Embedding and reviewing risk management
This domain tests whether risk management is genuinely used, reviewed and improved. Exam questions look for evidence of culture, assurance, maturity and behavioural change rather than paperwork alone.
Embedding
Embedding means risk management is used in everyday decisions, not run as a separate compliance exercise. Levers include visible leadership, clear accountabilities, integration with planning and budgeting, training, communication, incentives, tools and risk champions. Culture matters: blame cultures suppress reporting, while psychological safety improves early escalation.
Reviewing
- Review the approach and framework periodically and at triggers such as major change, incidents or audit findings.
- Use maturity models to assess capability: ad hoc, emerging, defined, managed and optimised.
- Use performance indicators: percentage of risks with owners, responses completed on time, overdue reviews, escalation timeliness and incident trends.
- Use assurance: independent review, audit, health checks and lessons learned.
Worked example
An organisation reports that 95% of projects have registers, but risks are reviewed only at gate reviews and owners cannot change budgets. Maturity is defined on paperwork but not managed in behaviour. Reasoning: evidence of use in decisions is missing. Interventions: add risk review to monthly performance meetings, give owners a response budget, publish escalation statistics, and run scenario exercises with senior managers. Measure the percentage of decisions that cite risk information and the time from identification to escalation.
Traps
Equating compliance with embedding; using training attendance as the only maturity measure; reviewing only annually; and treating risk culture as a poster campaign rather than incentives and behaviour.