Defined approach

The organisation has a clearly defined policy or approach for risk management setting out its strategy and objectives and the approaches and processes the organisation adopts to achieve them.

A effective risk policy should:
  • Cover each risk category (eg operational risk) and reflect the nature of each.
  • Clearly articulate the organisation's risk bearing capacity and appetite for risk.
  • Be subject to regular review and assurance to ensure adherence.


And would typically:

  • Be aligned with the business objectives and set out key principles to guide actions and decision making.
  • Set out clear risk definitions.
  • Clearly explain the risk governance framework.
  • Consider regulatory requirements (eg FSA), legal (eg Sarbanes-Oxley act) and listing rules (eg Combined code) where applicable.
Last updated on 08 Jul 2008