Fundamentals of Risk Management

Risk management manual
The extent of the documentation produced by an organization in respect of risk 
management will vary significantly. The documentation that is produced should 
be proportionate to the level of risk faced by the organization, in accordance with 

---

Risk strategy
250
the principles that apply to risk management, as set out in Table 5.1. Whatever is 
produced will need to be structured in a way that suits the organization and is 
aligned with the other activities that take place within the organization.
The first section of the risk management manual is the risk management policy. 
An example of a risk management policy statement for a council is set out in the box 
on page 246. The policy sets out the risk strategy for the organization. It is a state-
ment of intent and establishes the risk management context for the organization. The 
risk management policy should facilitate successful implementation of risk manage-
ment in the organization.
The risk management manual contains details of all of the responsibilities, pro-
cedures, protocols and guidelines regarding the risk management process and risk 
management framework for the organization. An illustration of suitable contents
for a risk management manual is set out in Table 21.3. The manual should confirm
the protocols for undertaking the activities, as set out in the risk guidelines for the 
organization. The risk guidelines may be produced as a separate set of documents, 
so that they can be more easily updated.
The risk management manual will include the strategy that the organization is
seeking to achieve with respect to risk management, as the risk management policy. 
The risk management manual will also set out details of the systems and procedures 
that will be put in place to monitor performance, as well as the means for reporting 
and communicating on risk management. It will, in effect, define the context within 
which risk management activities take place.