The risk management cycle · RiskAtoms Academy

By the end you will be able to

1Describe identify, assess, measure, mitigate, monitor and report as one cycle that keeps turning.
2Say what question each step answers and what it produces.
3Explain why the cycle must loop back, and what goes wrong when a step is skipped.
4Relate the cycle to the ISO 31000 process and the COSO ERM framework.

Why it matters

In January, Larkfield Bank let customers send instant payments from its app. A workshop the autumn before had named app fraud as a risk, scored it and written it down. By April, app fraud losses had tripled, and nobody had noticed for ten weeks. The risk had been found. Nobody was watching it.

Larkfield Bank is a made-up retail bank in the euro area with about €40bn of assets and 1.8 million customers. You will follow it through this whole module.

Core explanation

Six steps, one loop

Every risk team, in a bank, an insurer or a fund manager, does the same six things over and over. Together they make the risk management cycle:

Identify: find the risks.
Assess: judge how likely and how bad each one is, and rank them.
Measure: put a number on the important ones, usually in money.
Mitigate: decide what to do and put controls in place.
Monitor: watch the risks and the controls.
Report: tell the people who must act or decide.

Then it starts again. A new product, a new supplier, a recession or a failed control changes the picture, and monitoring is what notices. The cycle sits inside the firm's risk appetite (L2.3.05: Risk appetite frameworks): appetite says how much risk is acceptable, and the cycle checks whether the firm is inside it.

ExploreOne turn of the cycle

Click a step, or go round in order with “Next step”.

Step 1 of 6 · Identify

What could go wrong, or better than planned?

Produces: A list of risks, each written as cause, event and consequence.
Done by: The business (first line), helped and challenged by the risk function.
ISO 31000 term: Risk identification
At Larkfield: A workshop before the launch of instant app payments names “fraudsters take over customers' app accounts and send instant payments that cannot be recalled”.

Assess or measure? The two are easy to mix up. Assessing ranks risks quickly with judgement, often on a 1 to 5 scale, so that a firm with hundreds of risks can see which matter. Measuring puts a number in money on the few that matter most, which takes data and models. You will assess in L2.4.03: Assessing risks: likelihood and impact, and meet the main measures in M2.5: First risk measures.

Four ways to respond. In the mitigate step a firm picks one, or a mix:

Response	What it means	Example
Avoid	Stop the activity that creates the risk	Do not launch the product
Reduce	Add controls so it is less likely or less harmful	A payment limit for new payees
Transfer	Pass the loss to someone else	Buy insurance; outsource with a guarantee
Accept	Keep it, knowingly, because it is within appetite	Small, expected card fraud losses

Two frameworks you will hear about. ISO 31000:2018 is the international guideline on risk management for any organisation. Its process runs: set the scope, context and criteria; assess risk (identification, analysis, evaluation); treat risk; monitor and review; record and report. Communication and consultation run alongside every step. COSO Enterprise Risk Management (2017), from the US body best known for internal control standards, ties risk to strategy. It has five components (governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting) and 20 principles. The six steps above sit mainly inside its “performance” and “review and revision” components.

Who does what

The business that takes a risk (the first line) identifies it, owns it and runs the controls. The risk function (the second line) sets the method, challenges the scores, adds things up across the firm and reports. Internal audit (the third line) checks that the cycle actually works. See L2.3.04: The three lines model.

What goes wrong if you skip a step? Guess, then open.

Try it

Each task below is one step of the cycle. Which one?

Sort itWhich step is this?

Walk through the mortgage process with the team and list where it could fail.
Rate a supplier failure as 'unlikely' and 'severe' on the 5 × 5 scale.
Estimate that the 1-in-100-year loss from a cyber attack is €90m.
Require two people to approve any payment over €1m.
Check each month how many payments went out late.
Tell the board that fraud losses have broken the red threshold, and what is being done.

Worked example

Larkfield's app fraud, round the loop twice

Follow one risk round the cycle. Before you open each step, ask yourself what should happen next.

App fraud at Larkfield Bank

Step 1 of 6

1
Identify (October)
The pre-launch workshop writes: “Because instant app payments cannot be recalled, fraudsters who take over a customer's app may empty the account, leading to losses and refunds.”

The lesson is not that the workshop failed. It found the right risk. The loop broke at monitoring, and so the second turn started three months late.

Regulatory lens

Regulators write the cycle into law. The EU's Solvency II Directive (2009/138/EC, Article 44) requires insurers to have a risk management system with the processes needed “to identify, measure, monitor, manage and report, on a continuous basis” their risks. For banks, the Basel Committee's Corporate governance principles for banks (2015) expect an independent risk management function that identifies, measures, monitors and reports on risk across the bank, and its Principles for the Sound Management of Operational Risk (2011, revised 2021) set out the same loop for operational risk.

ISO 31000 and COSO are not laws: firms adopt them by choice. Supervisors judge the process by whether it works, not by which framework it follows. How supervisors review it is covered in Level 4: Regulation, Capital & Accounting.

Sparks

SparkThe loop came from the factory floor

The idea of a management cycle that learns from each turn comes from quality control. Walter Shewhart at Bell Labs described a cycle of specification, production and inspection in the 1930s, and W. Edwards Deming spread it as Plan, Do, Check, Act. Deming later preferred “Plan, Do, Study, Act”, because studying results is more than checking them. ISO management standards, including ISO 31000, still follow the same loop.

SparkA standard you cannot be certified against

ISO 31000 is a set of guidelines. Unlike ISO 9001 for quality, it says it is not meant for certification, so no firm can claim to be “ISO 31000 certified”. Firms say they are “aligned with” it instead.

Key takeaways

The risk management cycle is identify, assess, measure, mitigate, monitor and report, and then round again.
Assessing ranks many risks quickly with judgement; measuring puts a number in money on the ones that matter.
The four responses are avoid, reduce, transfer and accept.
Monitoring is what turns a one-off exercise into a cycle: it notices change and sends the firm back to the start.
ISO 31000 and COSO ERM describe the same process in their own words; regulators such as Solvency II and the Basel Committee require it.

Reaction

Check what stuck

Glossary

Risk management cycle: The repeating loop of identifying, assessing, measuring, mitigating, monitoring and reporting risks, so that each turn starts from what the last one learned.
Identify: Finding and describing the risks a firm faces, before anyone scores them.
Assess: Judging how likely a risk is and how much harm it would do, usually on a simple scale, to rank it.
Measure: Putting a number on a risk in money or another unit, such as an expected loss or a value at risk.
Mitigate: Choosing what to do about a risk (avoid, reduce, transfer or accept it) and putting controls in place. ISO 31000 calls it risk treatment.
Monitor: Watching risks and controls over time to see whether they are changing or failing.
Report: Telling the people who must act or decide what the risks are, in a form they can use.
Control: Something a firm does to make a risk less likely or less harmful, such as a check, a limit or a backup.
Risk appetite: The amount and type of risk a firm is willing to take to meet its goals, set by the board.
Risk criteria: The yardsticks a firm judges risks against, such as its scoring scales and its risk appetite.

Deep Dives & Origins

Deep Dives

Hopkin, P., Fundamentals of Risk Management, Kogan Page, for the Institute of Risk Management, chapters on the risk management process. Beginner.
Hull, J. C., Risk Management and Financial Institutions, Wiley, chapter on enterprise risk management. Intermediate.

Origins

International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines, 2018.
Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management: Integrating with Strategy and Performance, 2017.
Directive 2009/138/EC of the European Parliament and of the Council (Solvency II), Article 44.
Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 8-minute video will sit here, made from this page's script.