Fundamentals of Risk Management

TAbLE 
21.3
Risk management manual
A risk management manual should include the following sections:
Risk management and internal control objectives
Statement of the attitude of the organization to risk (risk strategy)
Description of the control environment
Level and nature of risk that is acceptable
Risk management organization and arrangements (risk architecture)
Arrangements for communicating risk information
Standard procedures for risk recognition and rating (risk assessment)
List of documentation for analysing and reporting risk (risk protocols)
Risk mitigation requirements and control mechanisms
Allocation of risk management roles and responsibilities
Criteria for monitoring and benchmarking risks
Allocation of appropriate resources
Risk priorities and performance targets
Risk management calendar for the coming year

---

Risk management context
251
A range of risk management protocols or guidelines will need to be produced,
and a typical set of protocols is listed in Table 21.4. The risk protocols provide more 
information on how the risk protocols should be interpreted and how they should be 
delivered. The risk management protocols can be seen as the standing instructions 
relating to risk management. They will often require the keeping of records, for example 
the risk register. The detailed risk management protocols or guidelines will set out:
●
●
risk assessment procedures;
●
●
risk control objectives;
TAbLE 
21.4
Risk management protocols
1 risk assessment procedures
Governance procedures
Response to significant risks
Projects and CapEx approvals
Procedures for strategy and budgets
2 risk control objectives
Brand management guidelines
Health and safety at work
Environmental protection
Contract risk management