Use these connections to describe, assess and manage risks, and to explain them in a risk register or report.
The headings in a register stand for different concepts. These connections explain how the entries belong together. Arrows show the labelled direction of a relationship; plain lines show a comparison or association.
01 · Describing the risk
Risk, causes and consequences
A risk is a possibility of harm or loss. Causes explain how it could come about; consequences explain what could follow. Several causes may contribute, and further consequences may depend on additional circumstances. Make each connection clear rather than treating a list of causes and outcomes as an explanation.
Example: A restaurant faces the risk that a guest suffers an allergic reaction. An incorrect allergen record could lead staff to serve an unsuitable dish. The reaction could then require treatment and interrupt the guest’s stay.
02 · Describing the risk
Consequences and harm
A consequence is something that follows; harm is injury, damage or loss suffered by someone or something. A consequence can be harmful, beneficial or neutral. To explain a risk, identify the harmful possibility and who could suffer it, including any further developments needed for that harm to occur.
Example: A late produce delivery changes the kitchen’s preparation schedule. If the delay leaves too little time to prepare booked meals, the restaurant could lose sales. The changed schedule and the financial loss are distinct consequences.
03 · Describing the risk
Risk and objectives
Objectives identify what someone wants to achieve. A risk can explain how possible harm or loss could obstruct that achievement. Naming the objective helps establish why the possibility matters, but the objective alone does not describe the harm, its causes or who could be affected.
Example: A hotel aims to provide reliable rooms for arriving guests. There is a risk that a booking-system outage leaves confirmed reservations unavailable, causing guests disruption and the hotel lost revenue. This threatens its objective of reliable service.
04 · Describing the risk
Circumstances and exposure
Exposure identifies who or what is in circumstances where harm or loss is possible. The circumstances explain why that person or thing is vulnerable. Exposure can change with location, timing, dependencies and activity, even when the underlying source of danger remains the same.
Example: A café stores all its chilled ingredients in one cold room. If cooling fails overnight, all that stock could spoil before staff arrive. Keeping the ingredients together leaves the café exposed to a larger stock loss.
05 · Assessing the risk
Likelihood and consequence
Likelihood describes the chance of a specified occurrence; consequence concerns what follows and how serious it could be. Keep their reference clear. The chance of a freezer failing is different from the chance of losing all its contents, which also depends on detection and recovery.
Example: A freezer failure may be possible during the coming season. Losing its entire contents also depends on how long it stays warm and whether staff move the stock. The assessment specifies which outcome its likelihood estimate concerns.
06 · Assessing the risk
Likelihood, consequence and rating
A risk rating summarises an assessment using a stated method. That method may combine likelihood and consequence categories, but the rating is not itself a probability or a cause of harm. Explain the scales, assessment period and control assumptions so the result can be understood and compared.
Example: A hotel assesses the risk that a lift breakdown strands a guest. It selects likelihood and consequence categories under its own matrix, assuming existing maintenance and emergency arrangements. The matrix determines the rating; the category names need explanation.
07 · Assessing the risk
Inherent, residual and target risk
These assessments concern the same risk under different control assumptions. State which controls an inherent assessment excludes. Residual risk reflects the controls currently operating; target risk describes the intended position after planned changes. A target is an aim, so it needs checking once the changes are in place.
Example: A kitchen assesses burn injuries without its specified safeguards, with the safeguards currently operating, and with proposed equipment and training. These are its inherent, residual and target assessments. The proposed improvements cannot be counted as already effective.
08 · Managing the risk
Controls, causes and consequences
A control should address a recognisable part of how harm could arise or develop. Some controls reduce contributing causes, some detect problems, and others limit consequences. Explain where each measure acts and what it is expected to change; one control rarely addresses every part of a risk.
Example: An extractor-cleaning programme reduces grease that could feed a kitchen fire. A suitable fire-suppression system limits a fire once it starts. Both address the risk that people are injured or property is damaged, but at different points.
09 · Managing the risk
Controls and their effectiveness
A control’s presence does not establish that it works. Effectiveness concerns whether it achieves its intended effect in the circumstances where it is needed. Inspection, testing and operating records can support that judgement. Consider both whether the measure is suitable and whether people actually use it.
Example: A temperature alarm detects a cooling problem and sends an alert. If staff respond in time, stock loss may be limited. If they respond too late, stock could spoil despite the alert.
A timely response may limit stock loss.
If no one responds in time, stock could spoil despite the alert.
Both scenarios assume the fault is detected and the alert reaches a staff member. The outcome depends on the response and the time available.
Another example: fire-door checks
A hotel has a procedure for checking fire doors. Records show checks occurred, but an inspection finds doors wedged open during deliveries. The evidence calls into question whether the procedure keeps the escape route protected during normal operations.
10 · Managing the risk
Treatment and controls
Risk treatment is a response chosen to change how a risk is managed. It may introduce or improve controls, change the activity or stop it. Distinguish a planned action from an operating control, and check the resulting effect before revising the assessment on that basis.
Example: A café plans to install a cold-room temperature alarm and train staff to respond. Installation and training are treatment actions. The working alarm and response arrangements become controls once they are in use and can be checked.
11 · Managing the risk
Risk, appetite, tolerance and capacity
Consider a risk against three different things: the harm someone is broadly willing to face, the specific limits and conditions for proceeding, and the harm they can bear. Appetite, tolerance and capacity answer these respective questions. Willingness does not establish capacity, and capacity does not establish willingness.
Example: A restaurant considers accepting a large outdoor function. Its appetite allows weather-related disruption; its tolerance requires a workable indoor fallback. Its capacity depends on whether it could bear cancellation losses while still paying staff and suppliers on time.
12 · Managing the risk
Assessment and acceptance
An assessment describes the risk and the grounds for judging it. Acceptance is a decision to proceed despite a recognised possibility of harm or loss. A rating can inform that decision but does not make it. Identify the authorised decision-maker and any conditions attached to proceeding.
Example: A hotel assesses the risk that refurbishment noise disrupts guests. The general manager agrees to proceed with restricted work hours and alternative rooms available. The assessment supports the decision; acceptance includes those conditions rather than simply endorsing a rating.
13 · Reporting and oversight
Risk and responsibility
Managing a risk requires clear responsibility for decisions and work. The person accountable for overseeing the risk may differ from those operating controls or completing treatment actions. Assign each role to someone able to act, and make clear which decisions need another person’s authority.
Example: A hotel’s operations manager oversees the risk that guests are injured in a fire. Housekeeping keeps escape routes clear, while maintenance tests alarms. A proposed building alteration requires separate approval; overseeing the risk does not automatically grant that authority.
14 · Reporting and oversight
Indicators, incidents and assessment
Indicators and incidents provide evidence for reviewing an assessment. An indicator may signal changing conditions; an incident shows that something happened. Neither explains the whole risk on its own. Examine relevance, causes and control performance before deciding whether the likelihood, consequences or planned response should change.
Example: A restaurant sees more near misses involving wet floors, followed by a guest slipping. It reviews when floors become wet and how promptly staff respond. This evidence may justify revising its assessment and changing cleaning arrangements during service.
15 · Reporting and oversight
Changes and escalation
A change in circumstances can make an earlier assessment or decision less reliable. Review what has changed and whether existing arrangements still suffice. Escalation brings the matter to someone with the necessary authority or resources when agreed limits, conditions or decision responsibilities require it.
Example: A venue learns that the contractor providing backup power cannot attend an event. The event manager reviews the increased disruption risk and refers it to the general manager because the approved plan depended on that backup being available.
16 · Reporting and oversight
Connections between risks
Risks can be connected through a shared cause, a common dependency or one harmful occurrence contributing to another. Distinguish these relationships: two risks sharing a cause need not cause each other. Understanding the connection helps identify controls and avoid assessing related possibilities as if they were independent.
Example: A hotel power failure could spoil chilled food and disable its booking system. Both risks share a dependence on electricity. The food loss does not cause the booking disruption, although the two could occur together during the same outage.
Examine these connections in a worked situation.
Read the case studiesPlain Risk, developed by Dr Julien Maréchal. © 2026 The Governance Practice.
Original materials: CC BY 4.0. Scope and attribution.
Logos, third-party material, and website software are excluded.