MoR Foundation cheat sheet

Risk is defined as an uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives; it combines the probability of occurrence with the impact on objectives.

Management of Risk (MoR) is a generic, principles-based guidance that can be tailored to any organization, project, programme, or operational context; it is not a prescriptive standard.

MoR rests on a set of principles, a set of perspectives, and an eight-step risk management process; the perspectives describe where risk is owned and managed, the process describes how.

MoR distinguishes risk from issue: an issue is an uncertain event that has already occurred and now requires management, so it moves from the risk register to the issue log.

Threats are risks with negative effects on objectives; opportunities are risks with positive effects; MoR treats both through the same identification, assessment, and response cycle.

Risk management adds value by supporting better decision-making, protecting value, and enabling informed risk-taking rather than by eliminating uncertainty.

MoR is aligned with the general risk management vocabulary and cycle popularized in ISO 31000-style frameworks, but its distinctive contributions are the perspectives model and the explicit process step for identifying risks.

The purpose of risk management in MoR is to support decision-making by understanding uncertainty, not to produce documentation for its own sake.

MoR principles include: risk management creates value; it is an integral part of all organizational processes; it is part of decision-making; and it explicitly addresses uncertainty.

Further MoR principles: risk management is systematic, structured, and timely; it is based on the best available information; it is tailored to the organization; and it takes human and cultural factors into account.

Closing principles: risk management is transparent and inclusive, is dynamic, iterative, and responsive to change, and supports continual improvement of the organization.

Principles are the rationale and intent behind risk management; they are not procedures, and they remain valid even when the process is tailored or scaled.

The principle of proportionality means the effort and formality of risk management should match the scale, complexity, and significance of the risk exposure.

The principle of a structured approach means risks are identified and assessed consistently, so results are comparable across time and between parts of the organization.

Human and cultural factors matter because risk perception, bias, and group behaviour materially affect identification and assessment quality; the principles require these to be acknowledged, not ignored.

A principle-based framework allows tailoring: an organization may adapt terminology, scales, and techniques, provided the intent of each principle is still met.

The MoR approach is described as a set of principles, an approach, a process, and embedding and reviewing activity; the approach explains how principles are turned into practice in a specific context.

An approach document or risk management policy typically defines scope, objectives, risk appetite and tolerances, organizational roles, process, scales, and reporting requirements.

Risk appetite is the amount and type of risk an organization is willing to seek or accept in pursuit of objectives; risk tolerance is the measurable boundary applied to a specific objective or category.

Risk capacity is the maximum risk the organization could bear before its viability is threatened; appetite should sit below capacity, and tolerance should make appetite operational.

Tailoring decisions include the number and definition of probability and impact scales, the register or tooling, reporting frequency, and the level of formality required at each level.

A risk management strategy should state how risk information flows between strategic, programme, project, and operational levels, including escalation thresholds.

The approach must cover both threats and opportunities, and should state how opportunity responses (exploit, share, enhance, accept) differ from threat responses.

Documenting the approach alone does not create risk management; the approach is only effective when combined with the process and with embedding activities.

The MoR process has eight steps: identify, assess (estimate and evaluate), plan, implement, and then the communication and embedding steps; the assessment step is often split into estimate and evaluate.

Identify context and identify risks come first: context covers the organization's objectives, external and internal environment, and the scope of the risk assessment.

Estimate covers probability, impact, proximity, and velocity; evaluate compares the estimate against tolerance to decide whether the risk is acceptable, needs treatment, or must be escalated.

Plan produces responses; for threats the standard response set is avoid, reduce (mitigate), transfer, and accept, with prepare/contingency as a supporting option.

For opportunities the response set is exploit, enhance, share, and accept; exploit seeks to realize the opportunity, enhance increases probability or impact, share involves a partner.

Implement executes the planned responses, assigns owners and actions, and records residual risk after treatment.

Communication and consultation run throughout the process, not as a single step; stakeholders must understand risks and their treatment for decisions to be valid.

Embedding and reviewing is the final step: it checks that risk management is actually operating and improves the process over time.

Embedding means making risk management part of normal working practice, so it is used in everyday decisions rather than performed as a separate compliance exercise.

Indicators of embedding include risk being a standing agenda item, risk owners actively managing responses, and risk information being used in decision papers and business cases.

The MoR health check and maturity review examine whether the principles, approach, process, and supporting culture are all in place and working.

A review should distinguish maturity of the process (is it followed?) from maturity of the culture (is it valued and used?), because process compliance alone can coexist with poor risk behaviour.

Embedding levers include leadership sponsorship and visible example, clear accountability, integration with planning and performance management, training, and simple consistent tooling.

Reviewing should be scheduled and event-driven: regular cycles plus triggers such as a major change, a significant issue, or a failed assumption.

Review outputs should feed back into the approach and the process, closing the loop of continual improvement required by the principles.

Common barriers to embedding are risk management seen as bureaucratic, registers never read by decision-makers, and owners without authority to act.

The MoR perspectives are strategic, programme, project, and operational; each perspective has its own objectives, risk focus, and typical owner.

The strategic perspective addresses risks to the organization's overall objectives, reputation, and long-term viability, owned at executive or board level.

The programme perspective addresses risks to the delivery of a group of related projects and to the realization of benefits, including cross-project dependencies.

The project perspective addresses risks to delivering the project's products and objectives within time, cost, quality, and scope constraints.

The operational perspective addresses risks in day-to-day service delivery and business-as-usual processes, where risks recur and are managed through standard procedures.

The same risk can appear in more than one perspective; MoR handles this by defining escalation and aggregation so risks are owned at the level where they can best be managed.

Aggregation means combining related lower-level risks into a higher-level risk for reporting and decision-making, while avoiding double counting in the aggregate exposure.

Each perspective should have a defined risk owner, tolerance, and reporting route; missing any of these is a common cause of risks falling between levels.

The risk owner is accountable for managing a specific risk, including its assessment, response plan, and monitoring; ownership should sit where authority to act exists.

The risk action owner (response owner) is responsible for carrying out a specific mitigating action; one risk may have several action owners but should have one risk owner.

Senior management and the board set risk appetite, approve the approach, and receive aggregated risk reporting; they are accountable for the overall risk management framework.

A risk management function or champion supports the process with guidance, templates, facilitation, and quality review, but does not take ownership of business risks.

Assurance providers (internal audit, independent review) give objective assessment of whether risk management is effective; they should not design and then audit the same controls.

Project and programme managers are accountable for risk management within their scope and for escalating risks beyond their tolerance to the appropriate level.

All staff are responsible for identifying and reporting risks and issues in their area of work, consistent with the principle that risk management is inclusive and transparent.

Clear role definition prevents the common failure where everyone assumes someone else owns the risk, leaving responses unmanaged.

A risk health check is a structured assessment of the current state of risk management against the principles, approach, and process, producing findings and improvement actions.

Health check questions typically cover whether risks are identified consistently, whether estimates are comparable, whether responses are implemented, and whether reporting is used.

Maturity models describe progression from ad hoc or absent practice, through repeatable and defined practice, to managed and optimized practice with continuous improvement.

Maturity assessment should be evidence-based: sample registers, test whether responses were actually implemented, and compare reported risk with outcomes.

Tooling ranges from simple registers and spreadsheets to enterprise risk systems that support scoring, workflow, aggregation, and reporting across perspectives.

Tool selection should follow the approach, not drive it; a tool that is too complex for the organization's maturity reduces rather than increases use.

Useful tool features include consistent scales, owner and action tracking, audit history, aggregation by perspective, and reporting that decision-makers actually read.

Health check and maturity findings should be prioritized by their effect on decision-making and fed into the improvement loop of the embedding and reviewing step.

Risk is defined as an uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives; it combines the probability of occurrence with the impact on objectives.

Management of Risk (MoR) is a generic, principles-based guidance that can be tailored to any organization, project, programme, or operational context; it is not a prescriptive standard.

MoR rests on a set of principles, a set of perspectives, and an eight-step risk management process; the perspectives describe where risk is owned and managed, the process describes how.

MoR distinguishes risk from issue: an issue is an uncertain event that has already occurred and now requires management, so it moves from the risk register to the issue log.

Threats are risks with negative effects on objectives; opportunities are risks with positive effects; MoR treats both through the same identification, assessment, and response cycle.

Risk management adds value by supporting better decision-making, protecting value, and enabling informed risk-taking rather than by eliminating uncertainty.

MoR is aligned with the general risk management vocabulary and cycle popularized in ISO 31000-style frameworks, but its distinctive contributions are the perspectives model and the explicit process step for identifying risks.

The purpose of risk management in MoR is to support decision-making by understanding uncertainty, not to produce documentation for its own sake.

MoR principles include: risk management creates value; it is an integral part of all organizational processes; it is part of decision-making; and it explicitly addresses uncertainty.

Further MoR principles: risk management is systematic, structured, and timely; it is based on the best available information; it is tailored to the organization; and it takes human and cultural factors into account.

Closing principles: risk management is transparent and inclusive, is dynamic, iterative, and responsive to change, and supports continual improvement of the organization.

Principles are the rationale and intent behind risk management; they are not procedures, and they remain valid even when the process is tailored or scaled.

The principle of proportionality means the effort and formality of risk management should match the scale, complexity, and significance of the risk exposure.

The principle of a structured approach means risks are identified and assessed consistently, so results are comparable across time and between parts of the organization.

Human and cultural factors matter because risk perception, bias, and group behaviour materially affect identification and assessment quality; the principles require these to be acknowledged, not ignored.

A principle-based framework allows tailoring: an organization may adapt terminology, scales, and techniques, provided the intent of each principle is still met.

The MoR approach is described as a set of principles, an approach, a process, and embedding and reviewing activity; the approach explains how principles are turned into practice in a specific context.

An approach document or risk management policy typically defines scope, objectives, risk appetite and tolerances, organizational roles, process, scales, and reporting requirements.

Risk appetite is the amount and type of risk an organization is willing to seek or accept in pursuit of objectives; risk tolerance is the measurable boundary applied to a specific objective or category.

Risk capacity is the maximum risk the organization could bear before its viability is threatened; appetite should sit below capacity, and tolerance should make appetite operational.

Tailoring decisions include the number and definition of probability and impact scales, the register or tooling, reporting frequency, and the level of formality required at each level.

A risk management strategy should state how risk information flows between strategic, programme, project, and operational levels, including escalation thresholds.

The approach must cover both threats and opportunities, and should state how opportunity responses (exploit, share, enhance, accept) differ from threat responses.

Documenting the approach alone does not create risk management; the approach is only effective when combined with the process and with embedding activities.

The MoR process has eight steps: identify, assess (estimate and evaluate), plan, implement, and then the communication and embedding steps; the assessment step is often split into estimate and evaluate.

Identify context and identify risks come first: context covers the organization's objectives, external and internal environment, and the scope of the risk assessment.

Estimate covers probability, impact, proximity, and velocity; evaluate compares the estimate against tolerance to decide whether the risk is acceptable, needs treatment, or must be escalated.

Plan produces responses; for threats the standard response set is avoid, reduce (mitigate), transfer, and accept, with prepare/contingency as a supporting option.

For opportunities the response set is exploit, enhance, share, and accept; exploit seeks to realize the opportunity, enhance increases probability or impact, share involves a partner.

Implement executes the planned responses, assigns owners and actions, and records residual risk after treatment.

Communication and consultation run throughout the process, not as a single step; stakeholders must understand risks and their treatment for decisions to be valid.

Embedding and reviewing is the final step: it checks that risk management is actually operating and improves the process over time.

Embedding means making risk management part of normal working practice, so it is used in everyday decisions rather than performed as a separate compliance exercise.

Indicators of embedding include risk being a standing agenda item, risk owners actively managing responses, and risk information being used in decision papers and business cases.

The MoR health check and maturity review examine whether the principles, approach, process, and supporting culture are all in place and working.

A review should distinguish maturity of the process (is it followed?) from maturity of the culture (is it valued and used?), because process compliance alone can coexist with poor risk behaviour.

Embedding levers include leadership sponsorship and visible example, clear accountability, integration with planning and performance management, training, and simple consistent tooling.

Reviewing should be scheduled and event-driven: regular cycles plus triggers such as a major change, a significant issue, or a failed assumption.

Review outputs should feed back into the approach and the process, closing the loop of continual improvement required by the principles.

Common barriers to embedding are risk management seen as bureaucratic, registers never read by decision-makers, and owners without authority to act.

The MoR perspectives are strategic, programme, project, and operational; each perspective has its own objectives, risk focus, and typical owner.

The strategic perspective addresses risks to the organization's overall objectives, reputation, and long-term viability, owned at executive or board level.

The programme perspective addresses risks to the delivery of a group of related projects and to the realization of benefits, including cross-project dependencies.

The project perspective addresses risks to delivering the project's products and objectives within time, cost, quality, and scope constraints.

The operational perspective addresses risks in day-to-day service delivery and business-as-usual processes, where risks recur and are managed through standard procedures.

The same risk can appear in more than one perspective; MoR handles this by defining escalation and aggregation so risks are owned at the level where they can best be managed.

Aggregation means combining related lower-level risks into a higher-level risk for reporting and decision-making, while avoiding double counting in the aggregate exposure.

Each perspective should have a defined risk owner, tolerance, and reporting route; missing any of these is a common cause of risks falling between levels.

The risk owner is accountable for managing a specific risk, including its assessment, response plan, and monitoring; ownership should sit where authority to act exists.

The risk action owner (response owner) is responsible for carrying out a specific mitigating action; one risk may have several action owners but should have one risk owner.

Senior management and the board set risk appetite, approve the approach, and receive aggregated risk reporting; they are accountable for the overall risk management framework.

A risk management function or champion supports the process with guidance, templates, facilitation, and quality review, but does not take ownership of business risks.

Assurance providers (internal audit, independent review) give objective assessment of whether risk management is effective; they should not design and then audit the same controls.

Project and programme managers are accountable for risk management within their scope and for escalating risks beyond their tolerance to the appropriate level.

All staff are responsible for identifying and reporting risks and issues in their area of work, consistent with the principle that risk management is inclusive and transparent.

Clear role definition prevents the common failure where everyone assumes someone else owns the risk, leaving responses unmanaged.

A risk health check is a structured assessment of the current state of risk management against the principles, approach, and process, producing findings and improvement actions.

Health check questions typically cover whether risks are identified consistently, whether estimates are comparable, whether responses are implemented, and whether reporting is used.

Maturity models describe progression from ad hoc or absent practice, through repeatable and defined practice, to managed and optimized practice with continuous improvement.

Maturity assessment should be evidence-based: sample registers, test whether responses were actually implemented, and compare reported risk with outcomes.

Tooling ranges from simple registers and spreadsheets to enterprise risk systems that support scoring, workflow, aggregation, and reporting across perspectives.

Tool selection should follow the approach, not drive it; a tool that is too complex for the organization's maturity reduces rather than increases use.

Useful tool features include consistent scales, owner and action tracking, audit history, aggregation by perspective, and reporting that decision-makers actually read.

Health check and maturity findings should be prioritized by their effect on decision-making and fed into the improvement loop of the embedding and reviewing step.