Fundamentals of Risk Management

Reputation and the business model 
243
A global business working in many countries comes across numerous issues in its everyday 
operations. It is crucial therefore that the corporate responsibility committee seeks regular 
briefings on the systems and processes in place for managing issues. The committee 
requests an annual summary of the most material issues Unilever is dealing with, which in 
2015 included issues such as climate change, food and beverage taxes, the responsible use 
of technology and human and labour rights.
Given the committee’s role in ensuring Unilever’s reputation is well managed, it can
also seek independent views on how Unilever is perceived in society. One of the major 
annual surveys of reputation in sustainability is conducted by a research agency and
the methodology draws on the views of over 800 sustainability experts across more than
80 countries. It reveals that an increasing number of them see that corporate leadership
in sustainable development is mainly driven by making sustainability part of the company’s 
core business model. Some 38 per cent of respondents said that Unilever is ‘integrating 
sustainability into its business strategy’, putting it well ahead of others in this respect.
Unilever PLC
Annual Report and Accounts 2015: Strategic Report
Monitoring reputation

---

21
Risk management 
context
Architecture, strategy and protocols
This part provides information on the risk architecture, strategy and protocols 
(RASP) for an organization. The RASP provides details of the risk management 
framework for the organization and this helps to define the risk management con-
text. Table 21.1 sets out key features of the risk architecture, strategy and protocols 
in more detail. The most important component of the RASP is the risk management 
policy statement. The RM policy will set out the overall strategy of the organization 
towards risk management. Other sections of the overall risk management manual 
define risk management roles and responsibilities and set out the protocols that 
should be followed.
The risk architecture, strategy and protocols create the risk framework that supports 
the risk management process. British Standard BS 31100 provides notes on the risk 
management framework that state that it should include the objectives, mandate 
and commitment to manage risk (strategy), and the organizational arrangements 
that include plans, relationships, accountabilities, resources, processes and activities 
(architecture), and that the framework should be embedded within the organization’s 
overall strategic and operational policies and practices (protocols).
The risk architecture, strategy and protocols are equivalent to the risk framework, 
as described in ISO 31000. In effect, the risk architecture, strategy and protocols 
represent the context for risk management within the organization. The risk strategy 
component will normally be set out as a one-page statement of what the organization 
is seeking to achieve with respect to risk management. ISO 31000 refers to this one-
page statement as the risk management policy.
The risk management policy will form part of a larger risk management manual 
in many organizations. Most large organizations will document their risk protocols 
as a set of risk management guidelines. The range of guidelines that are required will 
vary according to the size, nature and complexity of the organization. The types of 
documentation that will need to be kept are as follows:
●
●
risk management administration records;
●
●
risk response and improvement plans;