M_o_R 4 Practitioner cheat sheet

M_o_R defines eight principles: aligns with objectives, fits the context, involves stakeholders, establishes clear guidance, informs decision-making, facilitates continual improvement, creates a supportive culture, and achieves measurable value.

Principles are universal and enduring; they describe what good risk management looks like regardless of organisation, sector, or scale of activity.

Principles are not a checklist to be ticked once - they must be applied and evidenced in the way risk work is actually conducted.

'Aligns with objectives' means risk activity is driven by the organisation's goals, not performed as a standalone compliance exercise.

'Fits the context' requires tailoring to the organisation's size, complexity, sector, regulatory setting, and risk appetite.

'Involves stakeholders' means identifying those affected by or able to influence risk, and engaging them proportionate to their impact.

'Achieves measurable value' is evidenced by demonstrable improvement in decision quality, fewer surprises, or reduced losses - not by volume of documentation.

A supportive culture requires visible leadership behaviour, no-blame reporting of near misses, and reward for appropriate risk-taking.

The approach is documented in the risk management policy plus supporting strategy, process guide, and plans; the policy states objectives, accountabilities, and the mandate for risk work.

Risk appetite defines the amount and type of risk the organisation is willing to accept in pursuit of objectives; risk capacity is the maximum it could bear before failure.

Risk appetite must be expressed in measurable terms (thresholds, tolerances, limits) to be usable in escalation and decision rules.

The approach must satisfy both internal drivers (strategy, governance, performance) and external drivers (regulation, contract, statutory duty).

The approach is tailored, not adopted wholesale: scale, complexity, and maturity determine the depth of techniques, tools, and reporting.

Governance assigns clear ownership: an accountable individual for each risk, an owner for the process, and defined escalation routes and thresholds.

Health checks and maturity assessments test whether the approach is being applied and remains fit for purpose, driving the improvement plan.

The approach must integrate with performance management, change control, and assurance so risk information reaches decision-makers at the point of decision.

The process has four core steps: identify, assess, plan a response, and implement and review; these iterate rather than run once.

Identify produces risks, causes, and effects; techniques include workshops, prompt lists, interviews, SWOT, and review of past incidents and lessons learned.

Assess combines probability and impact to derive a risk exposure rating, then applies proximity and velocity to sequence responses.

Probability-impact grids are qualitative; where data permit, quantitative methods (expected monetary value, Monte Carlo, decision trees) inform exposure.

Response options are: avoid, reduce (probability and/or impact), transfer, accept, and exploit or share for opportunities.

Each response needs an owner, a cost, an action plan, a target date, and a residual risk rating after the response is applied.

'Implement and review' checks that responses were executed, reassesses residual exposure, and captures new risks emerging from change.

Escalation rules route risks that breach appetite thresholds to the level with authority to accept or fund the response.

Embedding means risk thinking becomes part of normal decision-making - business cases, projects, procurement, and performance reviews - not a parallel exercise.

Embedding levers include leadership sponsorship, clear roles, training and competency development, tooling, incentives, and communication.

Maturity models describe progression from ad hoc, through repeatable and defined, to managed and optimised practice.

Health checks examine whether the process is applied as designed; maturity assessments examine how good the practice is.

Review cadence is set by risk velocity: fast-moving risks are reviewed more often than slow-moving strategic risks.

Indicators (key risk indicators) provide early warning and are monitored against thresholds to trigger action before impact occurs.

Lessons learned from incidents, near misses, audits, and assurance reviews feed the improvement plan and update the approach.

Evidence of embedding includes risk-informed decisions recorded in papers and minutes, and consistent reporting to the governing body.

M_o_R defines perspectives as the different contexts in which risk is managed: strategic, programme, project, and operational; each has its own objectives and language.

The strategic perspective addresses long-term direction, reputation, and viability, and is owned at executive and board level.

The programme perspective addresses benefits realisation across interdependent projects and the transitional risks between them.

The project perspective addresses delivery of defined outputs to time, cost, and quality, and is owned by the project manager.

The operational perspective addresses day-to-day service delivery, process failure, and compliance, and is owned by line management.

The risk owner is accountable for managing a specific risk; the risk actionee carries out the response actions and reports progress.

Assurance and audit provide independent challenge; they do not own or manage risks, which remains with the business.

Risks crossing perspectives are escalated with their cause and effect context intact, so the receiving level can act on them.