Risk Management Plan: How to Build One That Works
A small firm's main supplier fails just before a major delivery. Operations expects finance to approve an alternative, finance expects the project manager to decide, and nobody knows whether the customer should be warned. The problem is not only supplier failure. Nobody recorded who would act, what would trigger that decision or which fallback was workable.
A useful risk management plan resolves those questions before the pressure arrives. It's a live escalation tool, not a document that proves a meeting took place.
Table of Contents
- What a Risk Management Plan Covers
- How to Identify Risks Before Scoring Them
- Score Each Risk With a Likelihood and Impact Matrix
- Set Tolerance Levels for Each Critical Service
- Assign Owners and Pick a Response for Each Risk
- Monitor Triggers and Review the Plan on Schedule
- Common Plan Failures and How to Fix Them
- Build Your Risk Register This Week
What a Risk Management Plan Covers
A risk management plan documents how an organisation finds threats to its objectives, rates them, chooses responses, assigns responsibility and reviews results. In the supplier scenario, it should identify the alternative source, the person authorised to approve extra spending and the warning sign that starts the switch.
A complete plan contains these elements:
- Direction: Scope and objectives, risk categories and a scoring scale.
- Decisions: A risk register, response actions and named owners.
- Boundaries: Tolerance levels, monitoring triggers and review dates.
Categories should extend beyond financial loss. Strategic, operational, people, technology, legal and environmental risks belong alongside cash-flow and funding concerns. Ireland's National Risk Assessment offers a useful model for grouping diverse threats and connecting them to preparedness actions, without requiring an organisation to copy a national framework wholesale.
Project owners, finance, IT, operations and HR should contribute, with a single accountable lead coordinating the plan. The practical outputs are a working register, scoring table, owner list and review calendar, not a lengthy policy that employees can't use during disruption.
How to Identify Risks Before Scoring Them
Risk identification starts with the work, not a blank spreadsheet headed “things that could go wrong”. A manager needs enough detail to distinguish an actionable exposure from a broad concern such as economic uncertainty.
Start with objectives and dependencies
List the objectives and their delivery processes. The team should connect each objective to the projects, services and activities that make it possible. This keeps the discussion focused on consequences that matter rather than collecting unrelated worries.
Hold a time-boxed workshop with the people doing the work. Managers should ask what has failed, nearly failed or required an undocumented workaround. Front-line staff can explain where approvals stall, records go missing or a process relies on someone remembering an exception.
Review the available incident history. Customer complaints, near misses, audit findings and service interruptions reveal weaknesses that a workshop may overlook. The facilitator should distinguish a recurring cause from several reports of the same incident.
Map critical dependencies. Each service should be connected to its suppliers, software, information and essential staff knowledge. A backup supplier isn't a genuine alternative if it depends on the same underlying provider.
Group risks without splitting connected problems apart. Strategic, financial, operational, technology, people, legal and environmental categories help organise ownership. A technology failure may also affect revenue and customer service, so the register should retain those consequences rather than hiding them in departmental lists.
Write each risk as cause, event and consequence. For example, a payment provider outage prevents checkout and causes lost enrolments. That wording gives the owner something to investigate, unlike an entry labelled payments.
The identification sequence should remain simple enough for teams to repeat when their work changes.
Give cyber risk a practical entry
An analysis published by Cyber Ireland covering 98 Irish exporting SMEs found that 70% had no incident-response plan and 79% didn't assess third-party vendor risks. Those are specific planning gaps, not reasons to add another vague cyber entry.
A minimum viable cyber entry should connect the affected service to its supplier, access controls, incident contact, communications route and recovery priority. The team should establish who can disable compromised access and who can authorise restoration.
Structured risk identification tools and methods can help when discussion stalls. The final list should contain distinct exposures that someone can manage. Duplicate entries should be merged; broad external threats should be translated into a decision the organisation can take.
Score Each Risk With a Likelihood and Impact Matrix
Likelihood multiplied by impact provides a useful sorting mechanism, provided everyone uses the same definitions. The matrix below is an illustrative starting scale, not a statutory standard or a claim about typical business losses.
Likelihood and impact scores with example financial impact
| Score | Likelihood over 12 months | Financial impact example |
|---|---|---|
| 1 | Rare, under 5% | Under €5,000, no effect on service |
| 2 | Unlikely, 5% to 20% | €5,000 to under €25,000, a short delay to one task |
| 3 | Possible, over 20% to 50% | €25,000 to under €35,000, disruption requiring team recovery work |
| 4 | Likely, over 50% to 80% | €35,000 to €100,000, interruption of a critical service |
| 5 | Almost certain, over 80% | Over €100,000, or a loss threatening business viability |
The middle bands require calibration against the organisation's experience. Financial boundaries should also reflect its capacity to absorb loss: a threshold suitable for an established business may be useless for a small employer.
An illustrative escalation policy could treat 1 to 4 as low, monitored through routine management; 5 to 9 as medium, requiring an owner's action plan; 10 to 16 as high, requiring senior review within the month; and 17 to 25 as critical, requiring immediate escalation.
Work through the consequence, not just the arithmetic
Consider a hypothetical learning platform whose card processor becomes unavailable for two days, creating an estimated €40,000 in refunds and lost enrolments alongside additional support work. The team assigns likelihood 3 and impact 4, producing 12, a high rating under the example policy.
The likelihood judgement still needs evidence. A previous outage alone doesn't establish a reliable probability; the owner should also consider supplier changes, failure causes and service history.
Every risk needs an inherent rating, before controls, and a residual rating, after effective controls. A proposed backup doesn't justify a lower residual score until it has been implemented and tested.
Scoring rule: A lower number needs evidence of a stronger control, not greater confidence in the person responsible.
Calibrate before ranking
The most damaging scoring habit is assigning the middle score whenever evidence is incomplete. The group should compare actual past events against the scale, challenge inconsistent judgements and record the reason for each material rating.
Impact should follow the most serious relevant dimension, including staff safety, customers, legal exposure or reputation. Serious safety or legal concerns shouldn't disappear because their financial estimate is low.
A consistent approach to risk probability and impact assessment helps managers explain disagreements rather than average them away. The register should then be sorted by residual exposure, with detailed planning concentrated on the risks requiring the most consequential decisions.
Set Tolerance Levels for Each Critical Service
A risk score establishes priority. Impact tolerance defines how much disruption the organisation can withstand before management must intervene. Those aren't interchangeable: a modestly rated risk may still breach a critical service limit.
For an education business, service tolerances should cover course access, payment processing, learner accounts, certificate verification and support. Each statement needs a measurable boundary and a decision if that boundary is threatened.
| Critical service | Tolerance should specify |
|---|---|
| Course access | Maximum interruption during a teaching or assessment period |
| Payment processing | Permitted checkout interruption before an alternative is activated |
| Learner accounts | Maximum unprocessed changes or acceptable data loss |
| Certificate verification | Maximum unavailability before manual verification begins |
| Support | Maximum unanswered backlog, with urgent cases separated |
For example, a hypothetical payment service might require recovery within 30 minutes, with a senior manager deciding whether to suspend checkout if recovery fails. That's a proposed business limit, not a regulatory requirement.
The manager should map hosting, payment processing, email and essential staff tasks against each service. Any dependency capable of breaching the tolerance becomes a register entry.
Central Bank of Ireland operational-resilience guidance supports identifying and preparing, responding and adapting, then recovering and learning. Tolerances should therefore be tested through disruption scenarios and reconsidered whenever service design or customer needs change.
Assign Owners and Pick a Response for Each Risk
A risk needs an accountable person or role, not a committee. A committee can approve investment or accept exposure, but someone must check the indicator, maintain the control and initiate escalation.
The first-line owner runs the controls through normal operations. A second-line reviewer challenges whether those controls work and whether the residual rating is credible. In a small firm, a senior manager may provide that challenge, provided the review isn't merely self-approval.
The Central Bank of Ireland's governance model connects risk assessment, controls, ownership, monitoring and reporting with risk tolerance. That connection matters more than the sophistication of the spreadsheet.
Make responsibility visible
The register should contain risk description, cause, affected objective, inherent rating, control, residual rating, owner, tolerance threshold, key risk indicator, review frequency and escalation trigger. An action log alongside it should record the response decision, delivery deadline, evidence and next review date.
The ownership model should be understandable without reading the full policy.
Risk response options and when to use them
| Response | What it means | Typical action | Use when |
|---|---|---|---|
| Avoid | Stop the activity creating the risk | Drop a supplier or exit a product line | Exposure can't be brought within tolerance and the activity isn't core |
| Transfer | Shift part of the cost or liability | Insurance or outsourcing with clear liability terms | Financial consequences can be allocated contractually |
| Mitigate | Reduce likelihood or impact | Backups, another supplier, cross-training, two-factor sign-in | Operational or technology exposure can be reduced |
| Accept | Retain and monitor the exposure | Documented approval with a defined trigger | Residual exposure is within tolerance and further control isn't proportionate |
Transfer requires care. Outsourcing an activity doesn't automatically transfer accountability for customer outcomes, and insurance doesn't restore an interrupted service.
Let the residual exposure determine the decision
In the hypothetical payment-outage case, the head of finance operations owns the risk. A secondary processor with tested failover reduces the residual score to 6 under the illustrative scale.
The response is mitigation, with explicit acceptance of the remaining exposure, but only if recovery performance also satisfies the service tolerance. A medium score alone isn't permission to accept an outage that exceeds the agreed limit.
Guidance on developing risk response strategies can help managers distinguish prevention from contingency action. Prevention reduces the chance of failure; contingency instructions specify what the owner does when prevention fails.
Any residual exposure above tolerance should go to senior management with a decision request: fund a control, change the activity, restrict service or approve a documented exception. The report should state what would restore acceptable exposure and when the decision is needed.
Monitor Triggers and Review the Plan on Schedule
Starting key risk indicator thresholds
The following limits are illustrative management settings, not regulatory benchmarks. Each organisation should test them against its tolerance and revise them after an initial operating period.
| Indicator | Green | Amber | Red |
|---|---|---|---|
| Overdue receivables over 60 days | Under 4% of revenue | 4% to 8% of revenue | Over 8% of revenue |
| Failed payment rate in a week | Under 1% | 1% to 2% | Over 2% |
| Critical security patches open | Under 7 days | 7 to 14 days | Over 14 days |
| Share of one service from one supplier | Under 30% | 30% to 40% | Over 40% |
Green means routine monitoring continues, not that controls can stop. Amber prompts an owner review and recorded action. Red triggers senior notification and a decision, with immediate action where safety, legal obligations or service tolerance require it.
The Central Bank's Financial Stability Review illustrates the broader principle of connecting risk indicators, resilience capacity and response mechanisms. Businesses need their own appropriate limits rather than borrowing banking thresholds.
Put reviews on the management calendar
A proposed cadence is monthly review for high and critical risks, quarterly for medium risks and annual review for low risks. Incidents, failed controls and major changes should trigger an earlier review.
A dashboard should show trends, amber and red indicators, failed tests and overdue decisions.
Effective risk monitoring throughout the project lifecycle requires an agreed action for each trigger. Reporting a red indicator without requesting a decision leaves the exposure unchanged.
Common Plan Failures and How to Fix Them
Approval isn't evidence that a plan works. A signed document may still contain unavailable deputies, untested recovery steps and thresholds nobody measures.
The PwC Ireland Global Crisis and Resilience Survey reported in 2023 that 96% of Irish businesses had experienced a disruption during the previous two years. The practical test is whether employees can use the plan when normal working arrangements fail.
Fix the operating habit, not the document
- The register is never reopened. Management should reserve a standing meeting slot for changed exposure, overdue actions and decisions. Reading every unchanged entry wastes the time needed for exceptions.
- Every risk receives the middle score. The facilitator should ask for the event description and evidence behind the rating. Uncertainty should be recorded explicitly rather than disguised as precision.
- Owners are committees. The accountable manager should name the person authorised to act and a deputy who can access the instructions.
- Controls exist only on paper. A tabletop exercise should test detection, containment, recovery and communications. Participants should record actual elapsed time and unresolved gaps, not whether the exercise was completed.
- The register is too large to manage. Related entries should be grouped, with detailed controls focused on material exposures. Lower-priority risks still need a route back into active review.
- The control costs more than the benefit justifies. Finance should compare lifecycle cost with the loss reduction, operational burden and alternative options. Mandatory obligations and severe safety consequences require separate consideration.
A successful exercise exposes a weakness while there's still time to change the response.
Expected annual loss can support financial decisions when credible probability and loss estimates exist. Multiplying ordinal matrix scores doesn't produce a monetary estimate, and a low average loss doesn't make a business-threatening event acceptable.
Each fix should be checked with the employees who operate the process. Instructions that depend on unavailable access, unrealistic staffing or an unapproved purchase won't survive disruption.
Build Your Risk Register This Week
The first version should be small enough to operate and clear enough to challenge. A shared register with controlled access and a named coordinator is sufficient to begin; specialist software isn't a prerequisite.
Turn the first draft into decisions
- Create the register. Include the fields needed to connect each exposure to its objective, controls, owner, indicator and escalation decision. Keep supporting evidence accessible rather than burying it in email.
- Book the identification workshop. Invite the people responsible for delivery and bring incident records, complaints and dependency information. The facilitator should leave with distinct risk statements, not a transcript of concerns.
- Approve the priority actions. Score the exposures, select the most material and record the response decision for each. Every action needs an authorised owner, a practical trigger and a scheduled review.
At the first checkpoint, management should check whether warning indicators changed, whether agreed actions happened and whether control evidence supports the residual ratings. Any disagreement should result in a decision or an assigned investigation, not an unchanged entry.
The meeting should end with the next review already scheduled. A register becomes useful when someone can tell what decision is required, who must make it and when the organisation can no longer afford to defer it.
European Institute of Leadership and Management offers online certificate courses including Risk Management, Change Management and Time Management. Managers seeking structured learning alongside this practical work can visit European Institute of Leadership and Management to explore the relevant course options and connect their learning to an active risk register.