Risk Management Plan

Organisation / programme: [Name] Owner (risk manager): [Name and role] Date: [Date] Approved by: [Sponsor / executive] Status: [Draft / Approved] Next review: [Date]

---

1. Objectives and scope

[In 2 to 3 sentences: what this plan governs (the organisation, programme, or activity it covers), the objectives it protects, and what is explicitly in and out of scope. State the period it applies to and how often it is reviewed.]

2. Risk appetite

[State, by category, how much risk leadership is willing to take. Be specific where it matters.]

Risk category	Appetite	What this means in practice
Safety / people	[Low / zero]	[e.g., No avoidable harm; safety risks are reduced as far as reasonable]
Legal / compliance	[Low / zero]	[e.g., Full compliance required; no acceptance of breaches]
Financial	[Defined limit]	[e.g., Single-loss tolerance and overall exposure ceiling]
Commercial / strategic	[Moderate / high]	[e.g., Calculated risk welcomed where reward justifies it]
Reputation	[Low / moderate]	[What level of exposure is tolerable]

3. How likelihood and impact are scored

[Define the scales so scores mean the same thing to everyone.]

Score	Likelihood	Impact
1	[Rare]	[Negligible]
2	[Unlikely]	[Minor]
3	[Possible]	[Moderate]
4	[Likely]	[Major]
5	[Almost certain]	[Severe]

Risk score = likelihood x impact. [State the thresholds, e.g., 1 to 4 low, 5 to 12 medium, 15 to 25 high, and the rule each band triggers.]

4. Risk register

ID	Risk (cause and consequence)	Likelihood	Impact	Score	Response (avoid / reduce / transfer / accept)	Owner
R1	[If ... then ...]	[1-5]	[1-5]	[L x I]	[Response + key action]	[Name]
R2	[If ... then ...]	[1-5]	[1-5]	[L x I]	[Response + key action]	[Name]
R3	[If ... then ...]	[1-5]	[1-5]	[L x I]	[Response + key action]	[Name]
R4	[If ... then ...]	[1-5]	[1-5]	[L x I]	[Response + key action]	[Name]
R5	[If ... then ...]	[1-5]	[1-5]	[L x I]	[Response + key action]	[Name]

[Add a column for status, target date, and notes if your register is maintained as a working spreadsheet.]

5. Risk matrix

Plot each register entry on a grid with likelihood on one axis and impact on the other, banded by colour. The bands and the action each one requires:

• Red (high) — [e.g., score 15 to 25: requires a named owner and an active response within one week; reported to leadership].
• Amber (medium) — [e.g., score 5 to 12: requires an owner and a planned response; reviewed each cycle].
• Green (low) — [e.g., score 1 to 4: noted and monitored; no action unless it moves].

[Attach or embed the heat map so the red zone is visible at a glance.]

6. Roles and governance

Role	Person	Responsibility
Sponsor / executive	[Name]	Accountable for risk overall; sets appetite; receives top-risk reports
Risk manager / coordinator	[Name]	Maintains this plan and register; runs the review cycle
Risk owners	[Names]	Accountable for assigned risks and their responses
Risk review forum	[Group]	Examines top risks on a fixed cadence and escalates as needed

7. Monitoring and review

• Review cadence: [How often the register is reviewed and the matrix refreshed — e.g., monthly review, quarterly deep-dive.]
• Early-warning indicators: [Metrics or triggers watched between reviews for each major risk.]
• Reporting: [What is reported, to whom, and how often — e.g., a top-five risk summary to leadership.]
• Escalation: [The trigger and path for a risk that breaches appetite or materialises.]
• Feedback loop: [How incidents and near-misses feed a fresh round of identification.]

---

Optional sections

• Contingency / reserves: [Time or budget held back for accepted and residual risks.]
• Opportunity register: [Upside uncertainties tracked the same way as threats.]
• Linked plans: [Crisis communication, business continuity, or recovery plans this connects to.]