Enterprise risk management system without bureaucracy

Why a risk management system turns into reporting

The typical path: the company sets up a register of 100-200 risks, colours in a “probability-impact” matrix and convenes a committee once a quarter. A year later, one specialist updates the register, managers sign without reading, and real decisions on investments, product launches and choice of suppliers are made with no regard to this framework at all. The system exists, but there is no management.

The root of the problem: the risk management system was designed for reporting, not for decisions. The health test is simple: if you removed all the risk documents, would even one management decision change? If not, it is an imitation.

4 principles of a living system

1. A risk exists for the sake of a decision. Every line in the register ends with a choice: accept, reduce (how and at what cost), transfer (insure) or avoid. If there is no decision, the line has no purpose.
2. A risk has an owner with a budget. The owner is the manager who controls the source of the risk and is accountable for the actions, not “the risk management department”.
3. Risk is measured in money and time. “High/medium/low” cannot be compared with the cost of measures; an estimate in money can.
4. The system is light. One register, one page per risk, one hour a month of management time. Anything heavier dies.

Register: 15 risks instead of 150

The working register of a mid-sized company holds 10-20 management-level risks: production/IT stoppage, loss of key customers or channels, supply disruption, key-person risks, regulatory and sanctions risks, credit and currency risks, cyberattack, accident/fire, reputational crisis. Minor operational risks stay at department level and are not escalated. Each risk gets one page: description, estimate in money, owner, current measures, decision, review date.

Owners and decisions

Monthly rhythm: one hour at the management meeting, 3-4 risks in turn. The owner reports the status of the decision instead of the “risk status”: what has been done, what has changed in the estimate, what decision is needed from management. Once a quarter, the whole register is reviewed: what to add and what to close. This is enough. Committees and a separate reporting line are needed only by large holding companies and regulated industries.

Metrics instead of “probability-impact” maps

A risk map is a snapshot of opinions. Management works with numbers: the cost of one day of downtime for critical processes, recovery time, revenue concentration on customers and suppliers, insurance cover, actions completed on time. These metrics are shown on the management screen and compared month to month. Our dashboard does exactly this: a resilience index from 0 to 100 and traffic lights for weak spots instead of a rainbow of little squares.

The link to continuity

Half of a company's serious risks are stoppage risks: IT, production, supply, people. For them, action number one is a working continuity framework: BIA, a recovery plan, exercises. So a mature risk management system and BCM form a single project: the register says what to protect, and continuity says how.

Who owns a risk

Responsibility is split across three levels. The first line is the departments that create the risk and manage it; the risk owner always sits here. The second line is risk management and compliance. They set the rules and pull the picture together, but they do not decide for the first line. The third line is internal audit, which checks both and reports to the board, not to management. A detailed review with typical imbalances is in three lines of defence.

How much risk the company is willing to accept

This decision is made in advance and in a measurable form: a maximum annual loss for each type of risk, or an outright ban. The board of directors or the owner approves it, and the limit is then broken down into department limits. Wording such as “a moderate level of risk” does not work, because any decision fits it. How to get a working statement in one meeting is covered in risk appetite.

Leading indicators

The register shows risks but does not warn that an event is approaching. For that you need leading indicators with thresholds and a named person who must respond. How they differ from the usual outcome indicators is covered in KRI and KPI.

How to tell that the system works

• The register changes. If the list of risks has not changed in six months, nobody has reviewed it.
• Some decisions are made because of risk. A delayed launch, a second supplier, changed contract terms: at least a few a year.
• Risks are discussed before a decision, not after an incident. This is the main sign of maturity.
• Owners can name their risks from memory. If a manager does not remember being an owner, there is no owner.
• Estimates are checked against facts. Once a year, forecast losses are compared with actual ones. See the three-scenario method and the risk matrix.

A separate test is what the system does with risks that cannot be eliminated. Some of them are transferred to an insurer, and here it is important to understand the limits: how insurance differs from continuity and how to reduce the premium.

Frequently asked questions

Do you need a dedicated risk manager? For a mid-sized business, a part-time coordinator (methodology, calendar, register) is enough, with line managers as risk owners. A full risk function is needed in regulated industries and where investors require it.

Which standard should you build it on? Take ideas from ISO 31000, but the standard is not the goal: no certificate can replace the test “have decisions changed?”

How do you sell a risk management system to the owner? Talk in money terms, without risk jargon: “here are five scenarios, each one costs us X, and here is what we are doing to pay less”. This is a conversation about investment.