public bodies follow a similar pattern: the Valuation Tribunal Service’s policy says significant operational risks can be escalated to its executive team for inclusion in the strategic risk register. You can copy the idea at your scale: team-level risks stay with team leads, and anything that threatens the business goes to the leadership team.

How often to review it

Risk management is cyclical. Government guidance advises that reviews take place regularly, or when something significant changes, such as a change in the threat or operating environment. In practice, that means a standing item on the leadership agenda (monthly or quarterly depending on the size of the business), plus an unscheduled review after a major event: a new service line, a big client win or loss, an acquisition, a new regulation or a significant incident.

Step 5: Write a risk appetite statement

A risk appetite statement says how much risk, and what kind, the business is willing to accept to meet its objectives. Government guidance defines it in just those terms: the amount and type of risk an organisation is willing to accept, which can be used to guide where risks may be taken and where they may not.

In practice it is often applied by marking the boundary between acceptable and unacceptable residual risk. Sefton Council’s 2024 guidance also notes that an appetite framework can set different acceptable levels for different activities. That is the key to a useful statement: appetite is rarely the same everywhere.

A short example for a professional services firm might read:

• Client delivery and quality: low appetite. We do not accept risks that could compromise the quality of client work.
• Data protection and regulatory compliance: very low appetite. We act on any identified exposure promptly.
• New service lines and markets: moderate appetite. We will invest in testing new offers within an agreed budget.
• Financial exposure on a single client: low appetite. We set a ceiling on the share of revenue from any one client.

Link each line to a threshold in your scoring scale. For example, any residual score above 12 in a “very low appetite” area goes straight to the leadership team. A statement without thresholds is a slogan; one with thresholds changes decisions. Our guide to a decision-making framework shows how to turn rules like these into consistent choices.

Step 6: Plan and carry out mitigation

A risk mitigation plan converts the register from a list of worries into a list of jobs. Start with the highest-priority risks, review the protections you already have and add controls where the residual risk is above your appetite.

Useful design principles:

• Make each action SMART. Government guidance recommends actions that are Specific, Measurable, Achievable, Realistic and Time-bound, with a target date.
• Mix control types. Kirklees Council’s guidance sorts controls into preventative (such as training and policies), detective (such as reconciliations and incident reports) and limiting or corrective (such as insurance and business continuity). A good plan rarely relies on one type alone.
• Make controls measurable. The same guidance says reporting should show who operates the control, how often it is applied and how it is reported.
• Match the response to the risk. You can avoid it, reduce it, transfer it (insurance, contracts) or accept it within appetite. Accepting should be a recorded decision with an owner.

Here is a mitigation plan entry for the key-person risk from earlier:

Physical and technical risks usually need detective controls as well as preventative ones. If your premises hold client files or equipment, for instance, an alarm and camera system that is monitored off site works as a detective control only if someone actually responds. This explainer on remote security monitoring sets out how that arrangement works and what to define in advance, such as who gets the alert and what happens next. The same question applies to every control: who sees the signal, and what do they do?

If your risks involve data handling or automated tools, our guides on data governance and AI governance cover the controls that sit within those areas.

Step 7: Monitor, report and improve

The final part closes the loop. Each review should answer four questions:

1. Have any risks changed in likelihood or impact?
2. Have the actions due since the last review been completed, and did the controls work?
3. Have new risks appeared, or old ones become irrelevant?
4. Is the appetite statement still right for where the business is heading?

Keep reports to one page: the top risks, movement since last time, overdue actions and anything needing a decision. Over time, record near misses and incidents and feed them back into the register. That is the continual improvement the Orange Book calls for, and it is what stops the framework from ageing into a document nobody trusts.

Choosing a standard or building your own

You will see named frameworks in search results. Some are aimed at IT and information security, and some at large enterprises or public bodies. For most small and mid-sized UK businesses, the practical route is to borrow the structure from the public guidance cited in this article (identify, assess, treat, monitor, review) and size it to your business. Adopt a formal standard only when a client, regulator or insurer asks for it. Where one does, build on your working register and appetite statement rather than starting again.

Common mistakes

• Treating it as a one-off project. A register that was last reviewed a year ago is a historic document.
• No owners. Risks owned by “the team” belong to no one.
• Scoring without definitions. If “high” means different things to different people, the ranking is noise.
• Copying a template unchanged. Your hazards and controls are specific to you.
• Leaving risk with specialists. Risk is a leadership topic, as the NCSC guidance above makes plain.
• Too many risks. Fifteen well-managed risks beat a hundred ignored ones.

Our perspective

In our work with small and mid-sized businesses, we see the same pattern: the framework fails less because of the method than because nobody has built the capability to run it. The register exists, the appetite is unwritten, and the review lapses after two meetings.

That is why we treat risk as a capability to build and embed, not a document to produce. We start by establishing a clear direction and a launch-ready foundation, then iterate, optimise and embed the habits until the business runs the cycle itself. Owners, decision rights and escalation come first, because without them the scoring is academic.

If you take one thing from this guide, make it this: choose a small number of risks, give each a named owner and a dated action, and put the review in the diary. A modest framework that runs every quarter will serve you better than a complete one that does not.

Chris

Build the capability with us

If you would rather not build this alone, we help businesses establish a clear direction, improve execution and embed the capability to keep it going. Our staged approach moves from Build and Iterate through Optimise, Embed and Grow, starting with a launch-ready foundation within one month. For ongoing support, our Managed Capability plan is published at £999 per month, £2,850 per quarter or £10,000 per year. You can see every option on our pricing page.

If you run a recruitment firm and want the operating structure behind it, see our work for recruitment businesses.

FAQ

What is included in a risk management framework?

A practical framework includes governance and ownership, a method for rating likelihood and impact, a risk register, a risk appetite statement, a mitigation plan and a review cycle. UK government guidance describes the same cycle of identification, assessment, treatment, monitoring and reporting, with continual improvement.

What are the main steps of a risk assessment?

Identify what matters and what could threaten it, estimate the likelihood and impact of each risk, combine them to prioritise, then decide on controls and review the result. Record each step in your register so that the reasoning can be checked later.

How often should a risk register be reviewed?

Review it on a regular schedule, and also whenever something significant changes, such as a new service, a major client change or a new threat. Many small businesses review monthly or quarterly at leadership level, with team leads updating their own risks more often.

What is a risk appetite statement?

It is a short statement of the amount and type of risk your business is willing to accept to meet its objectives. It works best when it sets different levels for different areas and ties each to a threshold in your scoring scale.

Do we need a formal standard?

Not necessarily. Many small and mid-sized businesses run well on a simple structure based on public guidance. Move to a formal standard when a client, regulator or insurer requires it, building on the register and appetite statement you already have.

Sources

• The Orange Book: Management of Risk, Principles and Concepts (HM Treasury)
• Manage risk and threats (business.gov.uk)
• Risk assessment: Template and examples (HSE)
• How to reduce and manage business risk (British Business Bank)
• Risk management guidance (HM Treasury-linked, GOV.UK)
• Risk Management Policy (Valuation Tribunal Service)
• Corporate Risk Management (Sefton Council)
• Risk Management Strategy and Guidance (Kirklees Council)
• Vulnerability management: who owns the risk (NCSC)
• Remote security monitoring: how it works

Recommended

• Accountability Framework: How to Build One That Works
• Decision-Making Framework: How to Choose and Use One
• Data Governance Framework: A Practical Guide for UK SMEs
• Escalation Management Process: A Practical Guide for UK Firms