The risk management process has seven steps: establish the context, identify risks, analyse them, evaluate and prioritise them, treat them, monitor them on an ongoing basis, and communicate throughout. It’s a cycle, not a one-off exercise — risk that was acceptable last year may not be this year.
1. Establish the context
Define what you’re actually assessing risk against — a specific project, a vendor relationship, the business as a whole — and what “acceptable risk” means for that context.
2. Identify risks
List what could go wrong: supplier failure, cost overruns, compliance breaches, data exposure. This step is only as good as the range of people involved — risks visible to procurement are often invisible to finance, and vice versa.
3. Analyse the risks
For each identified risk, assess likelihood and potential impact. This doesn’t need to be complex — even a simple high/medium/low scoring exercise, done consistently, is more useful than an unranked list.
4. Evaluate and prioritise
Compare risks against each other and against your risk tolerance to decide which need immediate action and which can be monitored.
5. Treat the risk
For each priority risk, choose a response: avoid it, reduce its likelihood or impact, transfer it (insurance, contract terms), or accept it consciously.
6. Monitor and review
Risk isn’t static. A vendor that was low-risk a year ago may now be under financial pressure. Regular review — not just annual — is what separates an effective risk process from a compliance exercise done once and filed away.
7. Communicate and consult
Risk information needs to reach the people who can act on it, in a form they can use — not stay in a risk register nobody outside the compliance team ever opens.
Where this breaks down
in practice
The step most businesses skip isn’t identification — it’s ongoing monitoring and communication. A risk assessment done once at vendor onboarding, then never revisited, gives a false sense of security. Agilus’s risk management and data governance work focuses on making steps 6 and 7 sustainable — building the visibility and reporting that keeps risk data current and in front of the right people, rather than a document that goes stale within months.
FAQ
Q: What’s the difference between risk identification and risk analysis?
A: Identification is building the list of what could go wrong; analysis is assessing how likely each item is and how much damage it would cause.
Q: How often should a risk register be reviewed?
A: At minimum annually, but for high-risk vendor relationships or fast-changing projects, quarterly review is far more defensible — and far more useful.