Risk management plan: template, example and how to write one
A risk register tells you what could go wrong. A risk management plan tells everyone how the organisation deals with it — who decides, on what scale, how often, and what happens when a risk is too big. Without the plan, the register drifts into a list nobody trusts.
A risk management plan is a short document that sets out how an organisation or project will identify, assess, respond to, monitor and report risks. It defines scope and objectives, roles and authority to accept risk, the risk appetite and scoring criteria, how responses are chosen, the review and reporting cycle, and where the risk register is kept. It is the rulebook; the risk register is the record of the risks themselves. For a small business the plan fits on three to five pages; for a project it is usually a section of the project management plan.
The plan, already built inRisk Samurai turns the plan into working settings — your scales, owners, review dates and escalation rules — so the register follows the plan automatically.
Get early accessWhat a risk management plan is
A risk management plan describes how risk is managed — not which risks exist. It answers the questions that otherwise get argued every time a risk comes up: Who owns it? How do we score it? How much risk is acceptable? Who can sign off a risk we decide to live with? When do we look at it again? Who needs to hear about it?
The plan applies the risk management process described in ISO 31000 — establish the context, identify, analyse, evaluate, treat, monitor and report — to your organisation’s size and structure. If you want the process itself explained, read what is risk management first; this guide is about writing it down.
One naming trap: in the US, “Risk Management Plan” is also the formal name of a filing under the Environmental Protection Agency’s Risk Management Program rule for facilities that hold certain hazardous chemicals. That is a specific regulatory document about chemical accident prevention. This guide covers the general business and project document.
Risk management plan vs risk register vs risk policy
Organisations use these terms loosely. The distinction that matters is between rules and records.
| Document | What it contains | How often it changes | Typical length |
|---|---|---|---|
| Risk policy | Commitment from leadership: why risk is managed, principles, high-level accountability | Every 1–3 years | 1–2 pages |
| Risk management plan | The operating rules: scope, roles, criteria, method, review and reporting cycle | Annually or after major change | 3–5 pages (organisation); 1–3 (project) |
| Risk register | Each risk: description, owner, scores, controls, actions, review date | Weekly to monthly | As long as needed |
| Risk appetite statement | How much risk leadership will accept, by category, with limits | Annually | 1–2 pages |
Small organisations often merge the policy, plan and appetite into one document. That is fine as long as the three questions — why, how, how much — are each answered.
When you need a risk management plan
- Organisation-wide, when more than a handful of people manage risks and you need them to do it the same way. This is the backbone of enterprise risk management.
- For a project, when the project is large or uncertain enough to need its own register — most project methods, including the PMI’s PMBOK Guide, treat risk planning as part of project planning.
- For a contract or tender, when a client, funder or public body asks for one. Government and infrastructure tenders routinely do.
- For an audit or certification, where the auditor will ask how risks are assessed and treated — for example in an ISO 27001 information security management system or an ISO 9001 quality system.
What to include in a risk management plan
Ten sections cover what auditors, boards and project sponsors look for. Each can be a few lines.
| Section | Questions it answers |
|---|---|
| 1. Purpose and scope | What does the plan cover — the whole company, a business unit, a project? Which objectives are risks measured against? |
| 2. Roles and responsibilities | Who owns the process? Who owns risks? Who reviews? Who can accept residual risk at each level? |
| 3. Risk appetite and criteria | How much risk is acceptable in each category? Which scores require treatment or escalation? |
| 4. Risk categories | Which categories do we use so risks can be grouped and reported? |
| 5. Identification | How are risks found — workshops, incident reviews, audits, project stage gates? How are they described? |
| 6. Assessment | What are the likelihood and impact scales, with definitions? Which matrix? Inherent and residual scores? |
| 7. Responses | How do we choose between avoid, reduce, transfer and accept? What must a mitigation action include? |
| 8. Monitoring and review | How often is each risk level reviewed? Which events trigger an extra review? Which indicators are tracked? |
| 9. Reporting and escalation | What goes to leadership, how often and in what format? When must a risk be escalated immediately? |
| 10. Records and plan review | Where is the register? Who can edit it? When is the plan itself reviewed and who approves changes? |
Risk management plan template
Copy the headings below into a document and replace the prompts. Text in brackets is guidance; delete it once filled in.
1. Purpose and scope
This plan sets out how [organisation] identifies, assesses, treats, monitors and reports risks to its objectives. It applies to [all departments / the X business unit / the Y project] from [date]. The objectives risks are measured against are those in [the annual business plan / the project charter].
2. Roles and responsibilities
- [Board / owners]: approve this plan and the risk appetite; review top risks [quarterly].
- [CEO / MD]: accountable for risk management; accepts residual risks scored [12] or above.
- [Risk coordinator]: maintains the register and method; prepares reports.
- Risk owners: keep their entries current; own actions; accept residual risks below [12] within appetite.
- All staff: report new risks, incidents and near misses to [channel].
3. Risk appetite and criteria
[Summarise or link the risk appetite statement.] Residual risks above appetite must have a treatment plan agreed within [30] days or be accepted in writing by [role].
4–6. Categories, identification and assessment
Risks are grouped as [strategic, financial, operational, technology, compliance, reputational]. They are identified through [annual workshops, monthly team reviews, incident and audit findings] and written as cause → event → consequence. Likelihood and impact are each scored 1–5 using the scales in Appendix A and plotted on a 5×5 risk matrix. Both inherent and residual scores are recorded.
7. Responses
Owners choose to avoid, reduce, transfer or accept. Every reduction action has an owner, a due date and an expected effect on the score. Acceptance above [score] needs [role] approval, recorded in the register.
8. Monitoring and review
Critical risks: reviewed monthly. Significant: quarterly. Moderate: every six months. Low: annually. Extra reviews follow incidents, audits, major changes and breached key risk indicators.
9. Reporting and escalation
A top-risk report goes to [leadership team] [monthly] and to [board] [quarterly]. Any new risk scored [20] or above, or any incident with impact [4] or above, is escalated to [CEO] within [one working day].
10. Records and plan review
The risk register is kept in [tool / location]; [roles] can edit; history is retained. This plan is reviewed every [12] months and after significant change, and approved by [board / CEO].
The register that goes with this plan is our free risk register template, which already uses the 5×5 scoring above.
Risk management plan example for a small business
Here is the core of the plan filled in for a 60-person online retailer selling homeware in the UK and EU. The full version adds the scale definitions as an appendix.
| Section | Example entry |
|---|---|
| Scope | Whole company; objectives from the 2027 business plan (revenue growth, margin, customer satisfaction, no reportable data breaches) |
| Roles | Managing director accepts residual risks scored 12+; department heads own their risks; finance manager coordinates and maintains the register |
| Appetite | Low for health and safety, data protection and dispatch disruption over 48 hours; moderate for new product and marketing risks; high for supplier experimentation on non-core lines |
| Categories | Strategic, financial, operational (including suppliers), technology, compliance |
| Identification | Annual half-day workshop per team; standing item in the monthly management meeting; every incident reviewed for a missing risk |
| Assessment | 5×5 matrix; impact scale anchored to money (1 = under £5k … 5 = over £250k), days of disruption and number of customers affected |
| Responses | Residual 15+ must be treated or accepted by the MD within 30 days; transfer via insurance reviewed at each renewal |
| Review | Top ten risks monthly; full register quarterly; KRIs: payment provider downtime, stock cover on top 20 lines, overdue patching, staff turnover |
| Reporting | One-page risk summary in the monthly management pack; quarterly review with the owners |
| Plan review | Every January, and after any incident scored 4+ on impact |
Project risk management plan
A project risk management plan follows the same outline but is shaped by the project’s lifecycle and budget. The PMI’s PMBOK Guide — the eighth edition, published in late 2025, treats risk as one of its performance domains — and PRINCE2 both expect it. Add or change these sections:
- Risk budget. How contingency reserve is calculated (for example, a percentage of cost or the expected value of the top risks) and who can release it.
- Thresholds tied to tolerances. Impact scales defined in terms of schedule days, budget overrun and scope or quality, matched to the tolerances agreed with the sponsor.
- Timing. Risk reviews at each stage gate and in every progress meeting, not just monthly.
- Escalation to the sponsor or board. Which risks leave the project manager’s authority and how fast.
- Opportunities. Projects often track upside risks too — a supplier delivering early, a component becoming cheaper — with responses such as exploit, enhance and share.
- Handover at closure. Which open risks pass to business-as-usual owners and their registers when the project ends. This is the step most often skipped.
For a modest project, one to two pages inside the project management plan is enough; the project’s own risk register carries the detail.
How to write a risk management plan in seven steps
- Agree scope and sponsor. Decide what the plan covers and get one senior person to own it.
- Collect what already exists. Insurance schedules, health and safety assessments, IT security policies and any existing registers. The plan should absorb them, not compete with them.
- Set the scales. Write likelihood and impact definitions people can apply without debate — money, days, customers, regulatory consequences. This is where most plans are vague.
- Decide authority. Who can accept what level of residual risk. Tie it to the scores.
- Set the rhythm. Review frequency per risk level, reporting dates, escalation triggers.
- Test it on real risks. Run one workshop using the draft plan and fix whatever confused people.
- Approve and publish. Sign-off by the board or CEO; keep it where risk owners can find it next to the register.
Keeping the plan alive
A plan is working when you can see it in the register: every risk has an owner from the roles section, every score uses the scales, every overdue review is visible, and acceptances above the threshold have an approver’s name. Check those four things each quarter. If the register and the plan disagree, either fix the register or change the plan — do not let them drift.
Rule of thumb: if a new manager cannot read the plan and correctly score, assign and escalate a risk on their first day, the plan is too long or too vague.
Common mistakes
- Confusing the plan with the register. A plan that lists twenty risks is a register in disguise and goes stale within weeks.
- Copying a large company’s plan. Committees, three-line assurance maps and 40 pages of procedure that nobody in a 60-person company will follow.
- Undefined scales. “High impact” means different things to finance and to IT. Define it in numbers.
- No authority to accept risk. Without it, risks either sit untreated or every decision goes to the CEO.
- No review date for the plan itself. Restructures, new regulations and growth make yesterday’s plan wrong.
Frequently asked questions
What is a risk management plan?
A risk management plan is a document that describes how an organisation or project identifies, assesses, responds to, monitors and reports risks. It covers scope, roles, risk appetite and criteria, the method, response rules, review frequency, reporting and where records are kept.
What are the key components of a risk management plan?
The core components are: purpose and scope; roles and responsibilities, including who can accept risk; risk appetite and evaluation criteria; the identification and assessment method; how responses are selected and approved; monitoring and review; reporting and escalation; tools and records; and how the plan itself is reviewed.
What is the difference between a risk management plan and a risk register?
The plan sets the rules for managing risk; the register records the individual risks, their scores, owners, controls and actions. The plan changes rarely, usually once a year; the register changes every week.
How long should a risk management plan be?
Long enough to answer who, how and when, and no longer. For a small or mid-sized business three to five pages is typical. A project plan for a modest project often fits in two pages inside the project management plan.
How often should a risk management plan be reviewed?
Review the plan at least annually and after any significant change, such as a restructure, a new regulatory obligation, a major incident or a change in strategy. The register itself is reviewed far more often, on the cycle the plan sets.
From plan to working register
In Risk Samurai your scoring scales, appetite, owners and review cycle are set once and applied to every risk, with reminders when reviews fall due. AI drafts the first version of your register so the plan has something to govern on day one.
Get early access