Fundamentals of Risk Management

3 risk resourcing arrangements
Opportunity management
Project resource allocation
Insurance programme
Captive insurance company
4 reaction planning requirements
Loss and claims management
Disaster and recovery planning
Cost containment procedures
Risk management record keeping
5 risk assurance systems
Maintenance of risk register
Corporate RM committee
Terms of reference for audit committee
Control self-certification arrangements

---

Risk strategy
252
●
●
risk resourcing arrangements;
●
●
reaction planning requirements;
●
●
risk assurance systems.
The framework or risk architecture that has been set up to achieve adequate
management of risks should also be presented in the risk management manual.
It will then be for the individual companies within the group to operate within the 
established framework and arrange their own additional procedures and protocols 
as necessary. Specifically, the risk management manual should include details of at 
least the following:
●
●
the board member responsible for risk management;
●
●
language and perception of risk in the organization;
●
●
framework for identifying significant risks;
●
●
role of the risk manager and internal auditors;
●
●
terms of reference for the risk management committees;
●
●
risk management structure or risk architecture.
Many organizations find that it is necessary to update the risk management manual 
each year, even if the overall risk management strategy remains unchanged. This is 
undertaken for a number of reasons, including the desire to ensure that risk manage-
ment activities and the overall risk management approach is in line with current best 
practice. Updating the risk management manual, including the risk management policy, 
every year also gives the organization the opportunity to identify the risk priorities for 
the coming year and ensure that appro priate attention is paid to the significant risks.
Issuing an updated risk management policy every year also ensures that the board 
pays appropriate attention to risk management and that the organization under-
stands that it is a dynamic activity that requires constant management attention.