Risk

The Orange Book Management of Risk - Principles and Concepts

October 2004

The Orange Book Management of Risk - Principles and Concepts

October 2004

© Crown copyright 2004 Published with the permission of HM Treasury on behalf of the Controller of Her Majesty’s Stationery Office. The text in this document (excluding the Royal Coat of Arms and departmental logos) may be reproducedfree of charge in any format or medium providing that it is reproduced accurately and not used in a misleading context. The material must be acknowledged as Crown copyright and the title of the document specified. Any enquiries relating to the copyright in this document should be sent to: The Licensing Division HMSO St Clements House 2-16 Colegate Norwich NR3 1BQ Fax: 01603 723000 E-mail:licensing@cabinet-office.x.gsi.gov.uk

HM Treasury contacts This document can be accessed from the Treasury Internet site at: www.hm-treasury.gov.uk For further information on the Treasury and its work, contact: Correspondence and Enquiry Unit HM Treasury 1 Horse Guards Road London SW1A 2HQ Tel: 020 7270 4558 Fax: 020 7270 4861 E-mail: ceu.enquiries@hm-treasury.gov.uk ISBN: 1-84532-044-1

C ONTENTSPage
Foreword Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Annex A Annex B Annex C Annex D Foreword Overview The Risk Management Model Identifying Risks Assessing Risks Risk Appetite Addressing risks Reviewing and reporting risks Communication and learning The extended enterprise Risk Environment and context Example of documenting riskassessment Overall Assurance on Risk Management Summary of Horizon Scanning Issues Glossary of Key Terms

7 9 13 15 19 23 27 31 35 37 39 41 43 47 49

October 2004

The Orange Book

5

F OREWORD
In recent years all sectors of the economy have focused on management of risk as the key to making organisations successful in delivering their objectives whilst protecting the interests of theirstakeholders. Risk is uncertainty of outcome, and good risk management allows an organisation to: have increased confidence in achieving its desired outcomes; effectively constrain threats to acceptable levels; and take informed decisions about exploiting opportunities. Good risk management also allows stakeholders to have increased confidence in the organisation’s corporate governance and abilityto deliver. In central government a number of reports, particularly the National Audit Office’s 2000 report “Supporting innovation – managing risk in government departments” and the Strategy Unit 2002 report “Risk – improving government’s capacity to handle risk and uncertainty”, have driven forward the risk management agenda and the development of Statements on Internal Control. In 2001 Treasuryproduced “Management of Risk – A Strategic Overview” which rapidly became known as the Orange Book. That publication provided a basic introduction to the concepts of risk management that proved very popular as a resource for developing and implementing risk management processes in government organisations. This publication is the successor to the 2001 “Orange Book”. It continues to provide broadbased general guidance on the principles of risk management, but has been enhanced to reflect the lessons we have all been learning about risk management through the experience of the last few years. It should be read and used in conjunction with other relevant advice such as the “Green Book” which contains specific advice on “Appraisal and Evaluation in Central Government”, the Office of GovernmentCommerce’s “Management of Risk” which provides more detailed guidance on the practical application of the principles and concepts contained in this publication, and guidance provided by the Treasury’s Risk Support Team as part of “The Risk Programme”. Wherever possible links and references have been provided to additional resources which explore the Orange Book concepts in more detail. Perhaps...