Fundamentals of Risk Management

Risk management protocols
The risk management manual will set out responsibilities for risk as well as the
arrangements for implementing the policy. Risk management protocols will be set 
out in a series of risk procedures and guidelines and these are described later in 
this chapter.
Procedures and protocols for undertaking the assessment of risks to strategy, pro-
jects and operations will need to be established in writing. The organization 
will also need to produce guidance on the frequency and nature of risk reports and 
who is responsible for compiling the information.
Typically, the risk management protocols will need to be reviewed on an annual 
basis, so that they are kept up-to-date. The risk protocols should also describe the 
extent of record keeping that is required. The range of risk management document-
ation that may be necessary is extensive and Table 21.2 provides an overview of the 
types of documents that may be appropriate.
Risk management protocols describe the range of activities that are undertaken
in the name of risk management. The protocols define the activities that must be 
undertaken and how they will be undertaken. Risk management guidelines normally 
refer to the standards that should be achieved. In some cases, they include details of 
the controls that are in place. This will be especially true for guidelines that identify 

---

Risk management context
249
TAbLE 
21.2
Types of RM documentation
Risk governance
Risk management policy (and priorities)
Specific risk statements (health and safety policy)
Terms of reference of the risk/audit committees
Risk protocols and procedures
Risk awareness training records
Risk response
Results of risk assessments (risk register)
Risk control standards
Risk improvement recommendations
Risk assurance reports
Business continuity plans/disaster recovery plans
Event reports
Loss/claim reports and recommendations
Legal and litigation reports
Enforcement action/customer complaints
Incident and near-miss investigations
Business performance reports/key performance indicators
Risk performance
Control risk self-assessment (CRSA) returns
Audit procedures and protocols
Internal audit reports
Unit risk management reports
External disclosure reports
procedures that must be undertaken. These procedures will provide direction for 
directors, managers and staff within the organization.