Risk Management in the Public Sector
Concepts
Public sector risk management follows the same logic as enterprise risk management but with distinctive features: public accountability, political and reputational exposure, budget cycles, legal constraints, service continuity obligations, and multiple stakeholders. Candidates must know the risk management process: establishing context, risk identification, risk analysis (likelihood and impact), risk evaluation against tolerance, risk treatment (avoid, reduce, transfer, accept), and monitoring and review. Key terms: inherent risk, residual risk, risk appetite and risk tolerance, risk owner, risk register, and the three lines model (management as first line, risk and compliance functions as second line, internal audit as third line).
Traps
A frequent trap is confusing risk appetite (the amount of risk an organisation is willing to accept in pursuit of objectives) with risk tolerance (acceptable variation around that appetite). Another is treating internal audit as a risk owner - internal audit does not own or manage risks; it provides assurance on how risks are managed. Questions may also test the difference between inherent and residual risk, and the fact that risk treatment must be proportionate and documented.
Rule of thumb
Risk = likelihood × impact, evaluated against tolerance. If an option has internal audit "accepting" or "owning" a risk, it is wrong; the risk owner is a manager.
Worked example
A ministry identifies a high-likelihood, high-impact risk of delayed EU fund absorption. Inherent risk is high. After implementing monthly monitoring and a contingency plan, residual risk falls to medium. The risk owner is the programme director, not the internal auditor, who may later audit the effectiveness of that treatment.