Use the framework to describe a risk, examine a proposed response or explain what is acceptable.
Start with the questions relevant to your purpose. Keep the description specific enough for someone else to understand and question it.
01
Describe a risk
Open the editable risk diagram
Identify who or what could be affected, the possible harm or loss and the circumstances in which it could occur.
There is a risk that [something happens].
Questions and guidance
- What could happen, or fail to happen?
- What could bring this about or contribute to it?
- What consequences could follow?
- Who or what could be affected, and in what respect?
- What injury, damage or loss could they suffer?
- How serious could the harm or loss be?
- What circumstances make this possible?
- What evidence supports the description?
- What is assumed or remains uncertain?
Include the period and conditions when making a claim about likelihood. Explain how a possible cause could bring about an event and how that event could affect someone or something. Consider the conditions needed for each consequence to follow.
Example
There is a risk that customers will be charged twice for the same purchase.
Customers could pay more than they owe. A software fault is one possible cause to investigate. The duplicate charge could leave a customer with less money available for essential expenses. How they are affected depends on their circumstances and when the money is returned.
Investigate how duplicate charges could occur, how likely they are and what measures could prevent or detect them.
A short label for the same possibility is “risk of double charging”.
02
Examine a control
Explain the measure’s purpose and the grounds for believing it achieves that purpose.
Someone puts a measure in place to prevent, detect or respond to a particular problem.
Questions and guidance
- What is the measure intended to prevent, detect or limit?
- Who carries it out, and when?
- What conditions does it depend on?
- What evidence shows that it is used?
- What evidence shows that it achieves its purpose?
- What other effects could it have, and who or what could be affected?
A completed check can show that an activity took place. Further evidence may be needed to establish what it achieved.
03
Explain risk appetite
State the kind and extent of risk a person or organisation is prepared to take or accept, and the circumstances in which this applies.
A person or organisation is willing to face the possibility of particular harm or loss in specified circumstances.
Questions and guidance
- What activity or decision does the statement cover?
- What possible harm or loss is acceptable, and to what extent?
- What limits or other conditions apply?
- Who has authority to approve a particular decision?
- What would require the decision to be reconsidered?
State the specific limits that express the tolerance for this activity and what should happen if they are exceeded. Check that the possible loss can be borne while other commitments are met. An appetite statement needs enough detail to guide the decisions to which it applies.
See an example
A café is willing to trial a new menu item for four weeks and accept a loss of up to $1,000, provided existing supplier payments and normal service can be maintained. Its owner may approve the trial on those terms.
The figures are illustrative. A real statement needs grounds for the chosen limit and evidence that the business can bear the loss.
See how these questions help examine a description or a decision.
Read the case studiesPlain Risk, developed by Dr Julien Maréchal. © 2026 The Governance Practice.
Original materials: CC BY 4.0. Scope and attribution.
Logos, third-party material, and website software are excluded.