Every growing company manages risk, whether or not it calls it that. Founders weigh up hiring ahead of revenue, entering a new market or taking on a large customer with demanding terms. The difficulty comes as the business scales: more people make more decisions, more systems hold more data, and the founder can no longer personally see every risk. At that point, informal instinct needs to be supported by a structured approach.
A risk management framework provides that structure. It sets out how the company identifies, assesses, manages, monitors and reports risk, and how the board oversees the process. It need not be bureaucratic. For a growing company, the best frameworks are proportionate, practical and closely tied to strategy. This guide explains the core components and how to scale them to your size.
Key takeaways
- A risk management framework links strategy, risk appetite, risk identification, controls, monitoring and board oversight into one coherent system.
- Risk appetite statements give management clear boundaries and help the board judge whether risks are acceptable.
- A risk register with consistent likelihood and impact scoring is the practical heart of the framework.
- The IIA’s Three Lines Model clarifies who owns, oversees and independently assures risk management.
- Key risk indicators provide early warning; controls should be tested, not assumed.
- Provision 29 of the UK Corporate Governance Code 2024 raises expectations on internal controls for companies applying the Code, and offers a useful benchmark for others.
Why growing companies need a framework
Growth changes the risk profile of a business. New products and markets bring new regulatory obligations. Larger customers impose contractual requirements on security, data and ESG. Investors and lenders expect evidence that risks are understood and controlled. And the consequences of failure grow with the business: a cyber incident or a major contract dispute that a small firm might absorb could seriously damage a larger one.
Directors also have legal responsibilities. Under the Companies Act 2006, they must promote the success of the company and exercise reasonable care, skill and diligence. New legislation continues to raise expectations; for example, the Economic Crime and Corporate Transparency Act 2023 created a failure to prevent fraud offence for large organisations, which came into force in September 2025 and makes reasonable fraud prevention procedures a defence. Even where a specific law does not apply to your business, the direction of travel is clear: boards are expected to understand and oversee their risks.
A framework also has commercial benefits. It helps management take risks deliberately rather than accidentally, supports investor and lender confidence, and makes the business more attractive in due diligence.
The core components of a risk management framework
Most effective frameworks, whatever their size, include the following elements:
- Governance: who is responsible for risk at board, committee and management level.
- Risk appetite: how much risk the board is willing to accept in pursuit of its objectives.
- Identification: a consistent process for identifying risks, including emerging risks.
- Assessment: a common method for scoring likelihood and impact.
- Response and controls: decisions to accept, reduce, transfer or avoid each risk, and the controls that support those decisions.
- Monitoring: key risk indicators, control testing and regular review.
- Reporting: clear, timely information to the board and its committees.
The framework should be documented in a short risk management policy approved by the board, setting out these elements, roles and the review cycle.
Defining your risk appetite
Risk appetite is the amount and type of risk the board is willing to take to achieve its strategic objectives. Without it, there is no consistent way to judge whether a risk is acceptable.
Appetite usually varies by risk category. A growing technology company might have a high appetite for product innovation risk, a moderate appetite for market expansion risk, and a very low appetite for regulatory breaches, health and safety failures or loss of customer data. Expressing these in plain language, supported where possible by measurable tolerances, gives management clear boundaries.
Examples of appetite statements
- Financial: “We will maintain cash headroom of at least six months’ operating costs and will not enter agreements that breach banking covenants.”
- Customer concentration: “No single customer should represent more than a defined share of annual revenue without board approval.”
- Compliance: “We have no appetite for knowingly breaching laws or regulations.”
- Technology: “We accept limited disruption to non-critical systems but have a very low tolerance for downtime of customer-facing platforms.”
The board should review risk appetite at least annually, and whenever strategy changes significantly.
Building a practical risk register
The risk register is the working tool of the framework. It records each significant risk, its owner, its assessment, the controls in place and the actions planned. A good register is concise, current and used, not a spreadsheet that is updated once a year before the audit.
What to record for each risk
- a clear description, ideally in a “cause, event, consequence” format;
- the risk owner, a named individual rather than a department;
- inherent score, before controls;
- key existing controls;
- residual score, after controls;
- target score, consistent with risk appetite;
- further actions, owners and deadlines;
- key risk indicators and trend.
Scoring likelihood and impact
A five-point scale for both likelihood and impact is common and easy to use. Multiplying the two produces a score from 1 to 25, which can be banded to guide the response. Define each level in terms that make sense for your business, for example linking impact to financial loss, customer disruption, regulatory consequences and reputation.
| Score | Likelihood | Impact | Combined score band | Typical response |
|---|---|---|---|---|
| 1 | Rare: unlikely in the next five years | Negligible: minimal financial or operational effect | 1–4: Low | Accept and monitor through normal management |
| 2 | Unlikely: could occur within five years | Minor: limited, short-term disruption | 5–9: Moderate | Manage within existing controls; review periodically |
| 3 | Possible: could occur within two to three years | Moderate: noticeable financial loss or customer impact | 10–14: Significant | Active management with named owner and action plan |
| 4 | Likely: expected within the next year | Major: serious financial loss, regulatory scrutiny or reputational harm | 15–19: High | Senior management priority; regular board reporting |
| 5 | Almost certain: expected within months | Severe: threatens viability or strategy | 20–25: Critical | Immediate action; board-level oversight and escalation |
For example, a supplier dependency scored as “possible” (3) with a “major” impact (4) gives a combined score of 12, placing it in the significant band and requiring an owner and an action plan.
Tip: Scores are a tool for prioritisation, not a precise measurement. Focus discussion on whether the residual risk is within appetite and whether the actions are on track, rather than debating whether a risk is a 12 or a 15.
Principal and emerging risks
Not every risk on the register needs board attention. The board should focus on the company’s principal risks: those that, individually or together, could seriously affect its business model, future performance, solvency or liquidity. For most growing companies, this means a list of around eight to fifteen risks, reviewed in depth at least annually and monitored at each board meeting.
Emerging risks deserve separate attention. These are developing risks whose likelihood and impact are uncertain, such as new regulation, changes in technology like generative AI, shifts in customer behaviour or climate-related impacts. A short annual horizon-scanning discussion, informed by management, NEDs and external advisers, helps ensure the business is not taken by surprise. Climate and sustainability risks increasingly feature here, and our ESG roadmap for SMEs explains how to integrate them.
Controls and key risk indicators
Designing effective controls
Controls are the policies, procedures, systems and checks that reduce the likelihood or impact of a risk. They can be preventive, such as approval limits and segregation of duties, or detective, such as reconciliations and exception reports. Good controls are clearly owned, documented, proportionate to the risk and tested periodically. A control that exists only on paper provides false comfort.
Common control areas for growing companies include financial approvals and payments, revenue recognition, payroll, access to systems and data, contract approval, health and safety, and information security. Cyber controls deserve particular attention; our guide to cyber security for boards covers the key questions directors should ask.
Key risk indicators
Key risk indicators (KRIs) are metrics that provide early warning that a risk is increasing. Unlike KPIs, which measure performance, KRIs signal potential trouble ahead. Examples include:
- cash runway or forecast covenant headroom;
- percentage of revenue from the largest customer;
- staff turnover in critical roles;
- number of overdue security patches or failed backup tests;
- customer complaints or service-level breaches;
- overdue actions on the risk register.
Set thresholds for each KRI that trigger escalation, aligned to risk appetite, and include a small KRI dashboard in board reporting.
The three lines model
The Institute of Internal Auditors’ Three Lines Model, updated in 2020, is a widely used way of clarifying roles in risk management and assurance. It describes:
- The governing body: the board, which is accountable to stakeholders for oversight, sets direction and appetite, and ensures appropriate structures are in place.
- First line roles: operational management, who own and manage risks as part of delivering products and services.
- Second line roles: functions such as risk, compliance, finance or health and safety, which provide expertise, support, monitoring and challenge on risk management.
- Third line roles: internal audit, which provides independent and objective assurance and advice to the board on the adequacy and effectiveness of governance and risk management.
External assurance providers, such as external auditors and certification bodies, provide further independent assurance. In a smaller company, the second and third lines may be thin or combined, perhaps with the finance director providing much of the second line and an outsourced internal audit provider or periodic external review providing the third. What matters is that someone independent of day-to-day management checks that key controls work.
Need a proportionate risk framework?
BoardroomUK helps growing companies design risk management frameworks, risk registers and board reporting that match their size and ambitions, and supports boards preparing for higher governance standards.
Board and audit committee oversight
The board is ultimately responsible for risk management and internal control. In larger companies, much of the detailed work is delegated to an audit committee, or a separate risk committee, made up of independent non-executive directors. The committee typically reviews the risk register and principal risks, oversees internal and external audit, monitors the effectiveness of internal controls and reports its conclusions to the board.
Provision 29 of the UK Corporate Governance Code 2024
The Financial Reporting Council published the UK Corporate Governance Code 2024 in January 2024. Most of it applies to financial years beginning on or after 1 January 2025, but Provision 29 applies to financial years beginning on or after 1 January 2026. It requires the board to monitor the company’s risk management and internal control framework and, at least annually, review its effectiveness. The annual report should include a description of how the board has monitored and reviewed the framework, a declaration of effectiveness of the material internal controls as at the balance sheet date, and a description of any material controls that have not operated effectively, together with the action taken or proposed.
The Code applies on a “comply or explain” basis to companies within its scope, broadly those with shares in the commercial companies category of the FCA’s listing regime. Private companies are not bound by it, but Provision 29 is a useful benchmark: investors, lenders and acquirers increasingly expect boards to understand which controls are material and to be able to evidence that they work. Our guide to the UK Corporate Governance Code covers the wider changes.
Effective board reporting on risk
- a summary of principal risks, their residual scores and trends against appetite;
- KRIs that have breached thresholds, with explanations;
- significant incidents and near misses;
- progress on key actions;
- emerging risks identified since the last review;
- the results of any control testing or internal audit work.
Scaling the framework for SMEs
A framework designed for a listed group will overwhelm a 50-person business. Proportionality is essential.
- Keep the register short: 15 to 30 well-described risks are more useful than 150 vague ones.
- Use simple tools: a well-structured spreadsheet or board software is enough for many SMEs.
- Embed risk in existing meetings: review risks in management meetings and as a standing board agenda item rather than creating new committees too early.
- Assign clear ownership: every principal risk should have a named senior owner.
- Bring in independent challenge: a non-executive director with audit or risk experience can provide much of the oversight a committee would in a larger company.
- Grow the framework with the business: add formal committees, internal audit and control testing as complexity, investment and regulatory exposure increase.
Tip: Start by holding a two-hour risk workshop with the leadership team and at least one independent voice. Agree the top ten risks, owners and appetite, then build the register from there. You can refine the framework over the following year.
Frequently asked questions
What is a risk management framework?
It is the set of policies, processes, roles and tools a company uses to identify, assess, manage, monitor and report risk, together with the board’s oversight of that process. It links risk management to strategy and risk appetite.
Does Provision 29 apply to private companies?
No. Provision 29 forms part of the UK Corporate Governance Code 2024, which applies on a comply or explain basis to companies within its scope, broadly those in the commercial companies listing category. Private companies may still find it a useful benchmark for good practice.
How often should the risk register be reviewed?
Risk owners should keep their risks current, management should review the register regularly, often monthly or quarterly, and the board should review principal risks at least quarterly, with a deeper annual review alongside risk appetite.
What is the difference between a KPI and a KRI?
A key performance indicator measures how well the business is achieving its objectives. A key risk indicator provides early warning that a particular risk is increasing, so that action can be taken before it materialises.
Do small companies need an audit committee?
Not necessarily. Many SMEs handle risk and audit matters at full board level. An audit committee becomes more valuable as the company grows, takes on outside investment or prepares for a listing.
Last reviewed:
