Management of risk approach and framework
This domain tests the design of the risk management approach and framework: how policy, strategy, process and roles fit together across strategic, programme, project and operational perspectives.
Approach versus framework
- Risk management approach: the organisation's overall design - policy, objectives, responsibilities, process, reporting, assurance and review arrangements, tailored to context.
- Framework: the structure that makes the approach operate: principles, approach, process, embedding and reviewing; plus roles, tools, templates and reporting lines.
- Policy: mandatory intent and accountability. Strategy: how the approach will be implemented, scope, responsibilities, resources and timescales. Plans: detailed activities at programme, project or operational level. The approach should be approved, communicated and reviewed; the framework needs decision rights, escalation routes and reporting lines, not just templates.
Perspectives and tailoring
M_o_R uses four perspectives: strategic, programme, project and operational. The same process is tailored; a strategic risk may be assessed with scenario analysis, a project risk with a probability-impact grid. Tailoring must consider objectives, stakeholder needs, complexity, legal and regulatory context, and existing management systems.
Worked example
A government agency has a policy but no consistent register. The risk champion proposes: (1) confirm policy and appetite statements; (2) define a common 5x5 matrix and escalation thresholds; (3) assign risk owners at each perspective; (4) set quarterly assurance reviews. Reasoning: templates alone do not create a framework; the missing elements are decision rights, escalation and review. The approach must state how project risks aggregate to programme and strategic levels.
Traps
Treating a risk register template as the framework; writing a policy with no accountabilities; copying a private-sector approach without tailoring; and confusing the risk management strategy with the risk management plan.