Enterprise Risk Assessment

What is enterprise risk assessment?

Enterprise risk assessment is a structured look at everything that could stop a business achieving its goals — strategic, financial, operational, regulatory, and reputational risks — so the board and management can decide which to address, how, and by whom.

It's also a legal expectation. Every company's board report must include a statement on the development and implementation of a risk management policy, and larger listed companies must have a risk management committee.

The key terms

The building blocks of risk management:

Risk register

A list of the business's key risks, with owners, ratings, and responses.

Likelihood and impact

The two dimensions used to rate each risk.

Heat map

A visual showing risks by likelihood and impact, highlighting the most significant.

Risk appetite

How much risk the board is willing to accept in pursuit of its goals.

Mitigation

Actions to reduce a risk's likelihood or impact.

Risk owner

The person responsible for managing a specific risk.

Board report statement

Every company's board report must include a statement on its risk management policy.

Why it matters

Risk management is about staying in business:

Board duty

Directors must report on the company's risk management policy.

Fewer surprises

Known risks can be prepared for; unknown ones can't.

Better decisions

Understanding risks helps prioritise investment and attention.

Investor and lender confidence

They want to know management understands and manages risk.

Regulatory risk

Compliance failures in regulated sectors can halt operations.

Concentration risk

Dependence on a few customers, suppliers, or people is common and dangerous.

Resilience

Planning for disruptions helps the business recover faster.

Who is this for?

Risk assessment should lead to action. A register that isn't reviewed or acted on offers little protection.

Categories of risk

Risks usually fall into these groups:

What we'll need from you

Strategy and goals

What the business is trying to achieve.

Leadership time

Workshops or interviews with key leaders.

Past incidents

Problems, losses, and near misses.

Existing controls

Policies and controls already in place.

Financial information

Concentrations in customers, suppliers, and funding.

Regulatory context

Licences and regulations that apply.

Engagements are quoted based on the size and complexity of the business.

How we run a risk assessment

Our approach:

1. 1

   Set the context

   We understand the business, its goals, and its risk appetite.

2. 2

   Identify risks

   Risks are identified through interviews and workshops with leaders.

3. 3

   Rate them

   Each risk is rated for likelihood and impact.

4. 4

   Prioritise

   A heat map highlights the most significant risks.

5. 5

   Plan responses

   Owners and mitigation actions are agreed for key risks.

6. 6

   Report

   A risk register and policy are prepared for the board.

Keeping risk management alive

Risk management is continuous:

Regular review

Review the risk register with the board quarterly or half-yearly.

Track actions

Follow up mitigation actions to completion.

Update for change

Reassess when the business, market, or regulations change.

Incident learning

Add lessons from incidents to the register.

Board reporting

Report on risk management in the board's report each year.

Link to internal audit

Use the risk register to plan internal audits.

Benefits and responsibilities