What is risk management? A plain-English guide to the process

Every business already manages risk — when it buys insurance, keeps a second supplier or asks for payment up front. Risk management is doing that on purpose: finding the things that could derail your plans, deciding which ones matter, and choosing what to do about each before it happens rather than after.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 15 min read

What risk management means

ISO 31000 defines risk as the “effect of uncertainty on objectives”. Three ideas are packed into that short phrase, and they explain most of what follows:

• Risk is tied to objectives. A risk only matters because of what you are trying to achieve — sell more, stay solvent, keep customer data safe, deliver a project on time. No objectives, no risk.
• Risk is about uncertainty. Something that has already happened is an issue, not a risk. Something certain is a cost or a fact. Risk lives in the space of “might”.
• Effects can be positive. Uncertainty can also produce opportunities — a competitor exiting the market, a currency moving in your favour. Most small businesses focus on downside risk, which is reasonable, but a good process notices upside too.

Risk management, then, is the coordinated set of activities that deal with that uncertainty. In practice it comes down to a repeatable cycle: find risks, understand them, decide which matter most, act on them and keep watching. The output most people see is a risk register — a living list of risks, owners, scores and actions — but the register is only the record. The point is better decisions.

Why bother in a small business?

Large companies run risk management because regulators, auditors and boards require it. Small and mid-size firms have a more direct reason: they have fewer buffers. One lost key customer, one supplier failure or one ransomware attack can threaten the whole business. A simple, regular look at the top ten risks costs a few hours a quarter and tends to surface the two or three exposures that genuinely deserve money and attention. It also helps with things you will be asked for anyway: insurance proposals, enterprise customer questionnaires, investor due diligence and lender covenants.

Types of risk to look for

Categories are useful mainly as a prompt, so you do not overlook a whole area. A common set:

Many real risks cross categories — a cyber incident is also operational, compliance and reputational. Put it in the register once, under its main category, and describe all its consequences in the impact.

Types of risk management

“Risk management” is also used for specialist disciplines that apply the same process to one area. A small business does not need a team for each — but it helps to know the names, because customers, lenders and auditors use them:

The specialisms differ in vocabulary and depth, not in logic. For a smaller organisation the practical goal is that all of them feed one register, scored on one scale, so leadership can compare a cyber risk with a credit risk.

The risk management process in six steps

Most frameworks describe the same cycle in slightly different words. (If you want to see how ISO 31000, COSO and NIST compare, read our guide to risk management frameworks.) Here is the practical version.

1. Set the context

Decide what you are managing risk for: the whole business, a project, a product launch, a site. Write down the objectives that matter and the criteria you will use to judge risks — your scoring scales and how much risk you are willing to take, ideally in a short risk appetite statement.

2. Identify risks

Gather the people who know the work and ask, for each objective, “what could stop us?” Useful sources: past incidents and near misses, customer complaints, audit findings, supplier problems, insurance claims, industry news. Write each risk as cause, event and consequence: “Because we rely on one courier, a strike or outage could stop deliveries for a week, causing lost sales and refunds.” Vague one-word risks (“cyber”, “Brexit”, “staff”) cannot be scored or owned.

3. Analyse risks

For each risk, understand its causes, the controls already in place and how well they work, and rate likelihood and impact. This is risk analysis, covered in more detail below.

4. Evaluate risks

Compare each score against your criteria. Which risks are above appetite and need action? Which are acceptable as they are? This turns a list into a priority order.

5. Treat risks

For each risk that needs action, choose a response — avoid, reduce, transfer or accept — and agree specific actions, owners and dates.

6. Monitor, review and report

Risks change. Review the register on a fixed rhythm (monthly for the top risks, quarterly for the rest is a common pattern), track whether actions were completed and whether controls still work, and report the top risks to leadership. Key risk indicators give early warning between reviews.

Communication and consultation run through every step: the people closest to the work usually know the risks best, and risk owners need to know what they own.

Risk analysis: how to rate likelihood and impact

Risk analysis turns “this could happen” into something you can compare. There are three broad approaches, and most organisations use the first two.

A simple quantitative example: if card-not-present fraud costs an average of £400 per incident and you expect around 30 incidents a year, the expected annual loss is about £12,000. A fraud screening tool that costs £3,000 a year and is expected to stop half of those incidents is easily justified. The arithmetic is trivial; the value is in agreeing the inputs.

Whatever approach you use, rate risks twice: inherent (before controls) and residual (with current controls). The gap shows how much you depend on each control — see inherent vs residual risk for worked examples.

The four risk responses: avoid, reduce, transfer, accept

Once a risk is analysed and evaluated, you decide what to do about it. Almost every option falls into one of four responses, sometimes called the “4 Ts”: terminate, treat, transfer and tolerate.

ISO 31000 lists more options — including taking or increasing a risk to pursue an opportunity, removing the source of the risk, and changing likelihood or consequences separately — but they map onto these four. For opportunities, the mirror-image responses are exploit, enhance, share and accept.

Two rules make responses useful rather than decorative. First, acceptance must be explicit: a named person with the authority to do so signs off the residual risk, and it is recorded with a review date. Silent acceptance — a risk left at “red” with no action — is the most common failure in real registers. Second, responses can be combined: you might reduce ransomware risk with backups and MFA, transfer part of the cost through insurance, and accept what remains.

Risk mitigation in practice

Risk mitigation is the “reduce” response: putting controls in place that make a risk less likely or less damaging. Controls come in three kinds, and a well-mitigated risk usually has more than one:

• Preventive controls stop the event happening — MFA, segregation of duties, supplier vetting, staff training.
• Detective controls spot it quickly — log alerts, reconciliations, stock counts, monitoring of KRIs.
• Corrective controls limit the damage and help you recover — backups, incident response plans, insurance, a back-up supplier.

For each mitigation action, record what will be done, by whom, by when, at what cost, and what the target residual score is once it is done. If you cannot say how an action changes likelihood or impact, it is probably not mitigating that risk. Good mitigation plans are short and specific: “Enable MFA on all Microsoft 365 accounts — IT lead — by 15 December — expected residual likelihood 2” beats “improve cyber security”.

Check proportionality too. Spending £50,000 to mitigate a risk with an expected cost of £5,000 a year rarely makes sense unless the worst case would be existential. That trade-off is exactly what your risk appetite is for.

A risk management example, step by step

Here is the whole process applied to a single risk at a 25-person online homeware retailer whose objective for the year is to grow online sales by 20% without hurting delivery times.

1. Context. Objective: growth with on-time delivery. Appetite: low tolerance for anything that stops dispatch for more than two days in peak season.
2. Identify. “Because all orders ship through one courier, a strike, outage or contract dispute could stop deliveries for a week in peak season, causing lost sales, refunds and poor reviews.”
3. Analyse. Existing control: none beyond the courier contract. Likelihood 3 (possible in the next year), impact 4 (a week of peak sales lost) — score 12 on a 5×5 matrix.
4. Evaluate. 12 is above the appetite threshold of 8 for operational risks, so action is needed.
5. Treat. Reduce: open an account with a second courier and integrate it with the order system by September; test-ship 5% of orders through it monthly. Transfer: check whether business interruption cover would respond. Target residual score: likelihood 2, impact 2.
6. Monitor. Owner: operations manager. Indicators: share of orders the second courier can take within 24 hours; courier on-time rate. Review monthly until the target is reached, then quarterly.

The result is a decision that would not have happened without the process — and a record showing who decided what, which is exactly what an insurer or investor will ask about.

What goes in a risk management plan

A risk management plan describes how your organisation (or a project) manages risk. It is not the list of risks — that is the register — but the rules everybody follows. For a small organisation it can fit on three or four pages; for a project it is often a section of the project plan.

A project risk management plan follows the same outline but adds the project’s budget for contingency, how risks are escalated to the sponsor and when the project register is handed over to business-as-usual owners at closure. If you are starting from scratch, our risk register template gives you the register to go with the plan.

Risk management plan example for a small business

Filled in for the same retailer, the core of the plan fits on one page:

Who does what

• Leadership or board — sets objectives and appetite, reviews the top risks, decides on the large trade-offs.
• Risk owners — the managers accountable for individual risks; they keep the entry current and drive actions. The owner should be someone with the authority and budget to act, not whoever happened to raise the risk.
• Control and action owners — the people who operate a control or deliver an action; often different from the risk owner.
• Risk coordinator — in a small firm, often the finance director or operations manager part-time: runs the review calendar, keeps the method consistent, chases overdue actions.

Getting started in two weeks

1. Day 1–2: write down your top five business objectives for the year and agree simple 1–5 likelihood and impact scales.
2. Day 3–5: run a 90-minute workshop with your leadership team; aim for 15–25 risks written as cause, event, consequence.
3. Day 6–8: score each risk, note existing controls and assign an owner.
4. Day 9–11: for every risk above appetite, choose a response and one concrete action with a date.
5. Day 12–14: write the two-page plan, put the first review in the calendar and agree what leadership will see each quarter.

Common mistakes

• A register written for an audit and never opened again. If nobody uses it to decide anything, it is not risk management.
• Risks with no owner, or owned by “the business”. One named person per risk.
• Confusing issues with risks. Problems that have already happened go in an issue log; their recurrence may be a risk.
• Only looking inward. Suppliers, customers and regulators generate many of your biggest risks.
• Treating everything. Accepting low risks deliberately frees time for the high ones.
• Mitigation actions with no date. “Ongoing” usually means “not happening”.