main content

Risk management

In 2000, we introduced a coherent, improved risk management system across each business and workplace drawing on best practice from within and outside the Group. Its objective is to safeguard the interests of stakeholders through effective management of corporate and operational risk.

The process has several formal stages:

• the identification and definition of key business or project objectives;
• the identification and definition of relevant risks according to their nature, causes and consequences;
• and an assessment of the severity and likelihood of the risk.

Principal risks are then plotted on a matrix. Once the above process is complete, the identification of effective controls and action plans for each risk are required. Actions are then identified which will:

• avoid the risk altogether;
• reduce the opportunity for the risk to occur; and
• reduce the impact of the risk if it does occur.

A revised risk matrix is then produced.

Risk register

The key risks identified for each business, support function, contract and project are collated within a Live Risk Register to make their management easier. The Risk Register defines the severity of each risk in terms of reputation, statutory compliance and commercial impact and provides quantitative measures for the probability of the risk. The register provides a detailed worksheet for tracking each individual risk from initial identification through to full mitigation with specific responsibilities assigned and target dates agreed. Live Risk Registers are progressively updated as risks are resolved and new risks identified.

ˆ back to top