1 Are the right risks being taken?

It is essential for organisations to review their risk management practices periodically – and certainly at least annually. This allows those responsible for risk management to check that the methodologies and policies adopted remain appropriate. It also enables consideration of whether the right risks are being taken in the business – while other risks which do not need to be taken are controlled or mitigated. The business and economic climate within which organisations operate change over time and, if only for this reason, regular reviews of risk strategy are an integral part of good management.

The next three sections examine different approaches that can be taken when reviewing an organisation’s risk strategy.