IRM/AIRMIC/ALARM A Risk Management Standard (2002) 2: 2 Risk management

Risk management is part of strategic management: a methodical way of handling the risks attached to activities, aiming at sustained benefit and maximum sustainable value, raising the chance of success and lowering the chance of failure and uncertainty. It should run continuously through strategy and its implementation, address risks from past, present and especially future activities, and be built into the culture through an effective policy and a programme that top management leads, turning strategy into tactical and operational objectives and making every manager and employee responsible for managing risk as part of the job. Risks come from external and internal drivers, sometimes both, and may be grouped as strategic, financial, operational or hazard (2.1); the process runs from strategic objectives through assessment, reporting, treatment and monitoring (2.2).