Introduction to Risk Management and the MoR Framework
Introduction to risk management and the MoR framework
Risk management is the coordinated activity of directing and controlling an organisation with regard to risk. In MoR, risk is uncertainty that could affect objectives, and it covers both threats and opportunities. MoR is a guidance framework, not a prescriptive standard or a certification scheme; it gives principles, an approach, a process, perspectives, roles, health checks and maturity guidance that organisations tailor to their context.
The exam tests whether you can explain MoR's structure and terminology, distinguish it from a method, and recognise how the parts fit together. You should know that MoR is designed to be scalable: the same principles apply at strategic, programme, project and operational levels, but the detail and formality differ.
Core ideas
- Risk management should be proportionate, aligned with objectives and embedded in decision-making.
- MoR separates what good looks like (principles) from how to do it here (approach) and what to do (process).
- The framework includes perspectives so that risk can be managed consistently across organisational levels.
Worked example
A company has a project risk register, a separate operational incident log and no strategic risk view. Using MoR, it would not simply merge the documents. It would first align risk management with objectives, define an approach that sets common scales and escalation routes, then apply the process at each perspective. Strategic risks might be fewer and longer-term; project risks more detailed and short-term. The reasoning is that MoR provides a coherent framework, not one universal register.
Traps
- Treating risk as only negative; MoR includes opportunity.
- Calling MoR a standard or certification; it is guidance.
- Assuming one perspective's process design fits all levels.