Learn how to use an enterprise risk management toolkit to identify, assess, document, treat and monitor business risks. Follow a realistic worked example and practise preparing risk records and management recommendations.
Understanding risk management concepts is important. However, knowing what inherent risk, residual risk, risk appetite and risk treatment mean is different from applying those concepts in a real organisation.
Imagine joining a company as a GRC analyst.
Your manager asks you to review several business risks, evaluate existing controls, identify exposures outside the organisation's appetite and prepare a report for the next risk committee meeting.
Where would you begin?
What information would you need? How would you document your assessment? How would you demonstrate that your conclusions are supported by evidence?
This is where a structured Enterprise Risk Management (ERM) toolkit becomes useful.
An ERM toolkit helps organisations maintain consistent risk records, document assessments, track treatment decisions, monitor exposures and communicate important risk information.
In this guide, you will follow a fictional organisation through an end-to-end risk assessment and learn how to produce the documentation commonly expected from a GRC analyst.
The examples use a conventional risk register and related tracking records. Adapt the steps to the fields and instructions in the current GRC Workshop ERM Toolkit.
An Enterprise Risk Management toolkit is a collection of structured resources used to support an organisation's risk management activities.
It may include a risk register, scoring criteria, control assessment information, treatment records, risk appetite thresholds and reporting tools.
A well-designed toolkit helps answer important questions:
The toolkit provides a consistent way to organise this information.
It does not replace professional judgement, management accountability or an organisation's approved risk management methodology.
A spreadsheet can calculate a score, but it cannot independently determine whether a risk is acceptable or whether a control is genuinely effective.
Those conclusions require evidence, analysis and appropriate governance decisions.
Before adding risks, review the instructions, scoring criteria and sample records provided with the toolkit.
You should establish:
Where a toolkit includes both completed sample information and a clean template, use the sample to understand the expected structure before completing the blank version.
The risk scoring method used by an organisation should be defined and approved.
Some organisations use qualitative ratings. Others use five-by-five likelihood and impact matrices, quantitative estimates or combinations of methods.
For the worked example in this guide, we will use a fictional five-by-five matrix with the formula:
Risk score = Likelihood × Impact
This is an illustrative method, not a universal requirement.
Our case study follows Harbourview Services, a fictional UK company that provides an online booking and payment platform to small businesses.
Harbourview processes customer information and relies on several third-party technology providers.
Its main business objectives include:
The company's Technology Director has asked the GRC team to assess a growing concern about privileged user access.
A recent internal review found that some administrative accounts do not use the organisation's required multifactor authentication controls.
You have been assigned to support the assessment.
A good risk assessment begins with a clear risk statement.
Avoid recording a vague description such as:
Weak access controls.
This identifies a concern but does not adequately explain the risk scenario or business consequences.
A more useful statement is:
Due to inconsistent enforcement of multifactor authentication on privileged accounts, an unauthorised party may gain administrative access to production systems, potentially resulting in service disruption, disclosure of customer information and financial loss.
This statement identifies three components:
Cause: Inconsistent enforcement of multifactor authentication.
Uncertain event: Unauthorised administrative access.
Potential consequences: Service disruption, data disclosure and financial loss.
| Field | Example |
|---|---|
| Risk reference | CYB-001 |
| Risk category | Cybersecurity |
| Business process | Online booking and payments |
| Risk title | Unauthorised privileged access |
| Risk owner | Head of Technology |
| Risk statement | Inconsistent privileged-account MFA may enable unauthorised administrative access and cause business disruption or data exposure |
| Assessment status | Under review |
The GRC analyst can facilitate the assessment and challenge the evidence.
However, the business risk should have an accountable owner with the authority and responsibility to manage it.
In our example, the Head of Technology owns the risk.
The Identity and Access Management team may own individual controls or treatment actions.
These responsibilities should not be confused.
Before assigning likelihood and impact ratings, understand the underlying circumstances.
For Harbourview, relevant evidence might include:
During the assessment, the Technology team confirms that:
This information helps establish both the weakness and the controls that may reduce exposure.
If the organisation has not established whether all privileged accounts are included in its inventory, record that uncertainty.
Do not treat an incomplete inventory as reliable evidence that every account is protected.
A defensible risk assessment should distinguish confirmed facts from assumptions.
Inherent risk is the exposure considered before taking account of the controls relevant to the assessment, according to the organisation's approved methodology.
For Harbourview, management uses a five-by-five likelihood and impact matrix.
| Rating | Likelihood | Impact |
|---|---|---|
| 1 | Rare | Insignificant |
| 2 | Unlikely | Minor |
| 3 | Possible | Moderate |
| 4 | Likely | Major |
| 5 | Almost certain | Severe |
These labels would require more detailed definitions in an operational risk methodology.
For the fictional privileged-access scenario, the assessment team agrees:
Inherent risk score = 4 × 5 = 20.
The rationale is that privileged access could enable widespread compromise, and the absence of relevant controls would create substantial exposure.
The rating is an illustrative professional judgement, not a statistically established probability.
An ordinal score of 20 should not be interpreted as a monetary loss or compared arithmetically with financial exposure.
Now evaluate the controls that already exist.
Harbourview has implemented:
These controls may reduce the likelihood or consequences of the risk.
However, the analyst should evaluate their actual design and operation.
In this example, MFA coverage is incomplete.
The GRC team should not mark MFA as fully effective merely because the technology is available.
Design effectiveness considers whether a control, if implemented and operated as intended, is suitable for addressing the identified risk.
Operating effectiveness considers whether the control is actually functioning as intended over the relevant period or at the relevant point in time.
This distinction is important when supporting residual risk assessments.
Residual risk represents the exposure remaining after considering existing controls, using the organisation's approved assessment approach.
For the fictional example, the assessment team determines:
The team judges that existing controls reduce exposure, but incomplete MFA coverage leaves a significant risk.
These ratings must be supported by documented reasoning and evidence.
| Assessment | Likelihood | Impact | Score |
|---|---|---|---|
| Inherent risk | 4 | 5 | 20 |
| Current residual risk | 3 | 4 | 12 |
Important: Residual risk is not always calculated by subtracting a control score from inherent risk.
The organisation's methodology determines how control effectiveness influences the assessment.
The numbers above represent fictional assessments using that methodology.
Harbourview's approved policy sets a maximum acceptable residual score of 10 for the relevant cybersecurity risk category.
The current residual score is 12.
Therefore, the assessed exposure exceeds the approved boundary.
The analyst should:
The analyst should not lower the score simply to avoid a breach.
The risk owner should also not assume that acknowledging the risk is equivalent to having the authority to accept an exception.
Where the exposure requires approval beyond delegated authority, the appropriate decision-making body must be involved.
The risk owner and relevant stakeholders must determine an appropriate response.
Common treatment options include avoiding the risk, reducing it, sharing or transferring aspects of it, and accepting it through authorised governance.
For Harbourview, the preferred approach is risk reduction.
The Technology team proposes:
| Field | Example |
|---|---|
| Risk reference | CYB-001 |
| Treatment strategy | Reduce |
| Treatment action | Enforce MFA on all in-scope privileged accounts |
| Risk owner | Head of Technology |
| Action owner | Identity and Access Management Lead |
| Target completion | 30 November |
| Expected evidence | MFA configuration exports, account inventory and verification results |
| Current residual score | 12 |
| Target score | 8, subject to reassessment |
| Status | In progress |
The proposed target score of 8 is an expected future position.
It should not replace the current residual score of 12 until the planned controls have been implemented and their effectiveness evaluated.
This distinction prevents management from relying on risk reductions that have not yet been demonstrated.
A treatment plan is not complete simply because it has been entered into the register.
The analyst should monitor progress, follow up on missed deadlines and review whether the action is producing the intended result.
At the next review, Harbourview reports that MFA has been enabled for all twenty privileged accounts.
However, the GRC team discovers that two newly created administrative accounts were not included in the original inventory.
This creates a new question:
Has the organisation achieved adequate coverage, or has it simply completed the original list of actions?
The analyst should request an updated privileged-account inventory and confirm the effective control coverage.
Relevant evidence could include:
Only after the evidence is evaluated should the organisation determine whether the current residual risk has changed.
The risk record should reflect the latest supported position.
A good register maintains traceability between the initial assessment, treatment decisions, monitoring records and reassessments.
It should be possible to explain:
Do not simply overwrite important historical decisions without maintaining appropriate records.
Where your toolkit supports review history or separate action records, use those mechanisms consistently.
A risk register contains detailed information.
Management reporting should communicate the most important parts of that information clearly.
Consider this summary.
Risk: CYB-001 — Unauthorised privileged access.
Current assessment: High residual exposure, score 12.
Approved acceptance boundary: Maximum score 10.
Governance position: Outside approved appetite.
Key finding: Five identified privileged accounts did not have the required MFA configuration at the time of assessment.
Treatment: Expand MFA coverage, reconcile the account inventory and verify enforcement.
Accountable owner: Head of Technology.
Required decision: Confirm the treatment plan and any necessary interim exception through the appropriate approval authority.
Next action: Obtain control evidence and reassess current residual risk.
This report allows management to understand the exposure, treatment and decision required without reviewing every supporting register field.
A report that simply states "Risk score: 12" is incomplete.
Management needs context.
Explain what the score means under the approved methodology, why the risk matters, whether it exceeds appetite and what action is required.
Before considering the exercise complete, perform a quality review.
You are a junior GRC analyst at a fictional online retail business, Westbridge Commerce.
During a security review, you discover that a third-party inventory system has access to customer order information.
The integration uses an API credential that has not been rotated for an extended period.
Access permissions are broader than necessary, and the organisation has limited visibility of API activity.
The business depends on the integration to process customer orders.
Management has asked you to assess the risk and recommend a response.
Using the clean ERM Toolkit or an equivalent risk register:
For this exercise only:
You may make additional reasonable assumptions, provided you document them.
Risk identification: A clear scenario connecting excessive API permissions or credential compromise to possible unauthorised access and business consequences.
Assessment: Defensible likelihood and impact ratings supported by the available information and stated assumptions.
Controls: Recognition of existing safeguards, limitations and evidence gaps.
Governance: Appropriate application of the fictional appetite boundary and escalation requirements.
Treatment: Proportionate actions such as least-privilege access restrictions, credential rotation, improved monitoring and secure secrets management.
Ownership: Clear distinction between the accountable risk owner, technical action owners and GRC support.
Reporting: A concise recommendation explaining exposure, uncertainty, required decisions and follow-up.
There may be more than one defensible assessment score.
The objective is to demonstrate a sound method and reasoning, not to match an arbitrary number without justification.
Avoid entries that contain only a risk category or threat name.
A numerical score is not a substitute for understanding the scenario and supporting assumptions.
The person responsible for implementing a control is not necessarily accountable for accepting the business risk.
Target exposure must remain separate from evidenced current residual exposure.
A risk assessment should inform whether further treatment, escalation or authorised acceptance is necessary.
Completion of an action does not automatically demonstrate that the relevant risk has been sufficiently reduced.
Management requires information about what has changed, why it matters and what decision is required.
An ERM toolkit supports structured and repeatable risk management.
However, its value depends on the quality of the information entered and the decisions made from that information.
A complete risk record should connect the business objective, risk scenario, supporting evidence, assessment, controls, ownership, treatment, monitoring and reporting.
The GRC analyst helps maintain this connection by evaluating evidence, challenging assumptions, supporting governance decisions and monitoring follow-up actions.
The most important lesson is that risk management is not simply a spreadsheet exercise.
A well-maintained risk register should enable the organisation to identify important exposures, understand their implications and make informed decisions.
You have now explored the core activities involved in identifying, assessing, treating and monitoring organisational risks.
Return to the ERM Toolkit and complete the practical exercise using the clean template.
Then proceed to the ERM Pathway Assessment, which will test your ability to apply these concepts across an integrated business scenario.