Every business runs on things that can go wrong: a supplier who stops shipping, a server that dies on your busiest day, a key employee who quits, a pipe that bursts over the stockroom. Risk management is simply the discipline of dealing with those things before they deal with you.
Risk management is the habit of finding what could hurt your business, judging how likely it is and how bad it would be, deciding what to do about it, writing that down, and keeping the list current.
That is the whole subject. Everything else — frameworks, software, consultants — is scaffolding around those five moves. This page walks through each one and points you to the detailed guides when you want to go deeper.
What risk management looks like in practice
In practice, risk management is a short loop you repeat, not a project you finish. The loop has five steps:
- Find what can hurt you. Walk your operation and list what would genuinely damage it: losing your biggest customer, a fire, a ransomware lockout, your only delivery vehicle breaking down. A risk is an uncertain event that would hurt your goals if it happened. Be specific — “the walk-in freezer fails over a holiday weekend” is a risk you can act on; “equipment problems” is not.
- Judge how likely it is and how bad it would be. For each risk, make two honest calls: how likely is this in the next year or two, and if it happened, how much damage — money, downtime, reputation — would it do? Most people plot those two calls on a simple grid called a risk matrix so the worst combinations stand out at a glance.
- Decide what to do about it. Every risk gets a deliberate response (the four standard options are covered below). “We accept this one, knowingly” is a legitimate decision. Drifting into it because nobody looked is not.
- Write it down. An unwritten list lives in one person’s head and leaves when they do. The standard home for it is a risk register — a simple table of each risk, its scores, the chosen response, and the person who owns it.
- Keep it current. Risks change as your business changes. Review the list on a schedule — quarterly suits a small operation — and after any big change: a new location, product line, or major supplier.
That loop, run honestly, is what the formal standards describe at greater length. ISO 31000, the international standard for risk management, describes the same cycle in formal terms: understand your context, identify, analyse and evaluate risks, treat them, and keep reviewing throughout. If you want the formal architecture, our guide to enterprise risk assessment frameworks — ISO 31000, COSO ERM, and NIST compares the three approaches organisations use most.
The four ways to deal with a risk
Once a risk is on the list and scored, there are four standard responses. Here they are in plain words:
- Avoid it. Stop doing the thing that creates the risk. If storing customer card numbers on your own server keeps you up at night, hand card payments to a payment processor and never hold the numbers at all.
- Reduce it. Keep the activity but make the risk smaller — less likely, less damaging, or both. Backups reduce the damage of a server failure; cross-training reduces the damage of one person leaving. Most risks end up here.
- Transfer or share it. Move some of the financial consequences to someone else, usually through insurance or contract terms with a supplier or partner. The honest limit: insurance can pay for the damage, but it cannot run your business for you while you recover.
- Accept it. Decide, on purpose, to live with it — usually because the risk is small, or because fixing it would cost more than the damage it could do. Accepting is a decision you record, with a named owner, not a risk you forgot to think about.
One more term: risk appetite — how much risk your organisation is willing to carry in pursuit of its goals. It is the line that separates “reduce this” from “accept that,” and it should be set deliberately by whoever owns the business, not discovered by accident. Our guide to risk appetite, tolerance, and threshold frameworks shows how to state it plainly enough to use.
Risk management vs. risk assessment
These two terms get used interchangeably, and they are not the same thing.
A risk assessment is one step inside risk management. The assessment is the analysis: identifying risks and judging their likelihood and impact. Risk management is the whole ongoing discipline around it — deciding what to do about what the assessment found, doing it, and checking whether the picture has changed.
An assessment is a snapshot; management is the habit. A business can commission a thorough assessment, file the report, and still manage nothing. To do the assessment itself properly, start with the complete professional guide to risk assessment; for the version focused on keeping the business running through disruption, see risk assessment and threat analysis for business continuity planning.
A worked example: one freezer, one small business
Consider a catering company with a dozen staff and one walk-in freezer holding most of its food stock.
- Find. The risk: the freezer fails over a long weekend, when nobody is on site, and the stock spoils.
- Judge. Likelihood: low in any given month, but the unit is ageing. Impact: high — thousands in lost stock, cancelled events, and refunds in the company’s busiest season.
- Decide. A mix of responses. Reduce: a temperature alarm that texts the owner when the temperature rises, plus a standing service contract. Transfer: confirm the insurance policy actually covers spoilage, not just the equipment. Accept: the small chance of a failure in the few hours between alarm and response — accepted knowingly, because a second freezer does not fit the premises or the budget.
- Write it down. One line in the register: the risk, its scores, the alarm and service contract as the response, and the owner — who also owns the monthly alarm test.
- Keep current. When the company later takes on a second site, the picture changes — and risks that arrive through other companies deserve their own look, which is the subject of third-party risk management: the risks you inherit from suppliers, landlords, and service providers.
Nothing there required specialist software or a consultant — just an hour of honest thinking and a page of writing.
The documents that make it real
Risk management becomes real when three simple documents exist:
- The risk register. The master list: each risk, its likelihood and impact scores, the chosen response, an owner, and a review date. Our guide to risk register template fields, owners, and review cadence sets out what belongs in it and how often to revisit it.
- The risk matrix. The visual grid that turns “likely” and “bad” into a priority order, so the top corner gets the attention and money first. Here is how to build and read a 5×5 risk matrix, including what the colours do and do not mean.
- The appetite statement. A few plain sentences recording how much risk the business will carry and where the hard limits sit — the document that settles arguments about whether a risk should have been accepted.
That is the full kit; everything else is elaboration.
Where to start Monday morning
If your business has no risk list today, here is the honest minimum:
- Spend one hour listing the ten events that would hurt your business most. Be specific.
- Score each one for likelihood and impact, roughly. Rough and written beats precise and imaginary.
- For the top three, choose a response — avoid, reduce, transfer, or accept — and name an owner for each.
- Put the list in one document, share it with the people it names, and set a date three months out to review it.
You now have a risk management process, and it gets better each time you run the loop. When one of those risks is “the business cannot operate at all for a while,” you have arrived at the neighbouring discipline: business continuity — the planning that keeps critical work going, or gets it back, when a serious disruption lands.
Frequently asked questions
What is risk management in simple terms?
Risk management is finding what could hurt your business, judging how likely it is and how bad it would be, deciding what to do about it, writing it down, and keeping the list current. It is a repeating habit, not a one-time report.
What are the 4 ways to deal with a risk?
Avoid it (stop the activity that creates it), reduce it (make it less likely or less damaging), transfer or share it (insurance or contract terms move the financial cost), or accept it (decide on purpose to live with it, with a named owner).
Is risk management the same as risk assessment?
No. A risk assessment is the analysis step — identifying risks and judging their likelihood and impact. Risk management is the whole ongoing discipline around that step: deciding on responses, carrying them out, and reviewing the picture as things change.
What is a risk register?
A risk register is the written list of an organisation’s risks. Each entry records the risk, its likelihood and impact scores, the chosen response, the person who owns it, and a review date. It is the document that turns risk management from one person’s memory into a system.