Risk Management Approach
What the exam tests
The approach domain tests whether you can design and tailor the way risk management is applied: policy, appetite, capacity, tolerance, strategy, process, roles, reporting and tools. Expect questions on the relationship between these components and on proportionality.
Core rules
- The risk management approach is how the principles are put into practice in a specific organisation or perspective. It should be approved at the level accountable for it.
- The risk management policy states intent, mandate, scope and accountability. It is short and enduring.
- Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of objectives. Risk capacity is the maximum it can bear. Risk tolerance is the threshold that triggers escalation or action. Risk attitude is the chosen behavioural response.
- The risk management strategy explains how the process will be applied: roles, techniques, reporting, timing, tools, assurance and escalation.
- Tailor by perspective: strategic risks need longer horizons and board-level appetite; project risks need delivery-focused registers and tolerances.
- Document proportionately and integrate with existing governance rather than creating a parallel system.
Worked example
A service company adopts one appetite statement: low risk in all areas. Operational managers cannot recruit cover for peak demand because any overtime is treated as a breach. Reasoning: appetite has been set without differentiating risk categories or perspectives, and capacity and tolerance are conflated. A better approach sets appetite by category (safety: low; service innovation: moderate), defines tolerance thresholds and escalation, and allows delegated decisions within them. The policy still mandates risk management; the strategy changes how it is applied.
Traps
Confusing appetite, capacity, tolerance and attitude; treating the policy as the strategy; copying a template without tailoring; and setting appetite without thresholds or escalation. Also watch for an approach that is not approved or not linked to objectives.